Splunk Search

Blocking searches using splunkJS-stack?

ahmetcepoglu
Engager

I have multiple searches, and I need their results in a particular order.

I am trying to make a splunk view that shows results from multiple searches.

I am under the impression that to make it a splunk view, it must be created using splunk web-framework and has django bindings and whatnot. And because of that, it cannot have blocking searches.

I need to be able to retrieve search results in a particular order, so I am going to need blocking searches.

My question is, can I have blocking searches in a splunk-django application?

Tags (3)
0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hi ahmetcepoglu,

You can do this using the web-framework, and you don't need to use Django. The web-framework provides Django functionality, but everything is also available from javascript. You can also write an application that mixes Django with JavaScript.

Your scenario can be accomplished by creating searchmanagers and listening to their done events. You'll have Javascript that looks something like this:

var myManager = new SearchManager({
   id: 'myManager'
   search: '<your search here>
});
myManager.on('search:done', function(){
   //start next manager
});

If you want more samples and explanations, the framework toolkit is a good place to start: http://apps.splunk.com/app/1613/

magnew_splunk
Splunk Employee
Splunk Employee

Yes, but if your goal is to run searches one after another, you can use it. For each search manager, you can set autostart to false on creation. Then, you can start them when you want by calling startSearch on them. So for instance, if I wanted to run two searches in sequence, I could do something like this:

var myManager = new SearchManager({
id: 'myManager',
search: your search
});

var myManager2 = new SearchManager({
id: 'myManager',
autostart: false,
search: your search
});

myManager.on('search:done', function(){
myManager2.startSearch();
});

0 Karma

ahmetcepoglu
Engager

Isn't that nonblocking call?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...