void CanConstruct()
{
var attributes = new SavedSearchAttributes();
Assert.Equal("action.email.bcc=null; action.email.cc=null; action.email.command=null; action.email.format=null; action.email.from=null; action.email.inline=null; action.email.mailserver=null; action.email.maxresults=null; action.email.maxtime=null; action.email.reportCIDFontList=null; action.email.reportIncludeSplunkLogo=null; action.email.reportPaperOrientation=null; action.email.reportPaperSize=null; action.email.reportServerEnabled=null; action.email.sendpdf=null; action.email.sendresults=null; action.email.subject=null; action.email.to=null; action.email.track_alert=null; action.email.ttl=null; action.email.use_ssl=null; action.email.use_tls=null; action.email.width_sort_columns=null; action.populate_lookup.command=null; action.populate_lookup.dest=null; action.populate_lookup.hostname=null; action.populate_lookup.maxresults=null; action.populate_lookup.maxtime=null; action.populate_lookup.track_alert=null; action.populate_lookup.ttl=null; action.rss.command=null; action.rss.maxresults=null; action.rss.maxtime=null; action.rss.track_alert=null; action.rss.ttl=null; action.script.command=null; action.script.filename=null; action.script.hostname=null; action.script.maxresults=null; action.script.maxtime=null; action.script.track_alert=null; action.script.ttl=null; action.summary_index.command=null; action.summary_index.inline=null; action.summary_index.maxresults=null; action.summary_index.maxtime=null; action.summary_index.name=null; action.summary_index.track_alert=null; action.summary_index.ttl=null; actions=null; alert.digest_mode=null; alert.expires=null; alert.severity=null; alert.track=null; alert_comparator=null; alert_condition=null; alert_threshold=null; alert_type=null; auto_summarize=null; auto_summarize.command=null; auto_summarize.cron_schedule=null; auto_summarize.dispatch.time_format=null; auto_summarize.dispatch.ttl=null; auto_summarize.max_disabled_buckets=null; auto_summarize.max_summary_ratio=null; auto_summarize.max_summary_size=null; auto_summarize.max_time=null; auto_summarize.suspend_period=null; cron_schedule=null; description=null; disabled=null; dispatch.buckets=null; dispatch.earliest_time=null; dispatch.latest_time=null; dispatch.lookups=null; dispatch.max_count=null; dispatch.max_time=null; dispatch.reduce_freq=null; dispatch.rt_backfill=null; dispatch.spawn_process=null; dispatch.time_format=null; is_scheduled=null; is_visible=null; max_concurrent=null; realtime_schedule=null; restart_on_searchpeer_add=null; run_on_startup=null; search=null",
attributes.ToString());
Assert.Equal(new List<Argument>(), attributes);
}
/// <summary>
/// Asynchronously updates a saved search.
/// </summary>
/// <param name="name">
/// Name of the saved search to be updated.
/// </param>
/// <param name="attributes">
/// New attributes for the saved search to be updated.
/// </param>
/// <param name="dispatchArgs">
/// New dispatch arguments for the saved search to be updated.
/// </param>
/// <param name="templateArgs">
/// New template arguments for the saved search to be updated.
/// </param>
/// <returns>
/// An object representing the saved search that was updated.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/aV9eiZ">POST
/// saved/searches/{name}</a> endpoint to update the saved search
/// identified by <see cref="name"/>.
/// </remarks>
public async Task<SavedSearch> UpdateSavedSearchAsync(string name, SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null)
{
var resource = new SavedSearch(this.Context, this.Namespace, name);
await resource.UpdateAsync(attributes, dispatchArgs, templateArgs);
return resource;
}
public async Task CanCrudSavedSearch()
{
using (var service = await SdkHelper.CreateService())
{
//// Create
var name = MockContext.GetOrElse(string.Format("delete-me-{0}", Guid.NewGuid()));
var search = "search index=_internal | head 1000";
var originalAttributes = new SavedSearchAttributes
{
CronSchedule = "00 * * * *", // on the hour
IsScheduled = true,
IsVisible = false
};
var savedSearch = await service.SavedSearches.CreateAsync(name, search, originalAttributes);
Assert.Equal(search, savedSearch.Search);
Assert.Equal(originalAttributes.CronSchedule, savedSearch.CronSchedule);
Assert.Equal(originalAttributes.IsScheduled, savedSearch.IsScheduled);
Assert.Equal(originalAttributes.IsVisible, savedSearch.IsVisible);
//// Read
savedSearch = await service.SavedSearches.GetAsync(name);
Assert.Equal(false, savedSearch.IsVisible);
//// Read history
var jobHistory = await savedSearch.GetHistoryAsync();
Assert.Equal(0, jobHistory.Count);
Job job1 = await savedSearch.DispatchAsync();
jobHistory = await savedSearch.GetHistoryAsync();
Assert.Equal(1, jobHistory.Count);
Assert.Equal(job1, jobHistory[0]);
Assert.Equal(job1.Name, jobHistory[0].Name);
Assert.Equal(job1.ResourceName, jobHistory[0].ResourceName);
Assert.Equal(job1.Sid, jobHistory[0].Sid);
Job job2 = await savedSearch.DispatchAsync();
jobHistory = await savedSearch.GetHistoryAsync();
Assert.Equal(2, jobHistory.Count);
Assert.Equal(1, jobHistory.Select(job => job).Where(job => job.Equals(job1)).Count());
Assert.Equal(1, jobHistory.Select(job => job).Where(job => job.Equals(job2)).Count());
await job1.CancelAsync();
jobHistory = await savedSearch.GetHistoryAsync();
