Splunk Search

How to return search manager result as JSON

Explorer

I have this code to display values of the search manager in the console but in array format,

var mySearch = splunkjs.mvc.Components.getInstance("search1");
        mySearch.on("search:done", function() {
            var results = mySearch.data("results")
            results.on("data", function(){
                console.log("Data (rows): ", results.data().rows);
            });
        });

Can the result be converted to JSON format? Thanks

0 Karma
1 Solution

Champion

Have a look at this page from the tutorial, especially the block of code in point 6. You'll see the following lines:

var manager = splunkjs.mvc.Components.getInstance('sankey-search');
var data = manager.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

There you'll also see how to use them.

As a side remark, what you're doing in your code above is adding a function to your event listener every time the search returns results. Every time mySearch fires the event search:done, you're adding a new listener to the data event of mySearch.data("results"). Your code should instead look like this:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("results"); // get the data from that search
// When data arrives:
myResults.on("data", function() {
    ...
});

You use the search:done event for actions such as changing the display of a custom visualization from a notice such as "Waiting for search to complete..." to displaying actual data.

View solution in original post

Contributor

hi
i triyed this solution but splunk return error
mySearch.data is not a function

0 Karma

Champion

You probably didn't use the right id. You should set an id in Simple XML like this:

<search id="search_id">

and get it in js with

var mySearch = splunkjs.mvc.Components.getInstance("search_id");
0 Karma

Champion

Have a look at this page from the tutorial, especially the block of code in point 6. You'll see the following lines:

var manager = splunkjs.mvc.Components.getInstance('sankey-search');
var data = manager.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

There you'll also see how to use them.

As a side remark, what you're doing in your code above is adding a function to your event listener every time the search returns results. Every time mySearch fires the event search:done, you're adding a new listener to the data event of mySearch.data("results"). Your code should instead look like this:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("results"); // get the data from that search
// When data arrives:
myResults.on("data", function() {
    ...
});

You use the search:done event for actions such as changing the display of a custom visualization from a notice such as "Waiting for search to complete..." to displaying actual data.

View solution in original post

Explorer
var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
        var myResults = mySearch.data('results', { // get the data from that search
            output_mode: 'json_rows',
            count: 0 // get all results
        });
        // When data arrives:
        myResults.on("data", function() {
            console.log(myResults.data().rows);
        });

I used this to display the result on console but it is not on JSON format. The other thing is, it displays "Cannot read property 'rows' of undefined"

I have real time search manager.

0 Karma

Champion

As a rule of thumb, don't use real time searches to test stuff - they sometimes behave differently.
Also, as the error message implied, if you use the JSON output format, you no longer have the rows you used to get with the old method. Instead, you now use the toJSON() method of the underlying collection(). It should be something like this:

var mySearch = splunkjs.mvc.Components.getInstance("cacheSearch"); // get the search manager
var myResults = mySearch.data('results', { // get the data from that search
    output_mode: 'json_rows',
    count: 0 // get all results
});
// When data arrives:
myResults.on("data", function() {
    console.log(myResults.collection().toJSON());
});
0 Karma

Explorer

Im not testing stuff. I actually getting them and put inside a conditional statement.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!