/// <summary>
/// Runs the saved search using dispatch arguments.
/// </summary>
/// <param name="args">The arguments.</param>
/// <returns>The <see cref="Job"/>.</returns>
public Job Dispatch(SavedSearchDispatchArgs args)
{
return this.Dispatch((Args) args);
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#67");
// Create a saved search
Job job;
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch = savedSearches.Create("sdk-test1", search);
// Dispatch the saved search and wait for results.
job = savedSearch.Dispatch();
this.Wait(job);
job.Results().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.buckets", 100));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.earliest_time", "aaaa"));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
var savedSearchDispatchArgs = new SavedSearchDispatchArgs();
savedSearchDispatchArgs.ActionEmailAuthPassword = "******";
savedSearchDispatchArgs.ActionEmailAuthUsername = "******";
savedSearchDispatchArgs.ActionEmailBcc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCommand = "$name1$";
savedSearchDispatchArgs.ActionEmailFormat = "text";
savedSearchDispatchArgs.ActionEmailFrom = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailHostname = "dummy1.host.com";
savedSearchDispatchArgs.ActionEmailInline = true;
savedSearchDispatchArgs.ActionEmailMailServer = "splunk.com";
savedSearchDispatchArgs.ActionEmailMaxResults = 101;
savedSearchDispatchArgs.ActionEmailMaxTime = "10s";
savedSearchDispatchArgs.ActionEmailPdfView = "dummy";
savedSearchDispatchArgs.ActionEmailReportPaperOrientation = "landscape";
savedSearchDispatchArgs.ActionEmailReportPaperSize = "letter";
savedSearchDispatchArgs.ActionEmailReportServerEnabled = false;
savedSearchDispatchArgs.ActionEmailReportServerUrl = "splunk.com";
savedSearchDispatchArgs.ActionEmailSendPdf = false;
savedSearchDispatchArgs.ActionEmailSendResults = false;
savedSearchDispatchArgs.ActionEmailSubject = "sdk-subject";
savedSearchDispatchArgs.ActionEmailTo = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailTrackAlert = false;
savedSearchDispatchArgs.ActionEmailTtl = "61";
savedSearchDispatchArgs.ActionEmailUseSsl = false;
savedSearchDispatchArgs.ActionEmailUseTls = false;
savedSearchDispatchArgs.ActionEmailWidthSortColumns = false;
savedSearchDispatchArgs.ActionPopulateLookupCommand = "$name2$";
savedSearchDispatchArgs.ActionPopulateLookupDest = "dummypath";
savedSearchDispatchArgs.ActionPopulateLookupHostname = "dummy2.host.com";
savedSearchDispatchArgs.ActionPopulateLookupMaxResults = 102;
savedSearchDispatchArgs.ActionPopulateLookupMaxTime = "20s";
savedSearchDispatchArgs.ActionPopulateLookupTrackAlert = false;
savedSearchDispatchArgs.ActionPopulateLookupTtl = "62";
savedSearchDispatchArgs.ActionRssCommand = "$name3$";
savedSearchDispatchArgs.ActionRssHostname = "dummy3.host.com";
savedSearchDispatchArgs.ActionRssMaxResults = 103;
savedSearchDispatchArgs.ActionRssMaxTime = "30s";
savedSearchDispatchArgs.ActionRssTrackAlert = false;
savedSearchDispatchArgs.ActionRssTtl = "63";
savedSearchDispatchArgs.ActionScriptCommand = "$name4$";
savedSearchDispatchArgs.ActionScriptFilename = "action_script_filename";
savedSearchDispatchArgs.ActionScriptHostname = "dummy4.host.com";
savedSearchDispatchArgs.ActionScriptMaxResults = 104;
savedSearchDispatchArgs.ActionScriptMaxTime = "40s";
savedSearchDispatchArgs.ActionScriptTrackAlert = false;
savedSearchDispatchArgs.ActionScriptTtl = "64";
savedSearchDispatchArgs.ActionSummaryIndexCommand = "$name5$";
savedSearchDispatchArgs.ActionSummaryIndexHostname = "dummy5.host.com";
savedSearchDispatchArgs.ActionSummaryIndexInline = false;
savedSearchDispatchArgs.ActionSummaryIndexMaxResults = 105;
savedSearchDispatchArgs.ActionSummaryIndexMaxTime = "50s";
savedSearchDispatchArgs.ActionSummaryIndexTrackAlert = false;
savedSearchDispatchArgs.ActionSummaryIndexTtl = "65";
savedSearchDispatchArgs.Actions = "rss,email,populate_lookup,script,summary_index";
// Same as the previous dispatch except using custom arg
job = savedSearch.Dispatch(savedSearchDispatchArgs);
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Delete the saved search
savedSearches.Remove("sdk-test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#68");
}
