Hey!
I'm trying to run a search in the JS Splunk SDK, and periodically check the job for the current results. I found out that there are multiple exec_mode
s possible, and if I set it to normal
, I can get the job ID before the search has ended.
I tried to run my job this way:
service.search(
searchQuery,
searchParams,
async function (err, job) {
console.log("...done!\n");
let count = 0;
const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
await sleep(4000);
job.preview({}, function (err, results) {
if (err) {
console.error(err)
return;
}
if (results.rows) {
count++;
console.log("========== Iteration " + count + " ==========");
console.log(results.rows)
for (var i = 0; i < results.rows.length; i++) {
var row = results.rows[i];
console.log(stat + row[countIndex]);
}
console.log("=================================");
}
});
});
with these properties:
const searchQuery = "search index=*";
const searchParams = {
exec_mode: "normal"
};
The output of this job.preview
is that there are no rows yet.
Is there anything wrong with the way I'm checking the job results? Is there a way to achieve the results before the job ends?
Thanks!