/// <summary>
/// Create an instance of the SplunkViaHttp sink.
/// </summary>
/// <param name="context">Connection info.</param>
/// <param name="index">The name of the splunk index to log to</param>
/// <param name="userName">The username to authenticate with</param>
/// <param name="password">The password to authenticate with</param>
/// <param name="batchSizeLimit">The size of the batch prior to logging</param>
/// <param name="batchInterval">The interval on which to log via http</param>
/// <param name="resourceNamespace">The resource namespaces</param>
/// <param name="transmitterArgs">The </param>
/// <param name="formatProvider">The format provider to be used when rendering the message</param>
public SplunkViaHttpSink(
SplunkClient.Context context,
string index,
string userName,
string password,
int batchSizeLimit,
TimeSpan batchInterval,
SplunkClient.Namespace resourceNamespace = null,
SplunkClient.TransmitterArgs transmitterArgs = null,
IFormatProvider formatProvider = null
)
{
_index = index;
_userName = userName;
_password = password;
_batchSizeLimit = batchSizeLimit;
_transmitterArgs = transmitterArgs;
_queue = new ConcurrentQueue <LogEvent>();
_jsonFormatter = new JsonFormatter(renderMessage: true, formatProvider: formatProvider);
_service = resourceNamespace == null
? new SplunkClient.Service(context, new SplunkClient.Namespace("nobody", "search"))
: new SplunkClient.Service(context, resourceNamespace);
RepeatAction.OnInterval(batchInterval, () => ProcessQueue().Wait(), new CancellationToken());
}
/// <summary>
/// Runs the specified service.
/// </summary>
/// <param name="service">The service.</param>
/// <returns>a task</returns>
private static async Task Run(Service service)
{
try
{
await service.GetConfigurationsAsync();
}
catch (AuthenticationFailureException e)
{
Console.WriteLine("Can't get service configuration without log in");
}
Console.WriteLine("Login as admin");
string username = "******";
string password = "******";
await service.LoginAsync(username, password);
Console.WriteLine("List all configurations of the Splunk service:");
ConfigurationCollection configs = service.GetConfigurationsAsync().Result;
foreach (Configuration config in configs)
{
Console.WriteLine(config.Id);
}
Console.WriteLine("Log off");
await service.LogoffAsync();
}
private static async Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
string savedSearchName = "example_search";
string savedSearchQuery = "search index=_internal | head 10";
// Delete the saved search if it exists before we start.
SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(savedSearchName);
if (savedSearch != null)
{
await savedSearch.RemoveAsync();
}
savedSearch = await service.SavedSearches.CreateAsync(savedSearchName, savedSearchQuery);
Job savedSearchJob = await savedSearch.DispatchAsync();
using (SearchResultStream stream = await savedSearchJob.GetSearchResultsAsync())
{
foreach (SearchResult result in stream)
{
Console.WriteLine(result);
}
}
await savedSearch.RemoveAsync();
}
/// <summary>
/// Runs the specified service.
/// </summary>
/// <param name="service">The service.</param>
/// <returns>a task</returns>
private static async Task Run(Service service)
{
try
{
await service.Configurations.GetAllAsync();
}
catch (AuthenticationFailureException)
{
Console.WriteLine("Can't get service configuration without logging in.");
}
Credentials.GetLoginDetails();
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
Console.WriteLine("List all configurations of the Splunk service:");
await service.Configurations.GetAllAsync();
foreach (Configuration config in service.Configurations)
{
Console.WriteLine(config.Id);
}
Console.WriteLine("Log off");
await service.LogOffAsync();
}
public Service Connect(Namespace ns)
{
var service = new Service(Scheme.Https, this.command.Host, this.command.Port, ns);
service.LoginAsync(this.command.Username, this.command.Password).Wait();
return service;
}
public Service CreateServiceAndLogin(Namespace ns = null)
{
var service = new Service(Config.Scheme, Config.Host, Config.Port, ns);
var task = service.LogOnAsync(Config.Username, Config.Password);
task.Wait();
return service;
}
/// <summary>
/// Mains function
/// </summary>
/// <param name="args">The arguments.</param>
static void Main(string[] args)
{
using (var service = new Service(Scheme.Https, "localhost", 8089))
{
Console.WriteLine("Connected to {0}:{1} ", service.Server.Context.Host, service.Server.Context.Port);
Run(service).Wait();
}
}
protected override void OnStartup(StartupEventArgs e)
{
ServicePointManager.ServerCertificateValidationCallback += (sender, certificate, chain, sslPolicyErrors) =>
{
return true;
};
this.Service = new Service(Scheme.Https, "localhost", 8089);
}
/// <summary>
/// Create a Splunk <see cref="Service" /> and login using the settings
/// provided in .splunkrc.
