Splunk Search

Cannot access results of a Searchmanager in a for loop

mariuswal
New Member

I have a dashboard that should perform a dynamic number of searches. For this purpose I created a search manager, which receives new search strings via a For loop. Via an on-data listener I access the results of the search manager. If I have only one pass of the loop, I get the correct results, but already with two passes I get the result of the second search output twice. I have attached a minimal example of the problem here.

searchmanager = new SearchManager(…)
for (var i = 0; i < array.length; i++) {
     var search_string = "| makeresults | eval a=" + i + " | table a";

      searchmanager.settings.set("search", search_string);
      searchmanager.startSearch();

     var results = searchmanager.data("results");

     searchmanager.on("search:done", function() {
           results.on("data", function() {
               if (results.data()) {
                    var fields = results.data().fields;
                    var rows = results.data().rows;

                    console.log(rows);
                }

            })
        })
    }

The output of the console is for an array of a length of two always twice an object with "1" as the result and not one time "0" and then "1" as one would expect. For an array of a length of one the result is an object with "0" as the result.

I suspect the on("data") listener because i checked the search string and everything and at any given point there is the difference of the value in the objects but as soon as I try to enter the result with the listener it only gives me the result with "1" in the row.

I also tried to put the results in an array and access the result object after that with no success.

I hope someone can help me and that the minimal example helps to explain my problem. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...