public async Task SavedSearchDispatchProperties()
{
using (var service = await SdkHelper.CreateService())
{
// Ensure correct start state
SavedSearchCollection savedSearches = service.SavedSearches;
string name = "sdk-test_DispatchProperties";
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
await savedSearches.GetAllAsync();
Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name));
// Create a saved search
testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m");
// Dispatch the saved search with default arguments
Job job = await testSearch.DispatchAsync();
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
var savedSearchTemplateArgs = new SavedSearchTemplateArgs(
new Argument("action.email.authpassword ", "sdk-password"),
new Argument("action.email.authusername ", "sdk-username"),
new Argument("action.email.bcc ", "*****@*****.**"),
new Argument("action.email.cc ", "*****@*****.**"),
new Argument("action.email.command ", "$name1$"),
new Argument("action.email.format ", "text"),
new Argument("action.email.from ", "*****@*****.**"),
new Argument("action.email.hostname ", "dummy1.host.com"),
new Argument("action.email.inline ", "true"),
new Argument("action.email.mailserver ", "splunk.com"),
new Argument("action.email.maxresults ", "101"),
new Argument("action.email.maxtime ", "10s"),
new Argument("action.email.pdfview ", "dummy"),
new Argument("action.email.reportpaperorientation ", "landscape"),
new Argument("action.email.reportpapersize ", "letter"),
new Argument("action.email.reportserverenabled ", "false"),
new Argument("action.email.reportserverurl ", "splunk.com"),
new Argument("action.email.sendpdf ", "false"),
new Argument("action.email.sendresults ", "false"),
new Argument("action.email.subject ", "sdk-subject"),
new Argument("action.email.to ", "*****@*****.**"),
new Argument("action.email.trackalert ", "false"),
new Argument("action.email.ttl ", "61"),
new Argument("action.email.usessl ", "false"),
new Argument("action.email.usetls ", "false"),
new Argument("action.email.widthsortcolumns ", "false"),
new Argument("actions.populatelookup.command ", "$name2$"),
new Argument("actions.populatelookup.dest ", "dummypath"),
new Argument("actions.populatelookup.hostname ", "dummy2.host.com"),
new Argument("actions.populatelookup.maxresults ", "102"),
new Argument("actions.populatelookup.maxtime ", "20s"),
new Argument("actions.populatelookup.trackalert ", "false"),
new Argument("actions.populatelookup.ttl ", "62"),
new Argument("actions.rss.command ", "$name3$"),
new Argument("actions.rss.hostname ", "dummy3.host.com"),
new Argument("actions.rss.maxresults ", "103"),
new Argument("actions.rss.maxtime ", "30s"),
new Argument("actions.rss.trackalert ", "false"),
new Argument("actions.rss.ttl ", "63"),
new Argument("actionscriptcommand ", "$name4$"),
new Argument("actionscriptfilename ", "action_script_filename"),
new Argument("actionscripthostname ", "dummy4.host.com"),
new Argument("actionscriptmaxresults ", "104"),
new Argument("actionscriptmaxtime ", "40s"),
new Argument("actionscripttrackalert ", "false"),
new Argument("actionscriptttl ", "64"),
new Argument("actions.summaryindex.command ", "$name5$"),
new Argument("actions.summaryindex.hostname ", "dummy5.host.com"),
new Argument("actions.summaryindex.inline ", "false"),
new Argument("actions.summaryindex.maxresults ", "105"),
new Argument("actions.summaryindex.maxtime ", "50s"),
new Argument("actions.summaryindex.trackalert ", "false"),
new Argument("actions.summaryindex.ttl ", "65"),
new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
//// Same as the previous dispatch except using custom arg
job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs);
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.Null(testSearch);
}
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch =
service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes()
{
Search = search
}).Result;
// Dispatch the saved search and wait for results.
Job job = savedSearch.DispatchAsync().Result;
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();
if (this.VersionCompare(service, "6.0") < 0)
{
savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
}
//// Same as the previous dispatch except using custom arg
job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Delete the saved search
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
