/// <summary>
/// Submit a job to Splunk to be scheduled immediately.
/// </summary>
/// <param name="job">Job object containing details of the search job.</param>
/// <returns>Returns the string containing the Splunk job identifier.</returns>
public string SubmitJob(SplunkDataQuery job)
{
string path = "/services/search/jobs";
ServerRequest request = new ServerRequest(path, ServerRequest.HttpMethod.POST);
request.Args.Add(new KeyValuePair <string, string>("search", job.Value));
request.Args.Add(new KeyValuePair <string, string>("earliest_time", string.Format("{0}.000+00:00", job.EarliestTime.ToUniversalTime().ToString("s"))));
request.Args.Add(new KeyValuePair <string, string>("latest_time", string.Format("{0}.000+00:00", job.LatestTime.ToUniversalTime().ToString("s"))));
request.Args.Add(new KeyValuePair <string, string>("max_count", MaxCount.ToString()));
request.Args.Add(new KeyValuePair <string, string>("timeout", SearchJobTtl.ToString()));
ServerResponse response = this.Send(request);
var doc = new XmlDocument();
doc.LoadXml(response.Content);
string sid;
try
{
sid = doc.SelectSingleNode("/response/sid").InnerText;
}
catch (Exception)
{
throw new Exception(String.Format("Something went wrong while submitting the search to Splunk. The Splunk API returned:\n{0}", response.Content));
}
return(sid);
}
/// <summary>
/// Send a ServerRequest to the splunk API service.
/// </summary>
/// <param name="request">ServerRequest object containing the request details.</param>
/// <returns>ServerResponse object that contains the details of the response from the server.</returns>
public ServerResponse Send(ServerRequest request)
{
ServerResponse response;
string url = BuildUrl(request.Path);
var clientHandler = new HttpClientHandler();
if (!ValidateCertificate)
{
clientHandler.ServerCertificateCustomValidationCallback += (message, certificate2, arg3, arg4) => true;
}
using (HttpClient hc = new HttpClient(clientHandler))
{
if (AuthToken != null)
{
hc.DefaultRequestHeaders.Add("Authorization", "Splunk " + AuthToken);
}
try
{
switch (request.Method)
{
case ServerRequest.HttpMethod.GET:
string queryString = request.ArgsQueryString();
url = (queryString.Length > 0) ? string.Format("{0}?{1}", url, request.ArgsQueryString()) : url;
using (var rm = hc.GetAsync(url).Result)
{
string responseContent = rm.Content.ReadAsStringAsync().Result;
int statusCode = Convert.ToInt32(rm.StatusCode);
response = new ServerResponse(responseContent, statusCode);
}
break;
case ServerRequest.HttpMethod.POST:
using (var rm = hc.PostAsync(url, new FormUrlEncodedContent(request.Args)).Result)
{
string responseContent = rm.Content.ReadAsStringAsync().Result;
int statusCode = Convert.ToInt32(rm.StatusCode);
response = new ServerResponse(responseContent, statusCode);
}
break;
default:
throw new NotImplementedException();
}
}
catch (Exception e)
{
throw new Exception(String.Format("A problem occurred while communicating with the Splunk API.\nCheck that the Splunk API is online and accessible.\n\nThe exception was:\n\n{0}", e.Message));
}
}
return(response);
}
/// <summary>
/// Logs in to Splunk and sets the current authorization token.
/// </summary>
/// <param name="username">The username.</param>
/// <param name="password">The password.</param>
public void Login(string username, string password)
{
ServerRequest request = new ServerRequest("/services/auth/login", ServerRequest.HttpMethod.POST);
request.Args.Add(new KeyValuePair <string, string>("username", username));
request.Args.Add(new KeyValuePair <string, string>("password", password));
ServerResponse loginResponse = this.Send(request);
XmlDocument doc = new XmlDocument();
doc.LoadXml(loginResponse.Content);
string authToken = doc.SelectSingleNode("/response/sessionKey").InnerText;
this.AuthToken = authToken;
}
/// <summary>
/// Returns the current dispatch state of supplied job.
/// </summary>
/// <param name="job">Job object containing details of the search job.</param>
/// <returns>The 'dispatchStatus'.</returns>
public SplunkJobStatus GetJobStatus(string searchId)
{
string path = string.Format("{0}/{1}", "/services/search/jobs", searchId);
ServerRequest request = new ServerRequest(path, ServerRequest.HttpMethod.GET);
ServerResponse response = this.Send(request);
var doc = new XmlDocument();
doc.LoadXml(response.Content);
//Create XmlNamespaceManager so that we can query s: prefixed nodes.
var nsmgr = new XmlNamespaceManager(doc.NameTable);
//Add Splunk and OpenSearch namespaces
nsmgr.AddNamespace("s", "http://dev.splunk.com/ns/rest");
nsmgr.AddNamespace("opensearch", "http://a9.com/-/spec/opensearch/1.1/");
var dispatchStatus = doc.SelectSingleNode("//s:dict/s:key[@name='dispatchState']", nsmgr).InnerText;
switch (dispatchStatus)
{
case "QUEUED":
return(SplunkJobStatus.QUEUED);
case "PARSING":
return(SplunkJobStatus.PARSING);
case "RUNNING":
return(SplunkJobStatus.RUNNING);
case "PAUSED":
return(SplunkJobStatus.PAUSED);
case "FINALIZING":
return(SplunkJobStatus.FINALIZING);
case "FAILED":
return(SplunkJobStatus.FAILED);
case "DONE":
return(SplunkJobStatus.DONE);
default:
throw new KeyNotFoundException(String.Format("Unknown job status: {0}", dispatchStatus));
}
}
public string GetJobResults(SplunkDataQuery job, OutputMode mode)
{
string path = string.Format("{0}/{1}/{2}", "/services/search/jobs", job.RemoteId, "results");
ServerRequest request = new ServerRequest(path, ServerRequest.HttpMethod.GET);
//Set count to 0 to get all rows
request.Args.Add(new KeyValuePair <string, string>("count", "0"));
request.Args.Add(new KeyValuePair <string, string>("output_mode", mode.ToString()));
ServerResponse response = this.Send(request);
if (response.Status == 204)
{
return(null);
}
else
{
return(response.Content);
}
}