Assert.Equal(1, jobHistory.Count);
Assert.Equal(job2, jobHistory[0]);
Assert.Equal(job2.Name, jobHistory[0].Name);
Assert.Equal(job2.ResourceName, jobHistory[0].ResourceName);
Assert.Equal(job2.Sid, jobHistory[0].Sid);
await job2.CancelAsync();
jobHistory = await savedSearch.GetHistoryAsync();
Assert.Equal(0, jobHistory.Count);
//// Read schedule
var dateTime = MockContext.GetOrElse(DateTime.Now);
var schedule = await savedSearch.GetScheduledTimesAsync("0", "+2d");
Assert.Equal(48, schedule.Count);
var expected = dateTime.AddMinutes(60);
expected = expected.Date.AddHours(expected.Hour);
Assert.Equal(expected, schedule[0]);
//// Update
search = "search index=_internal * earliest=-1m";
var updatedAttributes = new SavedSearchAttributes
{
ActionEmailBcc = "*****@*****.**",
ActionEmailCC = "*****@*****.**",
ActionEmailFrom = "*****@*****.**",
ActionEmailTo = "[email protected], [email protected]",
IsVisible = true
};
await savedSearch.UpdateAsync(search, updatedAttributes);
Assert.Equal(search, savedSearch.Search);
Assert.Equal(updatedAttributes.ActionEmailBcc, savedSearch.Actions.Email.Bcc);
Assert.Equal(updatedAttributes.ActionEmailCC, savedSearch.Actions.Email.CC);
Assert.Equal(updatedAttributes.ActionEmailFrom, savedSearch.Actions.Email.From);
Assert.Equal(updatedAttributes.ActionEmailTo, savedSearch.Actions.Email.To);
Assert.Equal(updatedAttributes.IsVisible, savedSearch.IsVisible);
//// Update schedule
dateTime = MockContext.GetOrElse(DateTime.Now);
//// TODO:
//// Figure out why POST saved/searches/{name}/reschedule ignores schedule_time and runs the
//// saved searches right away. Are we using the right time format?
//// TODO:
//// Figure out how to parse or--more likely--complain that savedSearch.NextScheduledTime uses
//// timezone names like "Pacific Daylight Time".
await savedSearch.ScheduleAsync(dateTime.AddMinutes(15)); // Does not return anything but status
await savedSearch.GetScheduledTimesAsync("0", "+2d");
//// Delete
await savedSearch.RemoveAsync();
}
}
public async Task SavedSearchesUpdateProperties()
{
using (var service = await SdkHelper.CreateService())
{
SavedSearchCollection savedSearches = service.SavedSearches;
const string name = "sdk-test_UpdateProperties";
const string search = "search index=sdk-tests * earliest=-1m";
//// Ensure test starts in a known good state
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
//// Create a saved search
testSearch = await savedSearches.CreateAsync(name, search);
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.NotNull(testSearch);
//// Read the saved search
await savedSearches.GetAllAsync();
testSearch = savedSearches.SingleOrDefault(a => a.Name == name);
Assert.True(testSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
bool updatedSnapshot = await testSearch.UpdateAsync(new SavedSearchAttributes() { IsVisible = false });
Assert.True(updatedSnapshot);
Assert.False(testSearch.IsVisible);
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
// Create a saved search with some additional arguments
testSearch = await savedSearches.CreateAsync(name, search, new SavedSearchAttributes() { IsVisible = false });
Assert.False(testSearch.IsVisible);
// Set email param attributes
var attributes = new SavedSearchAttributes()
{
ActionEmailAuthPassword = "******",
ActionEmailAuthUsername = "******",
ActionEmailBcc = "*****@*****.**",
ActionEmailCC = "*****@*****.**",
ActionEmailCommand = "$name1$",
ActionEmailFormat = EmailFormat.Plain,
ActionEmailFrom = "*****@*****.**",
//attrs.ActionEmailHostname = "dummy1.host.com",
ActionEmailInline = "true",
ActionEmailMailServer = "splunk.com",
ActionEmailMaxResults = 101,
ActionEmailMaxTime = "10s",
ActionEmailSendPdf = true, //??ActionEmailPdfView = "dummy",
ActionEmailSendResults = true, //??ActionEmailPreProcessResults = "*",
ActionEmailReportPaperOrientation = PaperOrientation.Landscape,
ActionEmailReportPaperSize = PaperSize.Letter,
ActionEmailReportServerEnabled = false,
//attrs.ActionEmailReportServerUrl = "splunk.com",
ActionEmailSubject = "sdk-subject",
ActionEmailTo = "*****@*****.**",
ActionEmailTrackAlert = false,
ActionEmailTtl = "61",
ActionEmailUseSsl = false,
ActionEmailUseTls = false,
ActionEmailWidthSortColumns = false,
ActionPopulateLookupCommand = "$name2$",
ActionPopulateLookupDestination = "dummypath",
ActionPopulateLookupHostName = "dummy2.host.com",
ActionPopulateLookupMaxResults = 102,
ActionPopulateLookupMaxTime = "20s",
ActionPopulateLookupTrackAlert = false,
ActionPopulateLookupTtl = "62",
ActionRssCommand = "$name3$",
//attrs.ActionRssHostname = "dummy3.host.com",
ActionRssMaxResults = 103,
ActionRssMaxTime = "30s",
ActionRssTrackAlert = "false",
ActionRssTtl = "63",
ActionScriptCommand = "$name4$",
ActionScriptFileName = "action_script_filename",
ActionScriptHostName = "dummy4.host.com",
ActionScriptMaxResults = 104,
ActionScriptMaxTime = "40s",
ActionScriptTrackAlert = false,
ActionScriptTtl = "64",
ActionSummaryIndexName = "default",
ActionSummaryIndexCommand = "$name5$",
//attrs.ActionSummaryIndexHostname = "dummy5.host.com",
ActionSummaryIndexInline = false,
ActionSummaryIndexMaxResults = 105,
ActionSummaryIndexMaxTime = "50s",
ActionSummaryIndexTrackAlert = false,
ActionSummaryIndexTtl = "65",
Actions = "rss,email,populate_lookup,script,summary_index"
};
await testSearch.UpdateAsync(attributes);
// check
