Splunk Search

How to wait for the SearchManager job to finish?

chrismok
Path Finder

Currently, I run the search query and get the last 3 records, basic on these records and generate the charts. However I find that the "save array job will run after the page load end", and the a.length is zero.

So I would like to know how I can wait for the query result first

 var scope = new SearchManager({
             "id": "scope",
             "status_buckets": 0,
             "search": "sourcetype=\"test_buildlog\" |table b",
             "app": utils.getCurrentApp(),
             "runWhenTimeIsUndefined": false
             }, {
                 tokens: true, tokenNamespace: "submitted"
         });

         var s = scope.data('results');
            s.on("data", function () {

                for (var n = 0; n <= r.data().rows.length - 1; n++) {
                  //insert the data to array
                    a.push(r.data().rows[n][0]);
                }


         for (var i = 0; i <= a.length - 1; i++) {
            ......
           ......basic on the array data create another search query
            ......
}
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

View solution in original post

bhawkins1
Communicator

If you listen to SearchManager.on("search:done", fn); you'll not be able to reliably read result rows from SearchManager.data("results").data() - consistent with that, SearchManager.data("results").hasData() will sometimes return false.

Instead, use the results object's .on("data", fn); listener, like @slashnburn mentions above:

const search_man; // : SearchManager

const results = search_man.data("results");

results.on("data", () => {
    if (results.hasData()) {
        console.log(results.data().rows);
    }
});

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

martin_mueller
SplunkTrust
SplunkTrust

I think part of your comment was lost.

In general, listening to "search:done" events works like this:

myResults.on("search:done", function() {
  console.log("Woohoo, all done!");
});
0 Karma

bhawkins1
Communicator

I just wasted a few hours working out why my code wasn't working, because the search:done listener is subtly annoying in that it makes no guarantee about the presence of its SearchManager's .data('results').hasData() value.

In other words. definitely prefer to use SearchManager.data("results").on("data") if you want to use the data values, and not just notify when the search is done.

0 Karma

bhawkins1
Communicator

To be more specific, I was running an array of search managers using the search:done listener and about 1 in 8 had no results when the query would otherwise produce them. This would also occur predictably and for the same queries. Changing the listener to results.on("data") solved the problem.

0 Karma

slashnburn
Path Finder

Could you provide a little more insight?

myResults = new SearchManager({
            id: "mysearch",
            search: "mycustomsearch",
            data: "results",
            status_buckets: 300,
            preview: true,
            cache: false
        }, {tokens: true}).data("results").on("data", function() {
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...