@splunk/search-job

A class that simplifies creating and accessing Splunk search jobs.

Install

Install the package:

npm install @splunk/search-job

Usage

import SearchJob from '@splunk/search-job';

The API of the SearchJob class is based on Observables. Each method returns an Observable that can be subscribed to and will emit data over the lifecycle of the search job. A few examples are provided here.

Create a Simple SearchJob

const mySearchJob = SearchJob.create({
    search: 'index=_internal | head 10',
    earliest_time: '-60m@m',
    latest_time: 'now',
});

Create a SearchJob in a Specific Context

const mySearchJob = SearchJob.create({
    search: 'index=_internal | head 10',
    earliest_time: '-60m@m',
    latest_time: 'now',
}, {
    app: 'awesome_app',
    owner: 'admin',
});

Create a SearchJob from a Saved Search

const mySearchJob = SearchJob.fromSavedSearch({
    name: 'My Saved Search',
    app: 'search',
    owner: 'admin',
});

Get Search Progress

const progressSubscription = mySearchJob.getProgress().subscribe(searchState => {
    // Do something with the searchState.
});

// Later, if the search is no longer needed, and is not complete,
// unsubscribe to release resources.
progressSubscription.unsubscribe();

Get Search Results

Search results will only emit when the search is complete. See getResultsPreview to get a preview of results before the search is complete.

const resultsSubscription = mySearchJob.getResults().subscribe(results => {
    // Do something with the results.
});

// Later, if the results are no longer needed, and the search is not complete,
// unsubscribe to release resources.
resultsSubscription.unsubscribe();

Errors and Completion

All Observables support three callbacks: next, error, and complete.

const progressSubscription = mySearchJob.getProgress().subscribe({
    next: searchState => {
        // Do something with the search state.
    },
    error: err => {
        // The search failed. Do something with the err.
    },
    complete: () => {
        // The search has completed successfully.
    },
});