/// </summary>
/// <param name="ns">
/// </param>
/// <returns>
/// The service created.
/// </returns>
public static async Task<Service> CreateService(Namespace ns = null)
{
var context = new MockContext(Splunk.Scheme, Splunk.Host, Splunk.Port);
var service = new Service(context, ns);
await service.LogOnAsync(Splunk.Username, Splunk.Password);
return service;
}
async Task Run(Service service)
{
Job job = await service.SearchAsync("search index=_internal", count: 1000);
foreach (var result in await job.GetSearchResultsAsync())
{
Console.WriteLine(result);
}
}
private async Task<Service> CreateSplunkServiceFor(SplunkWriterConfig config)
{
var service = new Service(new Uri(config.RemoteUrl));
await service.LogOnAsync(config.Login, config.Password);
// ensure that the index is alive and well
var index = await service.Indexes.GetOrNullAsync(config.IndexName)
?? await service.Indexes.CreateAsync(config.IndexName);
await index.EnableAsync();
return service;
}
static void Main(string[] args)
{
using (var service = new Service(SdkHelper.Splunk.Scheme, SdkHelper.Splunk.Host, SdkHelper.Splunk.Port, new Namespace(user: "******", app: "search")))
{
Run(service).Wait();
}
Console.Write("Press return to exit: ");
Console.ReadLine();
}
private static async Task<Service> CreateLoggedOnSplunkServiceForIndex(string indexName)
{
var service = new Service(new Uri("https://localhost:8089"));
await service.LogOnAsync("admin", "P4$$w0rd");
// ensure that the index is alive and well
var index = await service.Indexes.GetOrNullAsync(indexName)
?? await service.Indexes.CreateAsync(indexName);
await index.EnableAsync();
return service;
}
static void Main(string[] args)
{
using (var service = new Service(Scheme.Https, "localhost", 8089, new Namespace(user: "******", app: "search")))
{
Run(service).Wait();
}
Console.Write("Press return to exit: ");
Console.ReadLine();
}
/// <summary>
/// Main function
/// </summary>
/// <param name="args">The arguments to main.</param>
static void Main(string[] args)
{
using (var service = new Service(SdkHelper.Splunk.Scheme, SdkHelper.Splunk.Host, SdkHelper.Splunk.Port))
{
Console.WriteLine("Connected to {0}:{1} ", service.Context.Host, service.Context.Port);
Run(service).Wait();
}
Console.Write("Press return to exit: ");
Console.ReadLine();
}
static void Main(string[] args)
{
ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;
using (var service = new Service(Scheme.Https, "localhost", 8089, new Namespace(user: "******", app: "search")))
{
Run(service).Wait();
}
Console.Write("Press return to exit: ");
Console.ReadLine();
}
/// <summary>
/// Runs the specified service.
/// </summary>
/// <param name="service">The service.</param>
/// <returns>a task</returns>
static async Task Run(Service service)
{
try
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
Console.WriteLine("Data inputs:");
var collection = service.CreateEntityCollection("data", "inputs", "all");
int count = 0;
await collection.GetAllAsync();
//// TODO:
//// [X] 1. Make Entity<TResource>.Content public (It still must be assigned to a dynamic variable before use.)
//// [X] 2. Write a convenience method on the Service object for getting an EntityCollection on some path: service.CreateEntityCollection("data", "inputs", "all")
//// [X] 3. Write a convenience method on the Service object for getting an Entity on some path: something like service.CreateEntity("data", "inputs", "tcp", "ssl")
//// [X] 4. Add service.CreateEntityCollectionCollection for completeness.
//// [X] 5. Revert the access change to EntityCollection<Entity<TResource>, TResource>(service, new ResourceName("data", "inputs", "all")) because (2) makes it unnecessary.
//// [X] 6. Revert the access change to Entity<TResource>(service, new ResourceName("data", "inputs", "all")) because (3) makes it unnecessary.
//// [ ] 7. Enliven the example.
