How to return search manager result as JSON

[josefa123]

I have this code to display values of the search manager in the console but in array format,

var mySearch = splunkjs.mvc.Components.getInstance("search1");
        mySearch.on("search:done", function() {
            var results = mySearch.data("results")
            results.on("data", function(){
                console.log("Data (rows): ", results.data().rows);
            });
        });

Can the result be converted to JSON format? Thanks

[sfatnass]

hi
i triyed this solution but splunk return error
mySearch.data is not a function

[jeffland]

You probably didn't use the right id. You should set an id in Simple XML like this:

<search id="search_id">

and get it in js with

var mySearch = splunkjs.mvc.Components.getInstance("search_id");

[jeffland · Accepted solution]

Have a look at this page from the tutorial, especially the block of code in point 6. You'll see the following lines:

var manager = splunkjs.mvc.Components.getInstance('sankey-search');
var data = manager.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

There you'll also see how to use them.

As a side remark, what you're doing in your code above is adding a function to your event listener every time the search returns results. Every time mySearch fires the event search:done, you're adding a new listener to the data event of mySearch.data("results"). Your code should instead look like this:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("results"); // get the data from that search
// When data arrives:
myResults.on("data", function() {
    ...
});

You use the search:done event for actions such as changing the display of a custom visualization from a notice such as "Waiting for search to complete..." to displaying actual data.

[josefa123]

var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
        var myResults = mySearch.data('results', { // get the data from that search
            output_mode: 'json_rows',
            count: 0 // get all results
        });
        // When data arrives:
        myResults.on("data", function() {
            console.log(myResults.data().rows);
        });

I used this to display the result on console but it is not on JSON format. The other thing is, it displays "Cannot read property 'rows' of undefined"

I have real time search manager.

[jeffland]

As a rule of thumb, don't use real time searches to test stuff - they sometimes behave differently.
Also, as the error message implied, if you use the JSON output format, you no longer have the rows you used to get with the old method. Instead, you now use the toJSON() method of the underlying collection(). It should be something like this:

var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
var myResults = mySearch.data('results', { // get the data from that search
    output_mode: 'json_rows',
    count: 0 // get all results
});
// When data arrives:
myResults.on("data", function() {
    console.log(myResults.collection().toJSON());
});

[josefa123]

Im not testing stuff. I actually getting them and put inside a conditional statement.