public async Task SavedSearchDispatchProperties() { using (var service = await SdkHelper.CreateService()) { // Ensure correct start state SavedSearchCollection savedSearches = service.SavedSearches; string name = "sdk-test_DispatchProperties"; SavedSearch testSearch = await savedSearches.GetOrNullAsync(name); if (testSearch != null) { await testSearch.RemoveAsync(); } await savedSearches.GetAllAsync(); Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name)); // Create a saved search testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m"); // Dispatch the saved search with default arguments Job job = await testSearch.DispatchAsync(); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Dispatch with some additional search options job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Dispatch with some additional search options job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); var savedSearchTemplateArgs = new SavedSearchTemplateArgs( new Argument("action.email.authpassword ", "sdk-password"), new Argument("action.email.authusername ", "sdk-username"), new Argument("action.email.bcc ", "*****@*****.**"), new Argument("action.email.cc ", "*****@*****.**"), new Argument("action.email.command ", "$name1$"), new Argument("action.email.format ", "text"), new Argument("action.email.from ", "*****@*****.**"), new Argument("action.email.hostname ", "dummy1.host.com"), new Argument("action.email.inline ", "true"), new Argument("action.email.mailserver ", "splunk.com"), new Argument("action.email.maxresults ", "101"), new Argument("action.email.maxtime ", "10s"), new Argument("action.email.pdfview ", "dummy"), new Argument("action.email.reportpaperorientation ", "landscape"), new Argument("action.email.reportpapersize ", "letter"), new Argument("action.email.reportserverenabled ", "false"), new Argument("action.email.reportserverurl ", "splunk.com"), new Argument("action.email.sendpdf ", "false"), new Argument("action.email.sendresults ", "false"), new Argument("action.email.subject ", "sdk-subject"), new Argument("action.email.to ", "*****@*****.**"), new Argument("action.email.trackalert ", "false"), new Argument("action.email.ttl ", "61"), new Argument("action.email.usessl ", "false"), new Argument("action.email.usetls ", "false"), new Argument("action.email.widthsortcolumns ", "false"), new Argument("actions.populatelookup.command ", "$name2$"), new Argument("actions.populatelookup.dest ", "dummypath"), new Argument("actions.populatelookup.hostname ", "dummy2.host.com"), new Argument("actions.populatelookup.maxresults ", "102"), new Argument("actions.populatelookup.maxtime ", "20s"), new Argument("actions.populatelookup.trackalert ", "false"), new Argument("actions.populatelookup.ttl ", "62"), new Argument("actions.rss.command ", "$name3$"), new Argument("actions.rss.hostname ", "dummy3.host.com"), new Argument("actions.rss.maxresults ", "103"), new Argument("actions.rss.maxtime ", "30s"), new Argument("actions.rss.trackalert ", "false"), new Argument("actions.rss.ttl ", "63"), new Argument("actionscriptcommand ", "$name4$"), new Argument("actionscriptfilename ", "action_script_filename"), new Argument("actionscripthostname ", "dummy4.host.com"), new Argument("actionscriptmaxresults ", "104"), new Argument("actionscriptmaxtime ", "40s"), new Argument("actionscripttrackalert ", "false"), new Argument("actionscriptttl ", "64"), new Argument("actions.summaryindex.command ", "$name5$"), new Argument("actions.summaryindex.hostname ", "dummy5.host.com"), new Argument("actions.summaryindex.inline ", "false"), new Argument("actions.summaryindex.maxresults ", "105"), new Argument("actions.summaryindex.maxtime ", "50s"), new Argument("actions.summaryindex.trackalert ", "false"), new Argument("actions.summaryindex.ttl ", "65"), new Argument("actions ", "rss,email,populate_lookup,script,summary_index")); //// Same as the previous dispatch except using custom arg job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Delete the saved search await testSearch.RemoveAsync(); testSearch = await savedSearches.GetOrNullAsync(name); Assert.Null(testSearch); } }
public void SavedSearchDispatch() { Service service = this.Connect(); string savedSearchTitle = "sdk-test1"; SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result; // Ensure test starts in a known good state if (savedSearches.Any(a => a.Name == savedSearchTitle)) { service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); savedSearches.GetAsync().Wait(); } Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); // Create a saved search string search = "search index=sdk-tests * earliest=-1m"; SavedSearch savedSearch = service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }).Result; // Dispatch the saved search and wait for results. Job job = savedSearch.DispatchAsync().Result; job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs(); if (this.VersionCompare(service, "6.0") < 0) { savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password")); savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username")); savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$")); savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text")); savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com")); savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true")); savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101")); savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s")); savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject")); savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61")); savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62")); savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$")); savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s")); savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63")); savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$")); savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename")); savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s")); savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65")); savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index")); } //// Same as the previous dispatch except using custom arg job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Delete the saved search service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); }