I am working with JavaSDK to execute custom python script.  In below code, i want to execute errorfunc (highlighted) in case "myResults.on("data", function ()" even is not triggered. How i can put non event condition.  require([ 'underscore', 'jquery', 'splunkjs/mvc', "splunkjs/mvc/searchmanager", 'splunkjs/mvc/simplexml/ready!' ], function (_, $, mvc, SearchManager) { console.log("sample.js has been loaded"); buttonClick() function buttonClick(){ $("#run_search_btn").on("click",function(){ console.log("Clicked") $('#run_search_btn').attr( "disabled", "disabled" ); script1 = "| script XPDM_Creation" function success(val_cnt,val){ console.log("Search Result: Successful"); console.log("Result:",val_cnt); console.log(val); alert("Generated"); $("#run_search_btn").removeAttr( "disabled"); } function err(){ console.log("Search Result: Failed"); alert("Generation Failed") $("#run_search_btn").removeAttr( "disabled"); } runScript1(script1,success,err) }) } function runScript1(script1, successfunc, errorfunc) { var result = []; var lookupSearch = new SearchManager({ earliest_time: "-24h@h", latest_time: "now", search: script1 }); var myResults = lookupSearch.data("results"); lookupSearch.on("search:done", function () { console.log(myResults) myResults.on("data", function () { result_cnt = myResults.data().rows; myResults_text = myResults.data().rows[0][0]; successfunc(result_cnt,myResults_text) }) errorfunc() }); lookupSearch.on('search:failed', function(properties) { // Print the entire properties object console.log("FAILED:", properties); errorfunc() }); lookupSearch.on('search:error', function(properties) { // Print the entire properties object console.log("FAILED:", properties); errorfunc() }); lookupSearch.on('search:progress', function(properties) { // Print just the event count from the search job console.log("IN PROGRESS.\nEvents so far:", properties.content.eventCount); }); } }) ... View more

I am want to improve the response time for search with rare event and searching with date variable. Note: I am interested in latest 500 event only. Here "local date" is other than _time variable. For _time is set on other date variable in event which i we can't change. Scenario 1 :  index="ABC" earliest=-120d sourcetype="XYX" flag = "Y" xxnumber="8XV5F5FF4" | head 500| fields id This search has completed and has returned 6 results by scanning 18 events in 0.254 seconds Scenario 2 :  index="ABC" earliest=-120d sourcetype="XYX" flag = "Y" local_date="2020-06-01 00:00:00" | head 500| fields d This search has completed and has returned 22 results by scanning 469,911 events in 25.058 seconds   Scenario 3: Rare events index="ABC" earliest=-120d sourcetype="XYX" flag = "Y" local_date>="2020-06-15 00:00:00" | head 500| fields id This search has completed and has returned 57 results by scanning 2,943,130 events in 67.789 seconds if we use any other filter than date filter (which is other than _time) takes less time (less than seconds).  Can any one suggest how i can get better response time with date filters.? ... View more