Splunk Search

Blocking searches using splunkJS-stack?

ahmetcepoglu
Engager

I have multiple searches, and I need their results in a particular order.

I am trying to make a splunk view that shows results from multiple searches.

I am under the impression that to make it a splunk view, it must be created using splunk web-framework and has django bindings and whatnot. And because of that, it cannot have blocking searches.

I need to be able to retrieve search results in a particular order, so I am going to need blocking searches.

My question is, can I have blocking searches in a splunk-django application?

Tags (3)
0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hi ahmetcepoglu,

You can do this using the web-framework, and you don't need to use Django. The web-framework provides Django functionality, but everything is also available from javascript. You can also write an application that mixes Django with JavaScript.

Your scenario can be accomplished by creating searchmanagers and listening to their done events. You'll have Javascript that looks something like this:

var myManager = new SearchManager({
   id: 'myManager'
   search: '<your search here>
});
myManager.on('search:done', function(){
   //start next manager
});

If you want more samples and explanations, the framework toolkit is a good place to start: http://apps.splunk.com/app/1613/

magnew_splunk
Splunk Employee
Splunk Employee

Yes, but if your goal is to run searches one after another, you can use it. For each search manager, you can set autostart to false on creation. Then, you can start them when you want by calling startSearch on them. So for instance, if I wanted to run two searches in sequence, I could do something like this:

var myManager = new SearchManager({
id: 'myManager',
search: your search
});

var myManager2 = new SearchManager({
id: 'myManager',
autostart: false,
search: your search
});

myManager.on('search:done', function(){
myManager2.startSearch();
});

0 Karma

ahmetcepoglu
Engager

Isn't that nonblocking call?

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...