Splunk Search

How to wait for the SearchManager job to finish?

chrismok
Path Finder

Currently, I run the search query and get the last 3 records, basic on these records and generate the charts. However I find that the "save array job will run after the page load end", and the a.length is zero.

So I would like to know how I can wait for the query result first

 var scope = new SearchManager({
             "id": "scope",
             "status_buckets": 0,
             "search": "sourcetype=\"test_buildlog\" |table b",
             "app": utils.getCurrentApp(),
             "runWhenTimeIsUndefined": false
             }, {
                 tokens: true, tokenNamespace: "submitted"
         });

         var s = scope.data('results');
            s.on("data", function () {

                for (var n = 0; n <= r.data().rows.length - 1; n++) {
                  //insert the data to array
                    a.push(r.data().rows[n][0]);
                }


         for (var i = 0; i <= a.length - 1; i++) {
            ......
           ......basic on the array data create another search query
            ......
}
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

View solution in original post

bhawkins1
Communicator

If you listen to SearchManager.on("search:done", fn); you'll not be able to reliably read result rows from SearchManager.data("results").data() - consistent with that, SearchManager.data("results").hasData() will sometimes return false.

Instead, use the results object's .on("data", fn); listener, like @slashnburn mentions above:

const search_man; // : SearchManager

const results = search_man.data("results");

results.on("data", () => {
    if (results.hasData()) {
        console.log(results.data().rows);
    }
});

martin_mueller
SplunkTrust
SplunkTrust

You can listen to the "search:done" event on the SearchManager and proceed from there.

http://docs.splunk.com/Documentation/WebFramework -> Click SearchManager -> scroll down to events

martin_mueller
SplunkTrust
SplunkTrust

I think part of your comment was lost.

In general, listening to "search:done" events works like this:

myResults.on("search:done", function() {
  console.log("Woohoo, all done!");
});
0 Karma

bhawkins1
Communicator

I just wasted a few hours working out why my code wasn't working, because the search:done listener is subtly annoying in that it makes no guarantee about the presence of its SearchManager's .data('results').hasData() value.

In other words. definitely prefer to use SearchManager.data("results").on("data") if you want to use the data values, and not just notify when the search is done.

0 Karma

bhawkins1
Communicator

To be more specific, I was running an array of search managers using the search:done listener and about 1 in 8 had no results when the query would otherwise produce them. This would also occur predictably and for the same queries. Changing the listener to results.on("data") solved the problem.

0 Karma

slashnburn
Path Finder

Could you provide a little more insight?

myResults = new SearchManager({
            id: "mysearch",
            search: "mycustomsearch",
            data: "results",
            status_buckets: 300,
            preview: true,
            cache: false
        }, {tokens: true}).data("results").on("data", function() {
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...