Splunk Node Retrieve Result ERROR toString

Describe the problem/error/question

Splunk node is not able to get the search results with the search ID returned by last node.

What is the error message (if any)?

Cannot read properties of undefined (reading ‘toString’)

Please share your workflow

(Select the nodes on your canvas and use the keyboard shortcuts CMD+C/CTRL+C and CMD+V/CTRL+V to copy and paste the workflow.)

Share the output returned by the last node

    "$": {
      "xmlns": "http://www.w3.org/2005/Atom",
      "xmlns:s": "http://dev.splunk.com/ns/rest",
      "xmlns:opensearch": "http://a9.com/-/spec/opensearch/1.1/"
    "title": "",
    "id": "1709794535.2305995",
    "updated": "2024-03-07T14:55:39.217+08:00",
    "published": "1970-01-01T08:00:00.000+08:00",
    "author": {
      "name": ""
    "bundleVersion": "11973770128039409271",
    "cursorTime": "1970-01-01T08:00:00.000+08:00",
    "defaultSaveTTL": "604800",
    "defaultTTL": "600",
    "delegate": "",
    "diskUsage": "32768",
    "dispatchState": "PARSING",
    "doneProgress": "0",
    "earliestTime": "1970-01-01T08:00:00.000+08:00",
    "isDone": "0",
    "isFailed": "0",
    "isFinalized": "0",
    "isPaused": "0",
    "isSaved": "0",
    "isSavedSearch": "0",
    "isZombie": "0",
    "label": "",
    "sid": "1709794535.2305995",
    "statusBuckets": "0",
    "ttl": "600",
    "workload_action_information": "",
    "workload_pool": "",
    "messages": "",
    "request": {
      "search": "search sourcetype=*"
    "runtime": {
      "auto_cancel": "0",
      "auto_pause": "0"
    "eai:acl": {
      "perms": {
        "read": "username",
        "write": "username"
      "owner": "username",
      "modifiable": "1",
      "sharing": "global",
      "app": "search",
      "can_write": "1",
      "ttl": "600"
    "searchProviders": "",
    "entryUrl": "https://host:8089/services/search/jobs/1709794535.2305995"

Information on your n8n setup

  • **n8n version:1.31.0
  • **Database (default: SQLite):Postgres
  • **n8n EXECUTIONS_PROCESS setting (default: own, main):own
  • **Running n8n via (Docker, npm, n8n cloud, desktop app):Docker
  • **Operating system:RH

hello @WTeeth

“dispatchState”: “PARSING”,

That means the search is not complete, so you don’t get any results yet. You have to check if the state is DONE and only then return the results.

yes, it does, pls close and thanks.

Hi, may I ask how to check if it is done? Because I don’t see any node like wait/getStatus in Splunk’s Nodes