Dashboards & Visualizations

Get reults from SearchManager / SplunkJS

gaRe
Explorer

Hello,

iam trying to start a search with Javascript and the SearchManager inside my own js-libary on a Dashboard . My Dashboard-header is binding: splunk.js, myownlibary.js and myOwncss.css. After reading some documentations and some help from here i found out how to call a search with the correct framework, objects and methods.

Iam also using the plugin "DB Connect", with that plugin you can
query directly to the database like: "| dbquery myDB \"(SQL STATEMENT)\""

Now ive got a db-query which works and iam trying to fire it with javascript-code which is also firing when my MutationObserver react by defined events.

So my actual code now is:

 var searchIncrementer = "1";
 require(["splunkjs/ready!"], function(mvc) {
    var deps = [
        "splunkjs/ready!",
        "splunkjs/mvc/searchmanager",
    ];
    require(deps, function(mvc) {

        var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
            id: "mvasearch" + searchIncrementer,
            earliest_time: "-24h@h",
            latest_time: "now",
            search: "| dbquery PrixB limit=1000 \"select * from bild b join shopposition s on                    b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='" + mvaArticleNumber + "'\"",
   });

   var mvaDataObj = splunkjs.mvc.Components.getInstance("mvasearch" + searchIncrementer);

    mvaDataObj.on('search:progress', function(properties) {
        console.log("IN PROGRESS:", properties)
    });

    mvaDataObj.on('search:done', function(properties) {
        console.log("DONE:", properties)
    });

    mvaDataObj.on('search:failed', function(properties) {
        console.log("FAIL:", properties)
    });  

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });
myResults.on("data", function() {
        // The full data object
        console.log(myResults.data());

        // Indicates whether the results model has data
        console.log("Has data? ", myResults.hasData());

        // The results rows
        console.log("Data (rows): ", myResults.data().rows);

     // The Backbone collection
        console.log("Backbone collection: ", myResults.collection());
});
    var tmpIncrementer = parseInt(searchIncrementer);
    tmpIncrementer++;
    searchIncrementer = String(tmpIncrementer);

   }); // require

Its mostly from the examples....

console.log() / IN PROGRESS, DONE

Tells me that there is no error, resultCount: 4 and some links like:

results: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/results"

search.log: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/search.log"

console.log("Has data? ", myResults.hasData());

Is false but why? Also the result from both logs are empty.

I dont get it because the resultCount is 4 so he founds something?
But why are the results empty? Is there a function like "getResultsFromSearch(row, fields)" which you can use by Splunk SDK (Javascript) on jobs?

Thanks..

cafissimo
Communicator

You should try to use

var myResults = mvaDataObj.data("results") ;
myResults.on("data", function() {
                    console.log("Has data? ", myResults.hasData());
                    console.log("Type: ", myChoice);
                    console.log("Data (rows): ", myResults.data().rows);
                    console.log("Backbone collection: (rows) ", myResults.collection().raw.rows);
                });

instead of

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

Let me know if it works!

ineeman
Splunk Employee
Splunk Employee

So in your original call, you have this:

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

And then you say you get four results. Is there a reason you're using "offset=10", which would mean that you won't see any results from 0-10? In this case, if you only have 4 results, you won't see them.

grossb
Explorer

Where are the examples you were referencing to get to this point?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...