Splunk Search

Blocking searches using splunkJS-stack?

ahmetcepoglu
Engager

I have multiple searches, and I need their results in a particular order.

I am trying to make a splunk view that shows results from multiple searches.

I am under the impression that to make it a splunk view, it must be created using splunk web-framework and has django bindings and whatnot. And because of that, it cannot have blocking searches.

I need to be able to retrieve search results in a particular order, so I am going to need blocking searches.

My question is, can I have blocking searches in a splunk-django application?

Tags (3)
0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hi ahmetcepoglu,

You can do this using the web-framework, and you don't need to use Django. The web-framework provides Django functionality, but everything is also available from javascript. You can also write an application that mixes Django with JavaScript.

Your scenario can be accomplished by creating searchmanagers and listening to their done events. You'll have Javascript that looks something like this:

var myManager = new SearchManager({
   id: 'myManager'
   search: '<your search here>
});
myManager.on('search:done', function(){
   //start next manager
});

If you want more samples and explanations, the framework toolkit is a good place to start: http://apps.splunk.com/app/1613/

magnew_splunk
Splunk Employee
Splunk Employee

Yes, but if your goal is to run searches one after another, you can use it. For each search manager, you can set autostart to false on creation. Then, you can start them when you want by calling startSearch on them. So for instance, if I wanted to run two searches in sequence, I could do something like this:

var myManager = new SearchManager({
id: 'myManager',
search: your search
});

var myManager2 = new SearchManager({
id: 'myManager',
autostart: false,
search: your search
});

myManager.on('search:done', function(){
myManager2.startSearch();
});

0 Karma

ahmetcepoglu
Engager

Isn't that nonblocking call?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...