Splunk Search

How to return search manager result as JSON

josefa123
Explorer

I have this code to display values of the search manager in the console but in array format,

var mySearch = splunkjs.mvc.Components.getInstance("search1");
        mySearch.on("search:done", function() {
            var results = mySearch.data("results")
            results.on("data", function(){
                console.log("Data (rows): ", results.data().rows);
            });
        });

Can the result be converted to JSON format? Thanks

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Have a look at this page from the tutorial, especially the block of code in point 6. You'll see the following lines:

var manager = splunkjs.mvc.Components.getInstance('sankey-search');
var data = manager.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

There you'll also see how to use them.

As a side remark, what you're doing in your code above is adding a function to your event listener every time the search returns results. Every time mySearch fires the event search:done, you're adding a new listener to the data event of mySearch.data("results"). Your code should instead look like this:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("results"); // get the data from that search
// When data arrives:
myResults.on("data", function() {
    ...
});

You use the search:done event for actions such as changing the display of a custom visualization from a notice such as "Waiting for search to complete..." to displaying actual data.

View solution in original post

sfatnass
Contributor

hi
i triyed this solution but splunk return error
mySearch.data is not a function

0 Karma

jeffland
SplunkTrust
SplunkTrust

You probably didn't use the right id. You should set an id in Simple XML like this:

<search id="search_id">

and get it in js with

var mySearch = splunkjs.mvc.Components.getInstance("search_id");
0 Karma

jeffland
SplunkTrust
SplunkTrust

Have a look at this page from the tutorial, especially the block of code in point 6. You'll see the following lines:

var manager = splunkjs.mvc.Components.getInstance('sankey-search');
var data = manager.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

There you'll also see how to use them.

As a side remark, what you're doing in your code above is adding a function to your event listener every time the search returns results. Every time mySearch fires the event search:done, you're adding a new listener to the data event of mySearch.data("results"). Your code should instead look like this:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("results"); // get the data from that search
// When data arrives:
myResults.on("data", function() {
    ...
});

You use the search:done event for actions such as changing the display of a custom visualization from a notice such as "Waiting for search to complete..." to displaying actual data.

josefa123
Explorer
var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
        var myResults = mySearch.data('results', { // get the data from that search
            output_mode: 'json_rows',
            count: 0 // get all results
        });
        // When data arrives:
        myResults.on("data", function() {
            console.log(myResults.data().rows);
        });

I used this to display the result on console but it is not on JSON format. The other thing is, it displays "Cannot read property 'rows' of undefined"

I have real time search manager.

0 Karma

jeffland
SplunkTrust
SplunkTrust

As a rule of thumb, don't use real time searches to test stuff - they sometimes behave differently.
Also, as the error message implied, if you use the JSON output format, you no longer have the rows you used to get with the old method. Instead, you now use the toJSON() method of the underlying collection(). It should be something like this:

var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
var myResults = mySearch.data('results', { // get the data from that search
    output_mode: 'json_rows',
    count: 0 // get all results
});
// When data arrives:
myResults.on("data", function() {
    console.log(myResults.collection().toJSON());
});
0 Karma

josefa123
Explorer

Im not testing stuff. I actually getting them and put inside a conditional statement.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...