Assert.True(testSearch.Actions.Email != null); //IsActionEmail));
Assert.True(testSearch.Actions.PopulateLookup != null);
Assert.True(testSearch.Actions.Rss != null);
Assert.True(testSearch.Actions.Script != null);
Assert.True(testSearch.Actions.SummaryIndex != null);
Assert.Equal("sdk-password", testSearch.Actions.Email.AuthPassword);
Assert.Equal("sdk-username", testSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.CC);
Assert.Equal("$name1$", testSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, testSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(testSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, testSearch.Actions.Email.MaxResults);
Assert.Equal("10s", testSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, testSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, testSearch.Actions.Email.ReportPaperSize);
Assert.False(testSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.True(testSearch.Actions.Email.SendPdf);
Assert.True(testSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", testSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.To);
Assert.False(testSearch.Actions.Email.TrackAlert);
Assert.Equal("61", testSearch.Actions.Email.Ttl);
Assert.False(testSearch.Actions.Email.UseSsl);
Assert.False(testSearch.Actions.Email.UseTls);
Assert.False(testSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", testSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", testSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", testSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, testSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", testSearch.Actions.PopulateLookup.MaxTime);
Assert.False(testSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", testSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", testSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, testSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", testSearch.Actions.Rss.MaxTime);
Assert.False(testSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", testSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", testSearch.Actions.Script.Command);
Assert.Equal("action_script_filename", testSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", testSearch.Actions.Script.Hostname);
Assert.Equal(104, testSearch.Actions.Script.MaxResults);
Assert.Equal("40s", testSearch.Actions.Script.MaxTime);
Assert.False(testSearch.Actions.Script.TrackAlert);
Assert.Equal("64", testSearch.Actions.Script.Ttl);
Assert.Equal("default", testSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", testSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(testSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, testSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", testSearch.Actions.SummaryIndex.MaxTime);
Assert.False(testSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", testSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search
await testSearch.RemoveAsync();
try
{
await testSearch.GetAsync();
Assert.True(false);
}
catch (ResourceNotFoundException)
{ }
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
}
}
void CanConstructSavedSearchAttributes()
{
var attributes = new SavedSearchAttributes();
Assert.Equal("action.email.auth_password=null; " +
"action.email.auth_username=null; " +
"action.email.bcc=null; " +
"action.email.cc=null; " +
"action.email.command=null; " +
"action.email.format=null; " +
"action.email.from=null; " +
"action.email.inline=null; " +
"action.email.mailserver=null; " +
"action.email.maxresults=null; " +
"action.email.maxtime=null; " +
"action.email.reportCIDFontList=null; " +
"action.email.reportIncludeSplunkLogo=null; " +
"action.email.reportPaperOrientation=null; " +
"action.email.reportPaperSize=null; " +
"action.email.reportServerEnabled=null; " +
"action.email.sendpdf=null; " +
"action.email.sendresults=null; " +
"action.email.subject=null; " +
"action.email.to=null; " +
"action.email.track_alert=null; " +
"action.email.ttl=null; " +
"action.email.use_ssl=null; " +
"action.email.use_tls=null; " +
"action.email.width_sort_columns=null; " +
"action.populate_lookup.command=null; " +
"action.populate_lookup.dest=null; " +
"action.populate_lookup.hostname=null; " +
"action.populate_lookup.maxresults=null; " +
"action.populate_lookup.maxtime=null; " +
"action.populate_lookup.track_alert=null; " +
"action.populate_lookup.ttl=null; " +
"action.rss.command=null; " +
"action.rss.maxresults=null; " +
"action.rss.maxtime=null; " +
"action.rss.track_alert=null; " +
"action.rss.ttl=null; " +
"action.script.command=null; " +
"action.script.filename=null; " +
"action.script.hostname=null; " +
"action.script.maxresults=null; " +
"action.script.maxtime=null; " +
"action.script.track_alert=null; " +
"action.script.ttl=null; " +
"action.summary_index.command=null; " +
"action.summary_index.inline=null; " +
"action.summary_index.maxresults=null; " +
"action.summary_index.maxtime=null; " +
"action.summary_index.name=null; " +
"action.summary_index.track_alert=null; " +
"action.summary_index.ttl=null; " +
"actions=null; " +
"alert.digest_mode=null; " +
"alert.expires=null; " +
"alert.severity=null; " +
"alert.track=null; " +
"alert_comparator=null; " +
"alert_condition=null; " +
"alert_threshold=null; " +
"alert_type=null; " +
"auto_summarize=null; " +
"auto_summarize.command=null; " +
