/// <summary>
/// Creates a new user entity from a username, password, and role.
/// Usernames must be unique on the system, and are used by the user to
/// log in to Splunk.
/// </summary>
/// <param name="name">The username for the new user.</param>
/// <param name="password">The password for this new user.</param>
/// <param name="role">A role to assign this new user.</param>
/// <param name="args">The optional args.</param>
/// <returns>The new user entity.</returns>
public User Create(string name, string password, string role, Args args)
{
args = Args.Create(args);
args.Add("password", password);
args.Add("roles", role);
return(this.Create(name.ToLower(), args));
}
/// <summary>
/// Performs the requested action on this job.
/// </summary>
/// <param name="action">The requested action.</param>
/// <param name="args">The variable arguments.</param>
/// <returns>The <see cref="Job"/>.</returns>
public Job Control(string action, Args args)
{
args = Args.Create(args).Set("action", action);
this.Service.Post(this.ActionPath("control"), args);
this.Invalidate();
return(this);
}
/// <summary>
/// Creates a search with a UTF-8 pre-encoded search request.
/// </summary>
/// <remarks>
/// A "oneshot" request is invalid. To create a oneshot search,
/// use the <see cref="Service.Oneshot(string)"/> method instead.
/// </remarks>
/// <param name="query">The search query.</param>
/// <param name="args">Additional arguments for this job.</param>
/// <returns>The job.</returns>
public new Job Create(string query, Args args)
{
if (args != null && args.ContainsKey("exec_mode"))
{
if (args["exec_mode"].Equals("oneshot"))
{
throw new Exception(
"Oneshot not allowed, use service oneshot search method");
}
}
args = Args.Create(args).Set("search", query);
ResponseMessage response = Service.Post(Path, args);
/* assert(response.getStatus() == 201); */
StreamReader streamReader = new StreamReader(response.Content);
XmlDocument doc = new XmlDocument();
doc.LoadXml(streamReader.ReadToEnd());
string sid = doc.SelectSingleNode("/response/sid").InnerText;
Job job = new Job(Service, "search/jobs/" + sid);
job.Refresh();
return(job);
}
/// <summary>
/// Updates the entity with the values you previously set using the
/// <see cref="WindowsRegistryInput"/> properties, and any additional
/// specified arguments. The specified arguments take precedence over
/// the values that were set using the
/// <see cref="WindowsRegistryInput"/> properties.
/// </summary>
/// <param name="args">The key/value pairs to update.</param>
public override void Update(Dictionary <string, object> args)
{
// Add required arguments if not already present
if (!args.ContainsKey("baseline"))
{
args = Args.Create(args);
args.Add("baseline", this.Baseline);
}
if (!args.ContainsKey("hive"))
{
args = Args.Create(args);
args.Add("hive", this.Hive);
}
if (!args.ContainsKey("proc"))
{
args = Args.Create(args);
args.Add("proc", this.Proc);
}
if (!args.ContainsKey("type"))
{
args = Args.Create(args);
args.Add("type", this.Type);
}
base.Update(args);
}
/// <summary>
/// Creates an <see cref="Entity"/> in this collection.
/// </summary>
/// <param name="name">The name of this entity.</param>
/// <param name="args">The variable argument list.</param>
/// <returns>The entity.</returns>
public virtual T Create(string name, Args args)
{
args = Args.Create(args);
args.Add("name", name);
this.Service.Post(this.Path, args);
this.Invalidate();
return(this.Get(name));
}
/// <summary>
/// Runs a search using the search/jobs/export endpoint, which streams
/// results back via a <see cref="Stream"/>.
/// </summary>
/// <param name="search">The search query string.</param>
/// <param name="args">The search arguments.</param>
/// <returns>A results stream.</returns>
public Stream Export(string search, Args args)
{
args = Args.Create(args).Set("search", search);
SetSegmentationDefault(ref args);
ResponseMessage response = Get("search/jobs/export", args);
return(new ResponseStream(response, true));
}
/// <summary>
/// Updates the event type with the values you previously set using
/// the class properties, and any additional specified arguments. The
/// specified arguments take precedence over the values that were set
/// using the properties.