//// [ ] 8. Fill holes in IService (holes are unrelated to this exercise)
foreach (var entity in collection)
{
Console.WriteLine("{0:D5}. {1}", ++count, entity.Id);
dynamic dataInput = entity.Content;
Console.WriteLine(" Disabled: {0}", dataInput.Disabled);
Console.WriteLine(" Index: {0}", dataInput.Index);
Console.WriteLine(" Type: {0}", dataInput.Eai.Type);
if (dataInput.Disabled == "0")
{
try
{
// Restart...
await entity.SendAsync(HttpMethod.Post, "disable");
await entity.SendAsync(HttpMethod.Post, "enable");
}
catch (Exception e)
{
Console.WriteLine("Could not restart '{0}': {1}", entity.Id, e.Message);
}
}
}
await service.LogOffAsync();
}
catch (Exception e)
{
Console.WriteLine(e);
}
}
/// <summary>
/// Cleans an application from Splunk -- requires a restart
/// </summary>
/// <param name="appName">The app name</param>
/// <param name="service">The connected service</param>
/// <returns>The new connection</returns>
private Service CleanApp(string appName, Service service)
{
ApplicationCollection apps = service.GetApplicationsAsync().Result;
if (apps.Any(a => a.Name == appName))
{
service.RemoveApplicationAsync(appName).Wait();
this.SplunkRestart();
service = this.Connect();
}
return service;
}
/// <summary>
/// Main.
/// </summary>
/// <param name="args">The arguments.</param>
static void Main(string[] args)
{
var ns = new Namespace(user: args[0], app: args[1]);
using (var service = new Service(SdkHelper.Splunk.Scheme, SdkHelper.Splunk.Host, SdkHelper.Splunk.Port, ns))
{
Console.WriteLine("Splunk management port: {0}", service.Context);
Console.WriteLine("Namespace: {0}", service.Namespace);
Run(service).Wait();
}
Console.Write("Press enter to exit: ");
Console.ReadLine();
}
static async Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
Console.WriteLine("Press return to cancel.");
string searchQuery = "search index=_internal | stats count by method";
Job realtimeJob = await service.Jobs.CreateAsync(searchQuery, args: new JobArgs
{
SearchMode = SearchMode.RealTime,
EarliestTime = "rt-1h",
LatestTime = "rt",
});
var tokenSource = new CancellationTokenSource();
#pragma warning disable 4014
//// Because this call is not awaited, execution of the current
//// method continues before the call is completed. Consider
//// applying the 'await' operator to the result of the call.
Task.Run(async () =>
{
Console.ReadLine();
await realtimeJob.CancelAsync();
tokenSource.Cancel();
});
#pragma warning restore 4014
while (!tokenSource.IsCancellationRequested)
{
using (SearchResultStream stream = await realtimeJob.GetSearchPreviewAsync())
{
Console.WriteLine("fieldnames: " + string.Join(";", stream.FieldNames));
Console.WriteLine("fieldname count: " + stream.FieldNames.Count);
Console.WriteLine("final result: " + stream.IsFinal);
foreach (SearchResult result in stream)
{
Console.WriteLine(result);
}
Console.WriteLine("");
await Task.Delay(2000, tokenSource.Token);
}
}
}
/// <summary>
/// The main program
/// </summary>
/// <param name="argv">The command line arguments</param>
static async Task Run(Service service)
{
Console.WriteLine("Login as " + SdkHelper.Splunk.Username);
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
Console.WriteLine("Create an index");
string indexName = "user-index";
Index index = await service.Indexes.GetOrNullAsync(indexName);
if (index != null)
{
await index.RemoveAsync();
}
index = await service.Indexes.CreateAsync(indexName);
Exception exception = null;
try
{
await index.EnableAsync();
Transmitter transmitter = service.Transmitter;
SearchResult result;
result = await transmitter.SendAsync("Hello World.", indexName);
result = await transmitter.SendAsync("Goodbye world.", indexName);
using (var results = await service.SearchOneShotAsync(string.Format("search index={0}", indexName)))
{
foreach (SearchResult task in results)
{
Console.WriteLine(task);
}
}
}
catch (Exception e)
{
exception = e;
}
await index.RemoveAsync();
if (exception != null)
{
throw exception;
}
}
static void Main(string[] args)
{
using (var service = new Service(SdkHelper.Splunk.Scheme, SdkHelper.Splunk.Host, SdkHelper.Splunk.Port, new Namespace(user: "******", app: "search")))
{
Task task = Run(service);
while (!task.IsCanceled)
{
Task.Delay(500).Wait();
}
}
Console.Write("Press return to exit: ");
Console.ReadLine();
}
/// <summary>
/// The main program
/// </summary>
/// <param name="argv">The command line arguments</param>
static async Task Run(Service service)
{
Console.WriteLine("Login as admin");
string username = "******";
string password = "******";
await service.LoginAsync(username, password);
Console.WriteLine("create a index");
string indexName = "user-index";
string source = "*\\splunkd.log";
string sourceType = "splunkd";
if (service.GetIndexesAsync().Result.Any(a => a.Name == indexName))
{
await service.RemoveIndexAsync(indexName);
}
Index index = await service.CreateIndexAsync(indexName);
try
{
await index.EnableAsync();
Receiver receiver = service.Receiver;
ReceiverArgs args = new ReceiverArgs()
{
Index = indexName,
Source = source,
SourceType = sourceType,
};
await receiver.SendAsync("Hello World.", args);
await receiver.SendAsync("Goodbye world.", args);
SearchResults results = service.SearchOneshotAsync(
string.Format(
"search index={0}",// source={2} sourcetype={3}",
indexName
//source,
//sourceType
)).Result;
Console.WriteLine(results);
}
finally
{
service.RemoveIndexAsync(indexName).Wait();
}
}
/// <summary>
/// The main program
/// </summary>
public async static Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
// Load connection info for Splunk server in .splunkrc file.
