public async Task SavedSearchDispatchProperties()
{
using (var service = await SdkHelper.CreateService())
{
// Ensure correct start state
SavedSearchCollection savedSearches = service.SavedSearches;
string name = "sdk-test_DispatchProperties";
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
await savedSearches.GetAllAsync();
Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name));
// Create a saved search
testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m");
// Dispatch the saved search with default arguments
Job job = await testSearch.DispatchAsync();
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 });
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" });
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
var savedSearchTemplateArgs = new SavedSearchTemplateArgs(
new Argument("action.email.authpassword ", "sdk-password"),
new Argument("action.email.authusername ", "sdk-username"),
new Argument("action.email.bcc ", "*****@*****.**"),
new Argument("action.email.cc ", "*****@*****.**"),
new Argument("action.email.command ", "$name1$"),
new Argument("action.email.format ", "text"),
new Argument("action.email.from ", "*****@*****.**"),
new Argument("action.email.hostname ", "dummy1.host.com"),
new Argument("action.email.inline ", "true"),
new Argument("action.email.mailserver ", "splunk.com"),
new Argument("action.email.maxresults ", "101"),
new Argument("action.email.maxtime ", "10s"),
new Argument("action.email.pdfview ", "dummy"),
new Argument("action.email.reportpaperorientation ", "landscape"),
new Argument("action.email.reportpapersize ", "letter"),
new Argument("action.email.reportserverenabled ", "false"),
new Argument("action.email.reportserverurl ", "splunk.com"),
new Argument("action.email.sendpdf ", "false"),
new Argument("action.email.sendresults ", "false"),
new Argument("action.email.subject ", "sdk-subject"),
new Argument("action.email.to ", "*****@*****.**"),
new Argument("action.email.trackalert ", "false"),
new Argument("action.email.ttl ", "61"),
new Argument("action.email.usessl ", "false"),
new Argument("action.email.usetls ", "false"),
new Argument("action.email.widthsortcolumns ", "false"),
new Argument("actions.populatelookup.command ", "$name2$"),
new Argument("actions.populatelookup.dest ", "dummypath"),
new Argument("actions.populatelookup.hostname ", "dummy2.host.com"),
new Argument("actions.populatelookup.maxresults ", "102"),
new Argument("actions.populatelookup.maxtime ", "20s"),
new Argument("actions.populatelookup.trackalert ", "false"),
new Argument("actions.populatelookup.ttl ", "62"),
new Argument("actions.rss.command ", "$name3$"),
new Argument("actions.rss.hostname ", "dummy3.host.com"),
new Argument("actions.rss.maxresults ", "103"),
new Argument("actions.rss.maxtime ", "30s"),
new Argument("actions.rss.trackalert ", "false"),
new Argument("actions.rss.ttl ", "63"),
new Argument("actionscriptcommand ", "$name4$"),
new Argument("actionscriptfilename ", "action_script_filename"),
new Argument("actionscripthostname ", "dummy4.host.com"),
new Argument("actionscriptmaxresults ", "104"),
new Argument("actionscriptmaxtime ", "40s"),
new Argument("actionscripttrackalert ", "false"),
new Argument("actionscriptttl ", "64"),
new Argument("actions.summaryindex.command ", "$name5$"),
new Argument("actions.summaryindex.hostname ", "dummy5.host.com"),
new Argument("actions.summaryindex.inline ", "false"),
new Argument("actions.summaryindex.maxresults ", "105"),
new Argument("actions.summaryindex.maxtime ", "50s"),
new Argument("actions.summaryindex.trackalert ", "false"),
new Argument("actions.summaryindex.ttl ", "65"),
new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
//// Same as the previous dispatch except using custom arg
job = await testSearch.DispatchAsync(templateArgs: savedSearchTemplateArgs);
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.Null(testSearch);
}
}
/// <summary>
/// Asyncrhonously creates a new <see cref="SavedSearch"/>.
/// </summary>
/// <param name="name">
/// Name of the <see cref="SavedSearch"/>.
/// </param>
/// <param name="search">
/// The Splunk search command to save.
/// </param>
/// <param name="attributes">
/// Optional attributes of the <see cref="SavedSearch"/>.
