Splunk Search

Blocking searches using splunkJS-stack?

ahmetcepoglu
Engager

I have multiple searches, and I need their results in a particular order.

I am trying to make a splunk view that shows results from multiple searches.

I am under the impression that to make it a splunk view, it must be created using splunk web-framework and has django bindings and whatnot. And because of that, it cannot have blocking searches.

I need to be able to retrieve search results in a particular order, so I am going to need blocking searches.

My question is, can I have blocking searches in a splunk-django application?

Tags (3)
0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hi ahmetcepoglu,

You can do this using the web-framework, and you don't need to use Django. The web-framework provides Django functionality, but everything is also available from javascript. You can also write an application that mixes Django with JavaScript.

Your scenario can be accomplished by creating searchmanagers and listening to their done events. You'll have Javascript that looks something like this:

var myManager = new SearchManager({
   id: 'myManager'
   search: '<your search here>
});
myManager.on('search:done', function(){
   //start next manager
});

If you want more samples and explanations, the framework toolkit is a good place to start: http://apps.splunk.com/app/1613/

magnew_splunk
Splunk Employee
Splunk Employee

Yes, but if your goal is to run searches one after another, you can use it. For each search manager, you can set autostart to false on creation. Then, you can start them when you want by calling startSearch on them. So for instance, if I wanted to run two searches in sequence, I could do something like this:

var myManager = new SearchManager({
id: 'myManager',
search: your search
});

var myManager2 = new SearchManager({
id: 'myManager',
autostart: false,
search: your search
});

myManager.on('search:done', function(){
myManager2.startSearch();
});

0 Karma

ahmetcepoglu
Engager

Isn't that nonblocking call?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...