Splunk Search

Cannot access results of a Searchmanager in a for loop

mariuswal
New Member

I have a dashboard that should perform a dynamic number of searches. For this purpose I created a search manager, which receives new search strings via a For loop. Via an on-data listener I access the results of the search manager. If I have only one pass of the loop, I get the correct results, but already with two passes I get the result of the second search output twice. I have attached a minimal example of the problem here.

searchmanager = new SearchManager(…)
for (var i = 0; i < array.length; i++) {
     var search_string = "| makeresults | eval a=" + i + " | table a";

      searchmanager.settings.set("search", search_string);
      searchmanager.startSearch();

     var results = searchmanager.data("results");

     searchmanager.on("search:done", function() {
           results.on("data", function() {
               if (results.data()) {
                    var fields = results.data().fields;
                    var rows = results.data().rows;

                    console.log(rows);
                }

            })
        })
    }

The output of the console is for an array of a length of two always twice an object with "1" as the result and not one time "0" and then "1" as one would expect. For an array of a length of one the result is an object with "0" as the result.

I suspect the on("data") listener because i checked the search string and everything and at any given point there is the difference of the value in the objects but as soon as I try to enter the result with the listener it only gives me the result with "1" in the row.

I also tried to put the results in an array and access the result object after that with no success.

I hope someone can help me and that the minimal example helps to explain my problem. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...