/// <summary>
/// Returns the input stream I/O handle for the preview results from
/// this job, adding optional parameters.
/// </summary>
/// <param name="args">The optional parameters.</param>
/// <returns>The preview results input <see cref="Stream"/> I/O
/// handle.</returns>
public Stream ResultsPreview(JobResultsPreviewArgs args)
{
return this.ResultsPreview((Args) args);
}
/// <summary>
/// The main program
/// </summary>
/// <param name="argv">The command line arguments</param>
public static void Main(string[] argv)
{
Command cli = Command.Splunk("search_realtime");
cli.AddRule("search", typeof(string), "search string");
cli.Parse(argv);
if (!cli.Opts.ContainsKey("search"))
{
System.Console.WriteLine(
"Search query string required, use --search=\"query\"");
Environment.Exit(1);
}
var service = Service.Connect(cli.Opts);
// Realtime window is 5 minutes
var queryArgs = new JobArgs
{
SearchMode = JobArgs.SearchModeEnum.Realtime,
EarliestTime = "rt-5m",
LatestTime = "rt",
};
var job = service.GetJobs().Create(
(string)cli.Opts["search"],
queryArgs);
var outputArgs = new JobResultsPreviewArgs
{
OutputMode = JobResultsPreviewArgs.OutputModeEnum.Xml,
// Return all entries.
Count = 0
};
for (var i = 0; i < 5; i++)
{
System.Console.WriteLine();
System.Console.WriteLine();
System.Console.WriteLine("Snapshot " + i + ":");
using (var stream = job.ResultsPreview(outputArgs))
{
using(var rr = new ResultsReaderXml(stream))
{
foreach (var @event in rr)
{
System.Console.WriteLine("EVENT:");
foreach (string key in @event.Keys)
{
System.Console.WriteLine(
" " + key + " -> " + @event[key]);
}
}
}
}
Thread.Sleep(500);
}
job.Cancel();
}
/// <summary>
/// Returns the input stream I/O handle for the preview results from
/// this job, adding optional parameters.
/// </summary>
/// <param name="args">The optional parameters.</param>
/// <returns>The preview results input <see cref="Stream"/> I/O
/// handle.</returns>
public Stream ResultsPreview(JobResultsPreviewArgs args)
{
return(this.ResultsPreview((Args)args));
}