"auto_summarize.cron_schedule=null; " +
"auto_summarize.dispatch.earliest_time=null; " +
"auto_summarize.dispatch.latest_time=null; " +
"auto_summarize.dispatch.time_format=null; " +
"auto_summarize.dispatch.ttl=null; " +
"auto_summarize.max_disabled_buckets=null; " +
"auto_summarize.max_summary_ratio=null; " +
"auto_summarize.max_summary_size=null; " +
"auto_summarize.max_time=null; " +
"auto_summarize.suspend_period=null; " +
"cron_schedule=null; " +
"description=null; " +
"disabled=null; " +
"dispatch.buckets=null; " +
"dispatch.earliest_time=null; " +
"dispatch.latest_time=null; " +
"dispatch.lookups=null; " +
"dispatch.max_count=null; " +
"dispatch.max_time=null; " +
"dispatch.reduce_freq=null; " +
"dispatch.rt_backfill=null; " +
"dispatch.spawn_process=null; " +
"dispatch.time_format=null; " +
"is_scheduled=null; " +
"is_visible=null; " +
"max_concurrent=null; " +
"realtime_schedule=null; " +
"restart_on_searchpeer_add=null; " +
"run_on_startup=null",
attributes.ToString());
Assert.Equal(new List <Argument>(), attributes);
}
void CanSetEverySavedSearchAttribute()
{
var attributes = new SavedSearchAttributes()
{
ActionEmailAuthPassword = "******",
ActionEmailAuthUsername = "******",
ActionEmailBcc = "some-unchecked-string",
ActionEmailCC = "some-unchecked-string",
ActionEmailCommand = "some-unchecked-string",
ActionEmailFormat = EmailFormat.Html,
ActionEmailFrom = "some-unchecked-string",
ActionEmailInline = "some-unchecked-string",
ActionEmailMailServer = "some-unchecked-string",
ActionEmailMaxResults = 99,
ActionEmailMaxTime = "some-unchecked-string",
ActionEmailReportCidFontList = "some-unchecked-string",
ActionEmailReportIncludeSplunkLogo = true,
ActionEmailReportPaperOrientation = PaperOrientation.Landscape,
ActionEmailReportPaperSize = PaperSize.Ledger,
ActionEmailReportServerEnabled = true,
ActionEmailSendPdf = true,
ActionEmailSendResults = true,
ActionEmailSubject = "some-unchecked-string",
ActionEmailTo = "some-unchecked-string",
ActionEmailTrackAlert = true,
ActionEmailTtl = "some-unchecked-string",
ActionEmailUseSsl = true,
ActionEmailUseTls = true,
ActionEmailWidthSortColumns = true,
ActionPopulateLookupCommand = "some-unchecked-string",
ActionPopulateLookupDestination = "some-unchecked-string",
ActionPopulateLookupHostName = "some-unchecked-string",
ActionPopulateLookupMaxResults = 99,
ActionPopulateLookupMaxTime = "some-unchecked-string",
ActionPopulateLookupTrackAlert = true,
ActionPopulateLookupTtl = "some-unchecked-string",
ActionRssCommand = "some-unchecked-string",
ActionRssMaxResults = 99,
ActionRssMaxTime = "some-unchecked-string",
ActionRssTrackAlert = "some-unchecked-string",
ActionRssTtl = "some-unchecked-string",
Actions = "some-unchecked-string",
ActionScriptCommand = "some-unchecked-string",
ActionScriptFileName = "some-unchecked-string",
ActionScriptHostName = "some-unchecked-string",
ActionScriptMaxResults = 99,
ActionScriptMaxTime = "some-unchecked-string",
ActionScriptTrackAlert = true,
ActionScriptTtl = "some-unchecked-string",
ActionSummaryIndexCommand = "some-unchecked-string",
ActionSummaryIndexInline = true,
ActionSummaryIndexMaxResults = 99,
ActionSummaryIndexMaxTime = "some-unchecked-string",
ActionSummaryIndexName = "some-unchecked-string",
ActionSummaryIndexTrackAlert = true,
ActionSummaryIndexTtl = "some-unchecked-string",
AlertComparator = AlertComparator.GreaterThan,
AlertCondition = "some-unchecked-string",
AlertDigestMode = true,
AlertExpires = "some-unchecked-string",
AlertSeverity = AlertSeverity.Warning,
AlertThreshold = "some-unchecked-string",
AlertTrack = AlertTrack.Automatic,
AlertType = AlertType.Always,
AutoSummarize = true,
AutoSummarizeCommand = "some-unchecked-string",
AutoSummarizeCronSchedule = "some-unchecked-string",
AutoSummarizeDispatchEarliestTime = "some-unchecked-string",
AutoSummarizeDispatchLatestTime = "some-unchecked-string",
AutoSummarizeDispatchTimeFormat = "some-unchecked-string",
AutoSummarizeDispatchTtl = "some-unchecked-string",
AutoSummarizeMaxDisabledBuckets = 2,
AutoSummarizeMaxSummaryRatio = 0.1,
AutoSummarizeMaxSummarySize = 52428800L,
AutoSummarizeMaxTime = 3600,
AutoSummarizeSuspendPeriod = "some-unchecked-string",
CronSchedule = "some-unchecked-string",
Description = "some-unchecked-string",
Disabled = true,
DispatchBuckets = 99,
DispatchEarliestTime = "some-unchecked-string",
DispatchLatestTime = "some-unchecked-string",
DispatchLookups = true,
DispatchMaxCount = 99,
DispatchMaxTime = 99,
DispatchRealTimeBackfill = true,
DispatchReduceFrequency = 99,
DispatchSpawnProcess = true,
DispatchTimeFormat = "some-unchecked-string",
DispatchTtl = "some-unchecked-string",
IsScheduled = true,
IsVisible = true,
MaxConcurrent = 99,
RealTimeSchedule = "some-unchecked-string",
RestartOnSearchPeerAdd = "some-unchecked-string",
RunOnStartup = true,
};
Assert.Equal(
"action.email.auth_password=some-unchecked-string; " +
"action.email.auth_username=some-unchecked-string; " +
"action.email.bcc=some-unchecked-string; " +
"action.email.cc=some-unchecked-string; " +
"action.email.command=some-unchecked-string; " +
"action.email.format=html; " +
"action.email.from=some-unchecked-string; " +
"action.email.inline=some-unchecked-string; " +
"action.email.mailserver=some-unchecked-string; " +
"action.email.maxresults=99; " +
"action.email.maxtime=some-unchecked-string; " +
