Dashboards & Visualizations

ldapsearch in javascript: search:done event fires before results are really received

tfellinger
New Member

Hello fellow splunkers,

I have a dashboard with some custom javascript looking like this:

   // Define search command to find email addresses of managers
    var search_managersMail = new SearchManager({
      id: "search_managersMail",
      search: mvc.tokenSafe('| ldapsearch domain=default search="(&(objectClass=group)(distinguishedName=$manager_selected$))" | ldapgroup | mvexpand member_dn | ldapfilter domain=default search="(&(distinguishedName=$$member_dn$$)(samAccountType=805306368))" attrs="mail" | fields mail'),
      autostart: false,
      cache: false,
      exec_mode: "blocking"
    });

    // Action when save button is clicked
    $("#btn-submit").on("click", function (){
        search_managersMail.startSearch();
        // Handle results if search is done
        search_managersMail.on("search:done", function(properties) {
        var search_managersMailResults = search_managersMail.data("results");
          for (i = 0; i < search_managersMailResults.data().rows.length; i++){
            managersMail += "," + search_managersMailResults.data().rows[i][0];

The problem looks like a race condition to me.
When the button btn-submit is pressed and the code hits the line "for (i = 0; i < search_managersMailResults.data().rows.length; i++){" I get in the debugger: search_managersMailResults.data() is undefined.

Just a second after this I see that the results are coming in via a GET Request...so the question is: Why does search:done even fire, when the results are not really here already. Is it because of ldapsearch? Is this approach not doable with ldapsearch?

In my lab this works fine, so the code should be good enough...but in the production enviroment I always get this error that the search_managersMailResults.data() is undefined and afterwards I see the correct results flying in...why is this happening in this order? Is there any way to make the code really wait for the results of the search before parsing the results?

Thanks,
Thomas

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I've typically done it this way. This ensures that your code only executes if there is data. There might be a problem with preview data, I can't remember, but this should work.

 var systemStateDevices = splunkjs.mvc.Components.getInstance("<srchManagerID>");
 var systemStateDevicesResults = systemStateDevices.data("results");

 systemStateDevicesResults.on("data", function() {
  _.each(systemStateDevicesResults.data().rows, function (row, rowCount) {
    ///do with data
    });
});

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I've typically done it this way. This ensures that your code only executes if there is data. There might be a problem with preview data, I can't remember, but this should work.

 var systemStateDevices = splunkjs.mvc.Components.getInstance("<srchManagerID>");
 var systemStateDevicesResults = systemStateDevices.data("results");

 systemStateDevicesResults.on("data", function() {
  _.each(systemStateDevicesResults.data().rows, function (row, rowCount) {
    ///do with data
    });
});
0 Karma

jeffland
SplunkTrust
SplunkTrust

The code in this answer is a good idea, you'll have to add the code to start the search on button click below the on("data"-function. In your code, you are adding new event listeners to the search with each click of the button, and adding further new event listeners in those events. You only have to define what happens on returning results once, search_managersMail.on("search:done" is not needed at all.

0 Karma

tfellinger
New Member

Thx guys! Works great! 🙂

0 Karma

tfellinger
New Member

Hello,

great! Thanks for the workaround...I will try this today.
As you do it differently I guess you don't know exactly why my code is not working?

Do you use your approach also with ldapsearch? I am a bit sceptical if ldapsearch is really compatible with procedures like this...

Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...