Why can't I see results from (JavaScript) SearchManager with double quotes in search?

[danillopavan]

Hello all,

I am using the object SearchManager for the below query, however it is not returning anything. Executing the same query directly in search, we can find the results. Probably it is something related to the double quotes in the replacement command within the query:

 var myquery=  'sourcetype=XXX | eval time_resumo=substr(time,6,2) | eval IP = replace(replace(IP, "\."," "),":"," ") |  
         lookup unidadedepara.csv IP OUTPUT PLANTA |   timechart span=1h avg(time_resumo) by PLANTA'

Is there any special way to configure (store) the above query in variable via JavaScript to be executed via SearchManager?

Thanks and regards,
Danillo Pavan

[elliotproebstel · Accepted solution]

I don't think the double-quotes are the issue. I have used many query strings in javascript with double-quotes - formatted just like yours. Is it possible that the csv file is not accessible to the user/app that is running this? If PLANTA is not being returned from the lookup, then the final command would output nothing, I believe. Have you tried trimming the query down to sourcetype=XXX | eval time_resumo=substr(time,6,2) | eval IP = replace(replace(IP, "\."," "),":"," ") to see if you get results?

[danillopavan]

Hello elliotproebstel , many thanks for your Support.

Yes, you are correct. I executed the initial of the query without the lookup command, and got the return. Now we found that the lookup command is not working, but why? If I execute the same query via SEARCH and it is working. The lookup table file componente is configure as Global and for all apss (read and write). Don´t know the reason for this query is not working in JavaScript.

Many thanks again!

[danillopavan]

Hello all,

It is working now. My search query was wrong. I needed to remove one of the replace commands. The problem was not with lookup information.

Thanks and regards

[elliotproebstel]

Glad you got it fixed!