/// <summary> /// Write events using EventStreamWriter /// </summary> // This method can be used by manual testing thus is public public static void WriteEvents() { using (var writer = new EventStreamWriter()) { var eventTemplate = new EventElement { Index = "sdk-tests2", Host = "test host", SourceType = "test sourcetype", Source = "test source", }; WriteEventData( writer, eventTemplate, "Event with all default fields set"); WriteEventData( writer, eventTemplate, "Letter O with double acute: \u0150"); eventTemplate.Unbroken = true; WriteEventData( writer, eventTemplate, "Part 1 of an unbroken event "); WriteEventData( writer, eventTemplate, "Part 2 of an unbroken event ending with newline" + Environment.NewLine); WriteEventDone( writer, eventTemplate); eventTemplate.Unbroken = false; WriteEventData( writer, eventTemplate, "Event after done key"); var timedEvent = eventTemplate; timedEvent.Time = new DateTime(2013, 1, 1, 0, 0, 0, DateTimeKind.Utc); timedEvent.Data = "Event with fixed time"; writer.Write(timedEvent); WriteMultiplex(writer); } }
/// <summary> /// Write a done key /// </summary> /// <param name="writer">An event writer</param> /// <param name="eventTemplate">An event template</param> private static void WriteEventDone(EventStreamWriter writer, EventElement eventTemplate) { var @event = eventTemplate; @event.Unbroken = false; @event.Done = true; writer.Write(@event); }
/// <summary> /// Streams the events. /// </summary> /// <param name="inputDefinition">The input definition.</param> public override void StreamEvents(InputDefinition inputDefinition) { string tailFilters = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("tailfilterproperty",""); string filter = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("filter", ""); string address = inputDefinition.Stanza.SingleValueParameters["address"]; string store = string.Empty; string last = string.Empty; bool tail = !string.IsNullOrEmpty(tailFilters); if (tail) { store = Path.Combine(inputDefinition.CheckpointDirectory, "lastvalue.txt"); last = File.Exists(store) ? File.ReadAllText(store) // .Split('\n') : inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("defaulttailfilter",""); //.Split('\n'); if (!string.IsNullOrEmpty(filter)) { filter = string.Format(filter, last); } else { address = string.Format(address, last); } } IEnumerable<IDictionary<string, object>> source = new Splunk.ODataSource() { Credentials = System.Net.CredentialCache.DefaultNetworkCredentials, Address = address, Resource = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("resource",""), Filter = filter, //OrderBy = inputDefinition.Stanza.MultiValueParameterXmlElements, //Select = inputDefinition.Stanza.MultiValueParameterXmlElements, }; string includeEmptyString; bool includeEmpty = false; if(inputDefinition.Stanza.SingleValueParameters.TryGetValue("includeEmpty", out includeEmptyString)) { bool.TryParse(includeEmptyString, out includeEmpty); } using (var writer = new EventStreamWriter()) { foreach (IDictionary<string, object> item in source) { writer.Write(new EventElement { Data = item.ToString(includeEmpty: includeEmpty), Stanza = inputDefinition.Stanza.Name, }); if (tail) { last = ((IDictionary) item).SelectRecursive(tailFilters.Split(',')).ToStringInvariant(); } } if (tail) { using (var stream = File.Open(store, FileMode.Create, FileAccess.Write)) { using (var storeWriter = new StreamWriter(stream)) { storeWriter.WriteLine(last); } } } } }
/// <summary> /// Write event data without appending a newline seperator. /// </summary> /// <param name="writer">An event writer</param> /// <param name="eventTemplate">An event template</param> /// <param name="eventData">Event data</param> private static void WriteEventData(EventStreamWriter writer, EventElement eventTemplate, string eventData) { var @event = eventTemplate; @event.Data = eventData; writer.Write(@event); }
/// <summary> /// Stream events into stdout /// </summary> /// <param name="inputDefinition">Input definition from Splunk</param> public override void StreamEvents(InputDefinition inputDefinition) { string lastVarValue = null; using (var writer = new EventStreamWriter()) { var stanza = inputDefinition.Stanza; // Gets input name. It is also the env var name. const string Seperator = @"://"; var indexInputName = stanza.Name.IndexOf(Seperator) + Seperator.Length; var varName = stanza.Name.Substring(indexInputName); SystemLogger.Write( string.Format( "Name of the var to monitor is : {0}", varName)); var interval = 1000; string intervalParam; if (stanza.SingleValueParameters.TryGetValue( PollingInterval, out intervalParam)) { interval = int.Parse(intervalParam); } SystemLogger.Write( string.Format( "Polling interval is : {0}", interval)); while (true) { var varValue = Environment.GetEnvironmentVariable( varName, EnvironmentVariableTarget.Machine); // Event data can't be null for real events. varValue = varValue ?? "(not exist)"; // Splunk does not record lines with only white spaces. varValue = string.IsNullOrWhiteSpace(varValue) ? "(white space)" : varValue; if (varValue != lastVarValue) { writer.Write( new EventElement { Source = varName, Data = varValue, }); lastVarValue = varValue; } Thread.Sleep(interval); } } }