Console.WriteLine("List of Apps:");
await service.Applications.GetAllAsync();
foreach (var app in service.Applications)
{
Console.WriteLine(app.Name);
// Write a seperator between the name and the description of an app.
Console.WriteLine(Enumerable.Repeat<char>('-', app.Name.Length).ToArray());
Console.WriteLine(app.Description);
}
}
/// <summary>
/// Runs the specified service.
/// </summary>
/// <param name="service">The service.</param>
/// <returns>a task</returns>
static async Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
try {
//// This code shows how to execute a long-running search job.
//// We query for the first 100,000 records from Splunk's _internal index and choose a 3 second
//// delay to improve the chances our retry loop runs more than once.
int delay = 3000;
var job = await service.Jobs.CreateAsync("search index=_internal | head 100000", mode: ExecutionMode.Normal);
for (int count = 1; ; ++count)
{
try
{
await job.TransitionAsync(DispatchState.Done, delay);
break;
}
catch (TaskCanceledException)
{
// Consider logging the fact that the operation is taking a long time, around count * (delay / 1000) seconds so far
// Also consider stopping the query, if it runs too long
}
// Consider increasing the delay on each iteration
}
//// Now that the search job is done we can print the results.
//// This example shows how to fetch raw search results in a specific format: JSON. Select an alternative format by
//// by selecting the OutputMode you like.
using (var message = await job.GetSearchResponseMessageAsync(outputMode: OutputMode.Json))
{
Console.Error.WriteLine("Search results (Press Control-C to cancel:");
var content = await message.Content.ReadAsStringAsync();
Console.WriteLine(content);
}
}
finally
{
service.LogOffAsync().Wait();
}
}
private async void TestConnection_Click(object sender, RoutedEventArgs e)
{
Scheme scheme=Scheme.Https;
int port = 8089;
if (CheckInput(ref port, ref scheme))
{
try
{
Service SplunkService = new Service(scheme, splunkHost.Text, port);
await SplunkService.LogOnAsync(inputUser.Text, inputPassword.Password);
OutputInfo.Text = "log on successfully and credential saved!";
this.SaveSettings(inputUser.Text, inputPassword.Password, splunkHost.Text, inputPort.Text, scheme);
}
catch (Exception ex)
{
OutputInfo.Text = ex.Message;
}
}
}
public void CanConstructService()
{
foreach (var ns in TestNamespaces)
{
using (var service = new Service(SdkHelper.Splunk.Scheme, SdkHelper.Splunk.Host, SdkHelper.Splunk.Port, ns))
{
Assert.Equal(string.Format("{0}://{1}:{2}/{3}",
SdkHelper.Splunk.Scheme.ToString().ToLower(),
SdkHelper.Splunk.Host,
SdkHelper.Splunk.Port,
ns),
service.ToString());
Assert.IsType(typeof(ApplicationCollection), service.Applications);
Assert.NotNull(service.Applications);
Assert.IsType(typeof(ConfigurationCollection), service.Configurations);
Assert.NotNull(service.Configurations);
Assert.IsType(typeof(IndexCollection), service.Indexes);
Assert.NotNull(service.Indexes);
Assert.IsType(typeof(JobCollection), service.Jobs);
Assert.NotNull(service.Jobs);
Assert.IsType(typeof(SavedSearchCollection), service.SavedSearches);
Assert.NotNull(service.SavedSearches);
Assert.IsType(typeof(Server), service.Server);
Assert.NotNull(service.Server);
Assert.IsType(typeof(StoragePasswordCollection), service.StoragePasswords);
Assert.NotNull(service.StoragePasswords);
Assert.IsType(typeof(Transmitter), service.Transmitter);
Assert.NotNull(service.Transmitter);
}
}
}
public static async Task Run(Service service)
{
await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);
//// Search : Export Previews
using (SearchPreviewStream stream = await service.ExportSearchPreviewsAsync("search index=_internal | head 100"))
{
int previewNumber = 0;
foreach (SearchPreview preview in stream)
{
int resultNumber = 0;
Console.WriteLine("Preview {0:D8}: {1}", ++previewNumber, preview.IsFinal ? "final" : "partial");
foreach (var result in preview.Results)
{
Console.WriteLine(string.Format("{0:D8}: {1}", ++resultNumber, result));
}
}
}
}
/// <summary>
/// Initializes a new instance of the <see cref="Application"/> class.