"action.email.reportCIDFontList=some-unchecked-string; " +
"action.email.reportIncludeSplunkLogo=1; " +
"action.email.reportPaperOrientation=landscape; " +
"action.email.reportPaperSize=ledger; " +
"action.email.reportServerEnabled=1; " +
"action.email.sendpdf=1; " +
"action.email.sendresults=1; " +
"action.email.subject=some-unchecked-string; " +
"action.email.to=some-unchecked-string; " +
"action.email.track_alert=1; " +
"action.email.ttl=some-unchecked-string; " +
"action.email.use_ssl=1; " +
"action.email.use_tls=1; " +
"action.email.width_sort_columns=1; " +
"action.populate_lookup.command=some-unchecked-string; " +
"action.populate_lookup.dest=some-unchecked-string; " +
"action.populate_lookup.hostname=some-unchecked-string; " +
"action.populate_lookup.maxresults=99; " +
"action.populate_lookup.maxtime=some-unchecked-string; " +
"action.populate_lookup.track_alert=1; " +
"action.populate_lookup.ttl=some-unchecked-string; " +
"action.rss.command=some-unchecked-string; " +
"action.rss.maxresults=99; " +
"action.rss.maxtime=some-unchecked-string; " +
"action.rss.track_alert=some-unchecked-string; " +
"action.rss.ttl=some-unchecked-string; " +
"action.script.command=some-unchecked-string; " +
"action.script.filename=some-unchecked-string; " +
"action.script.hostname=some-unchecked-string; " +
"action.script.maxresults=99; " +
"action.script.maxtime=some-unchecked-string; " +
"action.script.track_alert=1; " +
"action.script.ttl=some-unchecked-string; " +
"action.summary_index.command=some-unchecked-string; " +
"action.summary_index.inline=1; " +
"action.summary_index.maxresults=99; " +
"action.summary_index.maxtime=some-unchecked-string; " +
"action.summary_index.name=some-unchecked-string; " +
"action.summary_index.track_alert=1; " +
"action.summary_index.ttl=some-unchecked-string; " +
"actions=some-unchecked-string; " +
"alert.digest_mode=1; " +
"alert.expires=some-unchecked-string; " +
"alert.severity=3; " +
"alert.track=auto; " +
"alert_comparator=greater than; " +
"alert_condition=some-unchecked-string; " +
"alert_threshold=some-unchecked-string; " +
"alert_type=always; " +
"auto_summarize=1; " +
"auto_summarize.command=some-unchecked-string; " +
"auto_summarize.cron_schedule=some-unchecked-string; " +
"auto_summarize.dispatch.earliest_time=some-unchecked-string; " +
"auto_summarize.dispatch.latest_time=some-unchecked-string; " +
"auto_summarize.dispatch.time_format=some-unchecked-string; " +
"auto_summarize.dispatch.ttl=some-unchecked-string; " +
"auto_summarize.max_disabled_buckets=2; " +
"auto_summarize.max_summary_ratio=0.1; " +
"auto_summarize.max_summary_size=52428800; " +
"auto_summarize.max_time=3600; " +
"auto_summarize.suspend_period=some-unchecked-string; " +
"cron_schedule=some-unchecked-string; " +
"description=some-unchecked-string; " +
"disabled=1; " +
"dispatch.buckets=99; " +
"dispatch.earliest_time=some-unchecked-string; " +
"dispatch.latest_time=some-unchecked-string; " +
"dispatch.lookups=1; " +
"dispatch.max_count=99; " +
"dispatch.max_time=99; " +
"dispatch.reduce_freq=99; " +
"dispatch.rt_backfill=1; " +
"dispatch.spawn_process=1; " +
"dispatch.time_format=some-unchecked-string; " +
"is_scheduled=1; " +
"is_visible=1; " +
"max_concurrent=99; " +
"realtime_schedule=some-unchecked-string; " +
"restart_on_searchpeer_add=some-unchecked-string; " +
"run_on_startup=1",
attributes.ToString());
Assert.Equal(new List <Argument>
{
new Argument("action.email.auth_password", "some-unchecked-string"),
new Argument("action.email.auth_username", "some-unchecked-string"),
new Argument("action.email.bcc", "some-unchecked-string"),
new Argument("action.email.cc", "some-unchecked-string"),
new Argument("action.email.command", "some-unchecked-string"),
new Argument("action.email.format", "html"),
new Argument("action.email.from", "some-unchecked-string"),
new Argument("action.email.inline", "some-unchecked-string"),
new Argument("action.email.mailserver", "some-unchecked-string"),
new Argument("action.email.maxresults", "99"),
new Argument("action.email.maxtime", "some-unchecked-string"),
new Argument("action.email.reportCIDFontList", "some-unchecked-string"),
new Argument("action.email.reportIncludeSplunkLogo", 1),
new Argument("action.email.reportPaperOrientation", "landscape"),
new Argument("action.email.reportPaperSize", "ledger"),
new Argument("action.email.reportServerEnabled", 1),
new Argument("action.email.sendpdf", 1),
new Argument("action.email.sendresults", 1),
new Argument("action.email.subject", "some-unchecked-string"),
new Argument("action.email.to", "some-unchecked-string"),
new Argument("action.email.track_alert", 1),
new Argument("action.email.ttl", "some-unchecked-string"),
new Argument("action.email.use_ssl", 1),
new Argument("action.email.use_tls", 1),
new Argument("action.email.width_sort_columns", 1),
new Argument("action.populate_lookup.command", "some-unchecked-string"),
new Argument("action.populate_lookup.dest", "some-unchecked-string"),
new Argument("action.populate_lookup.hostname", "some-unchecked-string"),
new Argument("action.populate_lookup.maxresults", "99"),
new Argument("action.populate_lookup.maxtime", "some-unchecked-string"),
new Argument("action.populate_lookup.track_alert", 1),
new Argument("action.populate_lookup.ttl", "some-unchecked-string"),
