Splunk Search

How to wait for the SearchManager job to finish?

chrismok
Path Finder

Currently, I run the search query and get the last 3 records, basic on these records and generate the charts. However I find that the "save array job will run after the page load end", and the a.length is zero.

So I would like to know how I can wait for the query result first

 var scope = new SearchManager({
             "id": "scope",
             "status_buckets": 0,
             "search": "sourcetype=\"test_buildlog\" |table b",
             "app": utils.getCurrentApp(),
             "runWhenTimeIsUndefined": false
             }, {
                 tokens: true, tokenNamespace: "submitted"
         });

         var s = scope.data('results');
            s.on("data", function () {

                for (var n = 0; n <= r.data().rows.length - 1; n++) {
                  //insert the data to array
                    a.push(r.data().rows[n][0]);
                }


         for (var i = 0; i <= a.length - 1; i++) {
            ......
           ......basic on the array data create another search query
            ......
}
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

View solution in original post

bhawkins1
Communicator

If you listen to SearchManager.on("search:done", fn); you'll not be able to reliably read result rows from SearchManager.data("results").data() - consistent with that, SearchManager.data("results").hasData() will sometimes return false.

Instead, use the results object's .on("data", fn); listener, like @slashnburn mentions above:

const search_man; // : SearchManager

const results = search_man.data("results");

results.on("data", () => {
    if (results.hasData()) {
        console.log(results.data().rows);
    }
});

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

martin_mueller
SplunkTrust
SplunkTrust

I think part of your comment was lost.

In general, listening to "search:done" events works like this:

myResults.on("search:done", function() {
  console.log("Woohoo, all done!");
});
0 Karma

bhawkins1
Communicator

I just wasted a few hours working out why my code wasn't working, because the search:done listener is subtly annoying in that it makes no guarantee about the presence of its SearchManager's .data('results').hasData() value.

In other words. definitely prefer to use SearchManager.data("results").on("data") if you want to use the data values, and not just notify when the search is done.

0 Karma

bhawkins1
Communicator

To be more specific, I was running an array of search managers using the search:done listener and about 1 in 8 had no results when the query would otherwise produce them. This would also occur predictably and for the same queries. Changing the listener to results.on("data") solved the problem.

0 Karma

slashnburn
Path Finder

Could you provide a little more insight?

myResults = new SearchManager({
            id: "mysearch",
            search: "mycustomsearch",
            data: "results",
            status_buckets: 300,
            preview: true,
            cache: false
        }, {tokens: true}).data("results").on("data", function() {
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...