- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SplunkSDK SplunkJS oneshotSearch unable to get splunk query result as response
AnandSurya
New Member
08-09-2024
02:53 AM
Hi Team,
I am using SplunkSDK version 1.12.1 (splunk-sdk@1.12.1). We are using oneshotSearch to get splunk query data from the Get api. Please see below code snippet for executeSearch
module.exports.executeSearch = function (query, params, cb) {
splunkService.oneshotSearch(query, params, function (err, results) {
console.log("Query is : "+query);
cb(err, results);
});
};
Below code is from where we are calling above
SplunkQuery.executeSearch(splunkSearch, splunkParams, function (err, results) {
if (err) {
if (err.data && err.data.messages) {
Log.error(err.data.messages);
}
var error = Boom.badRequest();
error.reformat();
error.output.payload = Response.buildResponse(Errors.ERROR_RECORD_RETRIEVAL_FAILURE, []);
// return reply(error);
throw err;
}
var events = [];
var rawRowIndex = results.fields.indexOf('_raw');
if (results.rows.length == 0 && request.query.id) {
var error = Boom.badRequest();
error.reformat();
error.output.payload = Response.buildResponse(Errors.ERROR_INVALID_ID_PARAM, []);
return h.response(error);
}
for (var i = 0; i < results.rows.length; i++) {
var splunkRecord = results.rows[i];
Log.info("splunkRecord"+splunkRecord);
if (splunkRecord && splunkRecord[rawRowIndex]) {
var rawRecord = splunkRecord[rawRowIndex];
events.push(Util.splunkRecordToEvent(JSON.parse(rawRecord.replace(/\nValue of UseDynamoDB = True/g, ''))));
}
}
Log.info("end splunck sear");
Log.info('Splunk search completed, events count:'+events.length);
h.response(Response.buildResponse(0, events));
});
I can see the result or events in console with the search count (Splunk Search completed, events count: ) log as well. But I am getting 500 error as response through curl and postman too. What code changes I have to do to get the result data as response. Please suggest. Thank you