new Argument("action.rss.command", "some-unchecked-string"),
new Argument("action.rss.maxresults", "99"),
new Argument("action.rss.maxtime", "some-unchecked-string"),
new Argument("action.rss.track_alert", "some-unchecked-string"),
new Argument("action.rss.ttl", "some-unchecked-string"),
new Argument("action.script.command", "some-unchecked-string"),
new Argument("action.script.filename", "some-unchecked-string"),
new Argument("action.script.hostname", "some-unchecked-string"),
new Argument("action.script.maxresults", "99"),
new Argument("action.script.maxtime", "some-unchecked-string"),
new Argument("action.script.track_alert", 1),
new Argument("action.script.ttl", "some-unchecked-string"),
new Argument("action.summary_index.command", "some-unchecked-string"),
new Argument("action.summary_index.inline", 1),
new Argument("action.summary_index.maxresults", "99"),
new Argument("action.summary_index.maxtime", "some-unchecked-string"),
new Argument("action.summary_index.name", "some-unchecked-string"),
new Argument("action.summary_index.track_alert", 1),
new Argument("action.summary_index.ttl", "some-unchecked-string"),
new Argument("actions", "some-unchecked-string"),
new Argument("alert.digest_mode", 1),
new Argument("alert.expires", "some-unchecked-string"),
new Argument("alert.severity", "3"),
new Argument("alert.track", "auto"),
new Argument("alert_comparator", "greater than"),
new Argument("alert_condition", "some-unchecked-string"),
new Argument("alert_threshold", "some-unchecked-string"),
new Argument("alert_type", "always"),
new Argument("auto_summarize", 1),
new Argument("auto_summarize.command", "some-unchecked-string"),
new Argument("auto_summarize.cron_schedule", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.earliest_time", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.latest_time", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.time_format", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.ttl", "some-unchecked-string"),
new Argument("auto_summarize.max_disabled_buckets", "2"),
new Argument("auto_summarize.max_summary_ratio", "0.1"),
new Argument("auto_summarize.max_summary_size", "52428800"),
new Argument("auto_summarize.max_time", "3600"),
new Argument("auto_summarize.suspend_period", "some-unchecked-string"),
new Argument("cron_schedule", "some-unchecked-string"),
new Argument("description", "some-unchecked-string"),
new Argument("disabled", 1),
new Argument("dispatch.buckets", "99"),
new Argument("dispatch.earliest_time", "some-unchecked-string"),
new Argument("dispatch.latest_time", "some-unchecked-string"),
new Argument("dispatch.lookups", 1),
new Argument("dispatch.max_count", "99"),
new Argument("dispatch.max_time", "99"),
new Argument("dispatch.reduce_freq", "99"),
new Argument("dispatch.rt_backfill", 1),
new Argument("dispatch.spawn_process", 1),
new Argument("dispatch.time_format", "some-unchecked-string"),
new Argument("is_scheduled", 1),
new Argument("is_visible", 1),
new Argument("max_concurrent", "99"),
new Argument("realtime_schedule", "some-unchecked-string"),
new Argument("restart_on_searchpeer_add", "some-unchecked-string"),
new Argument("run_on_startup", 1)
},
attributes);
}
public async Task SavedSearchesUpdateProperties()
{
using (var service = await SdkHelper.CreateService())
{
SavedSearchCollection savedSearches = service.SavedSearches;
const string name = "sdk-test_UpdateProperties";
const string search = "search index=sdk-tests * earliest=-1m";
//// Ensure test starts in a known good state
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
//// Create a saved search
testSearch = await savedSearches.CreateAsync(name, search);
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.NotNull(testSearch);
//// Read the saved search
await savedSearches.GetAllAsync();
testSearch = savedSearches.SingleOrDefault(a => a.Name == name);
Assert.True(testSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
bool updatedSnapshot = await testSearch.UpdateAsync(new SavedSearchAttributes()
{
IsVisible = false
});
Assert.True(updatedSnapshot);
Assert.False(testSearch.IsVisible);
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
// Create a saved search with some additional arguments
testSearch = await savedSearches.CreateAsync(name, search, new SavedSearchAttributes()
{
IsVisible = false
});
Assert.False(testSearch.IsVisible);
// Set email param attributes
var attributes = new SavedSearchAttributes()
{
ActionEmailAuthPassword = "******",
ActionEmailAuthUsername = "******",
ActionEmailBcc = "*****@*****.**",
ActionEmailCC = "*****@*****.**",
ActionEmailCommand = "$name1$",
ActionEmailFormat = EmailFormat.Plain,
ActionEmailFrom = "*****@*****.**",
//attrs.ActionEmailHostname = "dummy1.host.com",
ActionEmailInline = "true",
ActionEmailMailServer = "splunk.com",
ActionEmailMaxResults = 101,
ActionEmailMaxTime = "10s",
ActionEmailSendPdf = true, //??ActionEmailPdfView = "dummy",
ActionEmailSendResults = true, //??ActionEmailPreProcessResults = "*",
ActionEmailReportPaperOrientation = PaperOrientation.Landscape,
ActionEmailReportPaperSize = PaperSize.Letter,
ActionEmailReportServerEnabled = false,
//attrs.ActionEmailReportServerUrl = "splunk.com",
ActionEmailSubject = "sdk-subject",
ActionEmailTo = "*****@*****.**",
ActionEmailTrackAlert = false,
ActionEmailTtl = "61",
ActionEmailUseSsl = false,
ActionEmailUseTls = false,