/// </summary>
/// <param name="service">
/// An object representing a root Splunk service endpoint.
/// </param>
/// <param name="name">
/// An object identifying a Splunk resource within
/// <paramref name= "service"/>.<see cref="Namespace"/>.
/// </param>
/// <exception cref="ArgumentNullException">
/// <paramref name="service"/> or <paramref name="name"/> are <c>null</c>.
/// </exception>
protected internal Job(Service service, string name)
: this(service.Context, service.Namespace, name)
{
Contract.Requires<ArgumentNullException>(service != null);
}
public void JobRefreshTest()
{
var cli = Command.Splunk("search");
cli.AddRule("search", typeof(string), "search string");
cli.Opts["search"] = "search index=_internal * | head 10 ";
var service = new Service(Scheme.Https, "localhost", 8089);
service.LoginAsync("admin", "changeme").Wait();
var job = service.CreateJobAsync((string)cli.Opts["search"]).Result;
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
TimeSpan max = new TimeSpan(0, 0, 0, 10);
while (!job.IsDone)
{
Thread.Sleep(1000);
//has to call this to get the job.IsCompleted
job.GetAsync().Wait();
Console.WriteLine("jobUpdated={0}", job.Updated);
if (stopwatch.Elapsed > max)
{
Assert.False(true, string.Format("The job is not finished within expected time {0} seconds", max.TotalSeconds));
}
}
job.CancelAsync().Wait();
}
///// <summary>
///// Invalid argument
///// </summary>
//private readonly Args<SearchOption> badOutputMode =
// new Args("output_mode", "invalid_arg_value");
///// <summary>
///// Invalid argument
///// </summary>
//private readonly Args<SearchMode> badSearchMode =
// new Args("search_mode", "invalid_arg_value");
///// <summary>
///// Invalid argument
///// </summary>
//private readonly Args badTruncationMode =
// new Args("truncation_mode", "invalid_arg_value");
///// <summary>
///// Invalid argument
///// </summary>
//private readonly Args badExecutionMode =
// new Args("exec_mode", "invalid_arg_value");
///// <summary>
///// Run the given query.
///// </summary>
///// <param name="service">The service</param>
///// <param name="query">The search query</param>
///// <returns>The job</returns>
//private Job Run(Service service, string query)
//{
// return this.Run(service, query, null);
//}
///// <summary>
///// Run the given query with the given query args.
///// </summary>
///// <param name="service">The service</param>
///// <param name="query">The search query</param>
///// <param name="args">The args</param>
///// <returns>The job</returns>
//private Job Run(Service service, string query, JobArgs args)
//{
// args.Search = query;
// return service.StartJob(args);
//}
///// <summary>
///// Run the given query and wait for the job to complete.
///// </summary>
///// <param name="service">The service</param>
///// <param name="query">The search query</param>
///// <returns>The job</returns>
//private Job RunWait(Service service, string query)
//{
// return this.RunWait(service, query, null);
//}
/// <summary>
/// Run the given query with the given query args and wait for the job to
/// complete.
/// </summary>
/// <param name="service">The service</param>
/// <param name="jobArgs">The args</param>
/// <returns>The job</returns>
private Job RunWait(Service service, JobArgs jobArgs)
{
return service.CreateJobAsync(jobArgs).Result;
}
static void Main(string[] args)
{
using (var service = new Service(Scheme.Https, "localhost", 8089, new Namespace(user: "******", app: "search")))
{
Run(service).Wait();
}
}
