public void SavedSearchDispatch() { Service service = this.Connect(); string savedSearchTitle = "sdk-test1"; SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result; // Ensure test starts in a known good state if (savedSearches.Any(a => a.Name == savedSearchTitle)) { service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); savedSearches.GetAsync().Wait(); } Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); // Create a saved search string search = "search index=sdk-tests * earliest=-1m"; SavedSearch savedSearch = service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }).Result; // Dispatch the saved search and wait for results. Job job = savedSearch.DispatchAsync().Result; job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs(); if (this.VersionCompare(service, "6.0") < 0) { savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password")); savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username")); savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$")); savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text")); savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com")); savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true")); savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101")); savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s")); savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject")); savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61")); savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62")); savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$")); savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s")); savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63")); savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$")); savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename")); savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s")); savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65")); savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index")); } //// Same as the previous dispatch except using custom arg job = savedSearch.DispatchAsync(null,savedSearchTemplateArgs).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Delete the saved search service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); }