/// </param>
/// <param name="dispatchArgs">
/// Optional dispatch arguments for the <see cref="SavedSearch"/>.
/// </param>
/// <param name="templateArgs">
/// Optional template arguments for the <see cref="SavedSearch"/>.
/// </param>
/// <returns>
/// The <see cref="SavedSearch"/> created.
/// </returns>
public Task <TSavedSearch> CreateAsync(string name, string search, SavedSearchAttributes attributes,
SavedSearchDispatchArgs dispatchArgs, SavedSearchTemplateArgs templateArgs)
{
Contract.Requires <ArgumentNullException>(search != null);
Contract.Requires <ArgumentNullException>(name != null);
return(default(Task <TSavedSearch>));
}
/// <inheritdoc/>
public virtual async Task <SavedSearch> CreateAsync(string name, string search,
SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null,
SavedSearchTemplateArgs templateArgs = null)
{
var args = new Argument[]
{
new Argument("name", name),
new Argument("search", search)
}
.AsEnumerable();
if (attributes != null)
{
args = args.Concat(attributes);
}
if (dispatchArgs != null)
{
args = args.Concat(dispatchArgs);
}
if (templateArgs != null)
{
args = args.Concat(templateArgs);
}
var savedSearch = await this.CreateAsync(args).ConfigureAwait(false);
return(savedSearch);
}
/// <inheritdoc/>
public virtual async Task <Job> DispatchSavedSearchAsync(string name,
SavedSearchDispatchArgs dispatchArgs = null,
SavedSearchTemplateArgs templateArgs = null)
{
var savedSearch = new SavedSearch(this.Context, this.Namespace, name);
var job = await savedSearch.DispatchAsync(dispatchArgs, templateArgs).ConfigureAwait(false);
return(job);
}
/// <summary>
/// Asynchronously updates the saved search represented by the current
/// instance.
/// </summary>
/// <param name="attributes">
/// New attributes for the saved search to be updated.
/// </param>
/// <param name="dispatchArgs">
/// New dispatch arguments for the saved search to be updated.
/// </param>
/// <param name="templateArgs">
/// New template arguments for the saved search to be updated.
/// </param>
/// <exception cref="ArgumentException">
/// <see cref="attributes"/>, <see cref="dispatchArgs"/>, and <see
/// cref="templateArgs"/> are <c>null</c>.
/// </exception>
/// <remarks>
/// This method uses the <a href="http://goo.gl/aV9eiZ">POST
/// saved/searches{name}</a> endpoint to update the saved search
/// represented by the current instance.
/// </remarks>
public async Task UpdateAsync(SavedSearchAttributes attributes = null, SavedSearchDispatchArgs dispatchArgs =
null, SavedSearchTemplateArgs templateArgs = null)
{
Contract.Requires <ArgumentException>(!(attributes == null && dispatchArgs == null && templateArgs == null));
using (var response = await this.Context.PostAsync(this.Namespace, this.ResourceName, attributes,
dispatchArgs, templateArgs))
{
await response.EnsureStatusCodeAsync(HttpStatusCode.OK);
await this.UpdateSnapshotAsync(response);
}
}
/// <summary>
/// Asynchronously creates a new saved search.
/// </summary>
/// <param name="searchName">
/// Name of the saved search to be created.
/// </param>
/// <param name="attributes">
/// Attributes of the saved search to be created.
/// </param>
/// <param name="dispatchArgs">
/// Dispatch arguments for the saved search to be created.
/// </param>
/// <param name="templateArgs">
/// Template arguments for the saved search to be created.
/// </param>
/// This method uses the <a href="http://goo.gl/EPQypw">POST
/// saved/searches</a> endpoint to create the <see cref="SavedSearch"/>
/// represented by the current instance.
/// </remarks>
public async Task CreateAsync(SavedSearchAttributes attributes, SavedSearchDispatchArgs dispatchArgs = null,
SavedSearchTemplateArgs templateArgs = null)
{
var args = new Argument[] { new Argument("name", this.ResourceName.Title) };
using (var response = await this.Context.PostAsync(this.Namespace, SavedSearchCollection.ClassResourceName,
args, attributes, dispatchArgs, templateArgs))
{
await response.EnsureStatusCodeAsync(HttpStatusCode.Created);
await this.UpdateSnapshotAsync(response);
}
}
/// <summary>
/// Asynchronously updates a saved search.
