Splunk Dev

SplunkSDK SplunkJS oneshotSearch unable to get splunk query result as response

AnandSurya
New Member

Hi Team,

I am using SplunkSDK version 1.12.1 (splunk-sdk@1.12.1). We are using oneshotSearch to get splunk query data from the Get api. Please see below code snippet for executeSearch

 

 

module.exports.executeSearch = function (query, params, cb) {        
        splunkService.oneshotSearch(query, params, function (err, results) {
        console.log("Query is : "+query);
        cb(err, results);
  });
};

 

 

Below code is from where we are calling above 

 

 

SplunkQuery.executeSearch(splunkSearch, splunkParams, function (err, results) {  
   if (err) {
      if (err.data && err.data.messages) {
        Log.error(err.data.messages);
      }
      var error = Boom.badRequest();
      error.reformat();
      error.output.payload = Response.buildResponse(Errors.ERROR_RECORD_RETRIEVAL_FAILURE, []);
      // return reply(error);
      throw err;
    }
    var events = [];
    var rawRowIndex = results.fields.indexOf('_raw');
    if (results.rows.length == 0 && request.query.id) {
      var error = Boom.badRequest();
      error.reformat();
      error.output.payload = Response.buildResponse(Errors.ERROR_INVALID_ID_PARAM, []);
      return h.response(error);
    }

    for (var i = 0; i < results.rows.length; i++) {
      var splunkRecord = results.rows[i];
      Log.info("splunkRecord"+splunkRecord);
      if (splunkRecord && splunkRecord[rawRowIndex]) {
        var rawRecord = splunkRecord[rawRowIndex];        
    events.push(Util.splunkRecordToEvent(JSON.parse(rawRecord.replace(/\nValue of UseDynamoDB = True/g, ''))));
       }
    }
   Log.info("end splunck sear");
   Log.info('Splunk search completed, events count:'+events.length);
   h.response(Response.buildResponse(0, events));
  });

 

 

I can see the result or events in console with the search count (Splunk Search completed, events count: ) log as well. But I am getting 500 error as response through curl and postman too. What code changes I have to do to get the result data as response. Please suggest. Thank you

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...