ActionEmailWidthSortColumns = false,
ActionPopulateLookupCommand = "$name2$",
ActionPopulateLookupDestination = "dummypath",
ActionPopulateLookupHostName = "dummy2.host.com",
ActionPopulateLookupMaxResults = 102,
ActionPopulateLookupMaxTime = "20s",
ActionPopulateLookupTrackAlert = false,
ActionPopulateLookupTtl = "62",
ActionRssCommand = "$name3$",
//attrs.ActionRssHostname = "dummy3.host.com",
ActionRssMaxResults = 103,
ActionRssMaxTime = "30s",
ActionRssTrackAlert = "false",
ActionRssTtl = "63",
ActionScriptCommand = "$name4$",
ActionScriptFileName = "action_script_filename",
ActionScriptHostName = "dummy4.host.com",
ActionScriptMaxResults = 104,
ActionScriptMaxTime = "40s",
ActionScriptTrackAlert = false,
ActionScriptTtl = "64",
ActionSummaryIndexName = "default",
ActionSummaryIndexCommand = "$name5$",
//attrs.ActionSummaryIndexHostname = "dummy5.host.com",
ActionSummaryIndexInline = false,
ActionSummaryIndexMaxResults = 105,
ActionSummaryIndexMaxTime = "50s",
ActionSummaryIndexTrackAlert = false,
ActionSummaryIndexTtl = "65",
Actions = "rss,email,populate_lookup,script,summary_index"
};
await testSearch.UpdateAsync(attributes);
// check
Assert.True(testSearch.Actions.Email != null); //IsActionEmail));
Assert.True(testSearch.Actions.PopulateLookup != null);
Assert.True(testSearch.Actions.Rss != null);
Assert.True(testSearch.Actions.Script != null);
Assert.True(testSearch.Actions.SummaryIndex != null);
Assert.Equal("sdk-password", testSearch.Actions.Email.AuthPassword);
Assert.Equal("sdk-username", testSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.CC);
Assert.Equal("$name1$", testSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, testSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(testSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, testSearch.Actions.Email.MaxResults);
Assert.Equal("10s", testSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, testSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, testSearch.Actions.Email.ReportPaperSize);
Assert.False(testSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.True(testSearch.Actions.Email.SendPdf);
Assert.True(testSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", testSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.To);
Assert.False(testSearch.Actions.Email.TrackAlert);
Assert.Equal("61", testSearch.Actions.Email.Ttl);
Assert.False(testSearch.Actions.Email.UseSsl);
Assert.False(testSearch.Actions.Email.UseTls);
Assert.False(testSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", testSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", testSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", testSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, testSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", testSearch.Actions.PopulateLookup.MaxTime);
Assert.False(testSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", testSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", testSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, testSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", testSearch.Actions.Rss.MaxTime);
Assert.False(testSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", testSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", testSearch.Actions.Script.Command);
Assert.Equal("action_script_filename", testSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", testSearch.Actions.Script.Hostname);
Assert.Equal(104, testSearch.Actions.Script.MaxResults);
Assert.Equal("40s", testSearch.Actions.Script.MaxTime);
Assert.False(testSearch.Actions.Script.TrackAlert);
Assert.Equal("64", testSearch.Actions.Script.Ttl);
Assert.Equal("default", testSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", testSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(testSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, testSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", testSearch.Actions.SummaryIndex.MaxTime);
Assert.False(testSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", testSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search
await testSearch.RemoveAsync();
try
{
await testSearch.GetAsync();
Assert.True(false);
}
catch (ResourceNotFoundException)
{ }
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
}
}
void CanSetEveryValue()
{
var attributes = new SavedSearchAttributes()
{
ActionEmailBcc = "some-unchecked-string",
ActionEmailCC = "some-unchecked-string",
ActionEmailCommand = "some-unchecked-string",
ActionEmailFormat = EmailFormat.Html,
ActionEmailFrom = "some-unchecked-string",
ActionEmailInline = "some-unchecked-string",
ActionEmailMailServer = "some-unchecked-string",
ActionEmailMaxResults = 99,
ActionEmailMaxTime = "some-unchecked-string",
ActionEmailReportCidFontList = "some-unchecked-string",
ActionEmailReportIncludeSplunkLogo = true,
ActionEmailReportPaperOrientation = PaperOrientation.Landscape,
ActionEmailReportPaperSize = PaperSize.Ledger,
ActionEmailReportServerEnabled = true,
ActionEmailSendPdf = true,
ActionEmailSendResults = true,
ActionEmailSubject = "some-unchecked-string",
ActionEmailTo = "some-unchecked-string",
ActionEmailTrackAlert = true,
ActionEmailTtl = "some-unchecked-string",
ActionEmailUseSsl = true,
ActionEmailUseTls = true,
ActionEmailWidthSortColumns = true,
ActionPopulateLookupCommand = "some-unchecked-string",