/// </summary>
/// <param name="args">The arguments.</param>
public override void Update(Dictionary <string, object> args)
{
// Add required arguments if not already present
if (!args.ContainsKey("search"))
{
args = Args.Create(args);
args.Add("search", this.Search);
}
base.Update(args);
}
Create(string name, InputKind kind, Dictionary <string, object> args)
{
args = Args.Create(args);
args.Add("name", name);
string path = this.Path + "/" + kind.RelPath;
this.Service.Post(path, args);
this.Invalidate();
return(this.Get(name));
}
/// <summary>
/// Creates a simplified synchronous search using search arguments.
/// </summary>
/// <param name="query">The search string.</param>
/// <param name="inputArgs">The variable arguments.</param>
/// <param name="outputArgs">The output arguments.</param>
/// <returns>The stream handle of the search.</returns>
/// <remarks>
/// Use this method for simple searches.
/// </remarks>
public Stream Search(string query, Args inputArgs, Args outputArgs)
{
inputArgs = Args.Create(inputArgs);
inputArgs.Set("search", query);
// always block until results are ready.
inputArgs.Set("exec_mode", "blocking");
Job job = this.GetJobs().Create(query, inputArgs);
return(job.Results(outputArgs));
}
/// <summary>
/// Creates a oneshot synchronous search using search arguments.
/// </summary>
/// <param name="query">The search query.</param>
/// <param name="inputArgs">The input arguments.</param>
/// <returns>An I/O stream.</returns>
public Stream Oneshot(string query, Args inputArgs)
{
inputArgs = (inputArgs == null) ? Args.Create() : inputArgs;
inputArgs = Args.Create(inputArgs);
inputArgs.Add("search", query);
inputArgs.Add("exec_mode", "oneshot");
SetSegmentationDefault(ref inputArgs);
ResponseMessage response = this.Post("search/jobs", inputArgs);
return(new ResponseStream(response));
}
/// <summary>
/// Updates the entity with the values you previously set using the
/// class properties, and any additional specified arguments. The
/// specified arguments take precedence over the values that were set
/// using the properties.
/// </summary>
/// <param name="args">The key/value pairs to update.</param>
public override void Update(Dictionary <string, object> args)
{
// If not present in the update keys, add required attributes
if (!args.ContainsKey("classes"))
{
args = Args.Create(args);
args.Add("classes", this.Classes);
}
if (!args.ContainsKey("interval"))
{
args = Args.Create(args);
args.Add("interval", this.Interval);
}
if (!args.ContainsKey("lookup_host"))
{
args = Args.Create(args);
args.Add("lookup_host", this.LookupHost);
}
base.Update(args);
}
/// <summary>
/// Creates a saved search from a name, search expression, and
/// additional arguments.
/// /// </summary>
/// <param name="name">The name of the saved search.</param>
/// <param name="search">The search string.</param>
/// <param name="args">The arguments.</param>
/// <returns>The saved search.</returns>
public SavedSearch Create(string name, string search, Args args)
{
args = Args.Create(args);
args.Add("search", search);
return(base.Create(name, args));
}
/// <summary>
/// Encodes a dictionary of strings or string arrays into a single
/// UTF-8-encoded string.
/// </summary>
/// <param name="args">The string or string array.</param>
/// <returns>The UTF-8-encoded string.</returns>
public static string Encode(Dictionary <string, object> args)
{
return(Args.Create(args).Encode());
}
/// <summary>
/// Parses a search query with additional arguments and returns a
/// semantic map for the search in JSON format.
/// </summary>
/// <param name="query">The search query.</param>
/// <param name="args">The arguments.</param>
/// <returns>A parse response message.</returns>
public ResponseMessage Parse(string query, Args args)
{
args = Args.Create(args);
args.Add("q", query);
return(this.Get("search/parser", args));
}