Unable to get resultsfrom search with splunk-sdk for node.js

[eholz1]

Hello Members!

I have been attempting to get search results using the splunk-sdk for node.js. I am using version 24. of node.

I have and can use the Python splunk-sdk without issue, works well! I have been having no joy with the

node.js splunk-sdk.

I can easily create a search in node, lgin in to splunk via the sdk, and return a sid - no problem there.

But, I want to get the results of the search using the retreived sid. So far, even with AI and internet help, I have 

been unable to get the results . I always get "unhandled errors" - I have tried using an "async myFunc()" etc, no dice.  My goal here is to: have a function that gets a sid, and then another function that using the side to get search results. My over all plan is this: Get a webhook POST from a Splunk alert, get the sid from the payload, use this sid to perform a GET request to return results.  I am using a "server" created by node.js.

The whold process above works fine with Python and Flask. I want to have persistent data on my "web page", so it is my understaning that JavaScript/Node has more "capability". Also I do have "express" installed in my node environment. It is my understanding that using "promisify" is deprecated - I have not got that to work either. 

Whata am I missing in terms of getting search results using the splunk-sdk for node?

Thanks So Much,

eholz1 - frustrated!

[livehybrid · Accepted solution]

Hi @eholz1 

Here is a working example of getting results by SID if it helps.

const splunkjs = require('splunk-sdk');

const service = new splunkjs.Service({
    host: "yourSplunkServer",
    port: 8089,
    username: "admin",
    password: "yourPassword",
    scheme: "https"
});

` Wrap callback-based SDK methods in promises `
function getResults(sid) {
    return new Promise((resolve, reject) => {
        service.login((err) => {
            if (err) return reject(err);

            service.jobs().fetch((err, jobs) => {
                if (err) return reject(err);

                const job = jobs.item(sid);
                if (!job) return reject(new Error(`Job not found: ${sid}`));

                job.fetch((err, job) => {
                    if (err) return reject(err);

                    if (!job.properties().isDone) {
                        return reject(new Error("Job not yet complete"));
                    }

                    job.results({}, (err, results) => {
                        if (err) return reject(err);
                        resolve(results.rows);
                    });
                });
            });
        });
    });
}

` Usage with Express `
const express = require('express');
const app = express();
app.use(express.json());

app.post('/getSID', async (req, res) => {
    try {
        const sid = req.body.sid;
        const results = await getResults(sid);
        res.json({ results });
    } catch (err) {
        console.error(err);
        res.status(500).json({ error: err.message });
    }
});

app.listen(3000);

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[eholz1]

As Always, the Splunk community comes to the rescue. Thanks for the input.

I know have a better understanding on how to implement this feature.

Thanks Again,

eholz1