Search results model

After a search has started running, you can access its data using one of the following results models:

  • events: Events from the search before any transformations have been applied.
  • preview: Preview results from a search in progress.
  • results: Results from the search after transforms and processing has been completed.
  • summary: Field summary information of results thus far, including statistics.

You can set which results model the search manager should display by setting the data property in the Splunk view. This code snippet shows how to retrieve "preview" results in a chart:

new ChartView({
    id: "previewchart",
    managerid: "mysearch1",
    type: "line",
    data: "preview",
    el: $("#previewchart")
}).render();

If you want to access the actual data from the results, retrieve a data object by calling the data method on the search manager and specifying which type of results model you want from the job. Optionally you can also specify a count (the number of results to retrieve) and an offset (the index of the first entity to return). This snippet shows how to retrieve a search manager "mysearch1", then retrieve 25 preview results beginning with the tenth:

var mainSearch = splunkjs.mvc.Components.get("mysearch1");
var myResults = mainSearch.data("preview", { count: 25, offset: 10 });

Once you have a data object, you can access the rows of results. You can also access the Backbone collection. This example continues from the previous one, showing how to access the results and display these objects in the console:

...
myResults.on("data", function() {
    // The full data object
    console.log(myResults.data());

    // Indicates whether the results model has data
    console.log("Has data? ", myResults.hasData());

    // The results rows
    console.log("Data (rows): ", myResults.data().rows);

    // The Backbone collection
    console.log("Backbone collection: ", myResults.collection());
});