/// </summary>
/// <param name="name">
/// Name of the saved search to be updated.
/// </param>
/// <param name="attributes">
/// New attributes for the saved search to be updated.
/// </param>
/// <param name="dispatchArgs">
/// New dispatch arguments for the saved search to be updated.
/// </param>
/// <param name="templateArgs">
/// New template arguments for the saved search to be updated.
/// </param>
/// <returns>
/// An object representing the saved search that was updated.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/aV9eiZ">POST
/// saved/searches/{name}</a> endpoint to update the saved search
/// identified by <see cref="name"/>.
/// </remarks>
public async Task<SavedSearch> UpdateSavedSearchAsync(string name, SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null)
{
var resource = new SavedSearch(this.Context, this.Namespace, name);
await resource.UpdateAsync(attributes, dispatchArgs, templateArgs);
return resource;
}
/// <summary>
/// Asynchronously dispatches a <see cref="SavedSearch"/> just like the
/// scheduler would.
/// </summary>
/// <param name="name">
/// The name of the <see cref="SavedSearch"/> to dispatch.
/// </param>
/// <param name="dispatchArgs">
/// A set of arguments to the dispatcher.
/// </param>
/// <param name="templateArgs">
/// A set of template arguments to the <see cref="SavedSearch"/>.
/// </param>
/// <returns>
/// The search <see cref="Job"/> that was dispatched.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/AfzBJO">POST
/// saved/searches/{name}/dispatch</a> endpoint to dispatch the <see
/// cref="SavedSearch"/> identified by <see cref="name"/>.
/// </remarks>
public async Task<Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null,
SavedSearchTemplateArgs templateArgs = null)
{
var savedSearch = new SavedSearch(this.Context, this.Namespace, name);
var job = await savedSearch.DispatchAsync(dispatchArgs, templateArgs);
return job;
}
public abstract Task <Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null);
public abstract Task<Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null);
public Task <bool> UpdateAsync(string search = null, SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null)
{
Contract.Requires <ArgumentException>(!(search == null && attributes == null && dispatchArgs == null && templateArgs == null));
return(default(Task <bool>));
}
public Task<bool> UpdateAsync(string search = null, SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null)
{
Contract.Requires<ArgumentException>(!(search == null && attributes == null && dispatchArgs == null && templateArgs == null));
return default(Task<bool>);
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch =
service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }).Result;
// Dispatch the saved search and wait for results.
Job job = savedSearch.DispatchAsync().Result;
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();
if (this.VersionCompare(service, "6.0") < 0)
{
savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
}
//// Same as the previous dispatch except using custom arg
job = savedSearch.DispatchAsync(null,savedSearchTemplateArgs).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Delete the saved search
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
/// <summary>
/// Dispatches the current <see cref="SavedSearch"/> just like the
/// scheduler would.
/// </summary>
/// <param name="dispatchArgs">
/// A set of arguments to the dispatcher.
/// </param>
/// <param name="templateArgs">
/// A set of template arguments to the saved search.
/// </param>
/// <returns>
/// An object representing the search job created by the dispatcher.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/AfzBJO">POST
/// saved/searches/{name}/dispatch</a> endpoint to dispatch the
/// current <see cref="SavedSearch"/>. It then uses the <a href=
/// "http://goo.gl/C9qc98">GET search/jobs/{search_id}</a> endpoint to
/// retrieve the <see cref="Job"/> object that it returns.
/// </remarks>
public async Task <Job> DispatchAsync(SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs
templateArgs = null)
{
var resourceName = new ResourceName(this.ResourceName, "dispatch");
string searchId;
using (var response = await this.Context.PostAsync(this.Namespace, resourceName, dispatchArgs, templateArgs))
{
await response.EnsureStatusCodeAsync(HttpStatusCode.Created);
searchId = await response.XmlReader.ReadResponseElementAsync("sid");
}
Job job = new Job(this.Context, this.Namespace, searchId);
await job.GetAsync();
return(job);
}
