public void SavedSearchDispatch()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch =
service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }).Result;
// Dispatch the saved search and wait for results.
Job job = savedSearch.DispatchAsync().Result;
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();
if (this.VersionCompare(service, "6.0") < 0)
{
savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
}
//// Same as the previous dispatch except using custom arg
job = savedSearch.DispatchAsync(null,savedSearchTemplateArgs).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Delete the saved search
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