ActionPopulateLookupDestination = "some-unchecked-string",
ActionPopulateLookupHostname = "some-unchecked-string",
ActionPopulateLookupMaxResults = 99,
ActionPopulateLookupMaxTime = "some-unchecked-string",
ActionPopulateLookupTrackAlert = true,
ActionPopulateLookupTtl = "some-unchecked-string",
ActionRssCommand = "some-unchecked-string",
ActionRssMaxResults = 99,
ActionRssMaxTime = "some-unchecked-string",
ActionRssTrackAlert = "some-unchecked-string",
ActionRssTtl = "some-unchecked-string",
Actions = "some-unchecked-string",
ActionScriptCommand = "some-unchecked-string",
ActionScriptFileName = "some-unchecked-string",
ActionScriptHostname = "some-unchecked-string",
ActionScriptMaxResults = 99,
ActionScriptMaxTime = "some-unchecked-string",
ActionScriptTrackAlert = true,
ActionScriptTtl = "some-unchecked-string",
ActionSummaryIndexCommand = "some-unchecked-string",
ActionSummaryIndexInline = true,
ActionSummaryIndexMaxResults = 99,
ActionSummaryIndexMaxTime = "some-unchecked-string",
ActionSummaryIndexName = "some-unchecked-string",
ActionSummaryIndexTrackAlert = true,
ActionSummaryIndexTtl = "some-unchecked-string",
AlertComparator = AlertComparator.GreaterThan,
AlertCondition = "some-unchecked-string",
AlertDigestMode = true,
AlertExpires = "some-unchecked-string",
AlertSeverity = AlertSeverity.Warning,
AlertThreshold = "some-unchecked-string",
AlertTrack = AlertTrack.Automatic,
AlertType = AlertType.Always,
AutoSummarize = true,
AutoSummarizeCommand = "some-unchecked-string",
AutoSummarizeCronSchedule = "some-unchecked-string",
AutoSummarizeDispatchTimeFormat = "some-unchecked-string",
AutoSummarizeDispatchTtl = "some-unchecked-string",
AutoSummarizeMaxDisabledBuckets = "some-unchecked-string",
AutoSummarizeMaxSummaryRatio = "some-unchecked-string",
AutoSummarizeMaxSummarySize = "some-unchecked-string",
AutoSummarizeMaxTime = "some-unchecked-string",
AutoSummarizeSuspendPeriod = "some-unchecked-string",
CronSchedule = "some-unchecked-string",
Description = "some-unchecked-string",
Disabled = true,
DispatchBuckets = 99,
DispatchEarliestTime = "some-unchecked-string",
DispatchLatestTime = "some-unchecked-string",
DispatchLookups = true,
DispatchMaxCount = 99,
DispatchMaxTime = 99,
DispatchRealTimeBackfill = true,
DispatchReduceFrequency = 99,
DispatchSpawnProcess = true,
DispatchTimeFormat = "some-unchecked-string",
DispatchTtl = "some-unchecked-string",
IsScheduled = true,
IsVisible = true,
MaxConcurrent = 99,
RealtimeSchedule = "some-unchecked-string",
RestartOnSearchPeerAdd = "some-unchecked-string",
RunOnStartup = true,
Search = "some-unchecked-string",
};
Assert.Equal(
"action.email.bcc=some-unchecked-string; " +
"action.email.cc=some-unchecked-string; " +
"action.email.command=some-unchecked-string; " +
"action.email.format=Html; " +
"action.email.from=some-unchecked-string; " +
"action.email.inline=some-unchecked-string; " +
"action.email.mailserver=some-unchecked-string; " +
"action.email.maxresults=99; " +
"action.email.maxtime=some-unchecked-string; " +
"action.email.reportCIDFontList=some-unchecked-string; " +
"action.email.reportIncludeSplunkLogo=t; " +
"action.email.reportPaperOrientation=Landscape; " +
"action.email.reportPaperSize=Ledger; " +
"action.email.reportServerEnabled=t; " +
"action.email.sendpdf=t; " +
"action.email.sendresults=t; " +
"action.email.subject=some-unchecked-string; " +
"action.email.to=some-unchecked-string; " +
"action.email.track_alert=t; " +
"action.email.ttl=some-unchecked-string; " +
"action.email.use_ssl=t; " +
"action.email.use_tls=t; " +
"action.email.width_sort_columns=t; " +
"action.populate_lookup.command=some-unchecked-string; " +
"action.populate_lookup.dest=some-unchecked-string; " +
"action.populate_lookup.hostname=some-unchecked-string; " +
"action.populate_lookup.maxresults=99; " +
"action.populate_lookup.maxtime=some-unchecked-string; " +
"action.populate_lookup.track_alert=t; " +
"action.populate_lookup.ttl=some-unchecked-string; " +
"action.rss.command=some-unchecked-string; " +
"action.rss.maxresults=99; " +
"action.rss.maxtime=some-unchecked-string; " +
"action.rss.track_alert=some-unchecked-string; " +
"action.rss.ttl=some-unchecked-string; " +
"action.script.command=some-unchecked-string; " +
"action.script.filename=some-unchecked-string; " +
"action.script.hostname=some-unchecked-string; " +
"action.script.maxresults=99; " +
"action.script.maxtime=some-unchecked-string; " +
"action.script.track_alert=t; " +
"action.script.ttl=some-unchecked-string; " +
"action.summary_index.command=some-unchecked-string; " +
"action.summary_index.inline=t; " +
"action.summary_index.maxresults=99; " +
"action.summary_index.maxtime=some-unchecked-string; " +
"action.summary_index.name=some-unchecked-string; " +
"action.summary_index.track_alert=t; " +
"action.summary_index.ttl=some-unchecked-string; " +
"actions=some-unchecked-string; " +
"alert.digest_mode=t; " +
"alert.expires=some-unchecked-string; " +
"alert.severity=Warning; " +
"alert.track=Automatic; " +
"alert_comparator=GreaterThan; " +
"alert_condition=some-unchecked-string; " +
"alert_threshold=some-unchecked-string; " +
"alert_type=Always; " +
"auto_summarize=t; " +
"auto_summarize.command=some-unchecked-string; " +
"auto_summarize.cron_schedule=some-unchecked-string; " +
"auto_summarize.dispatch.time_format=some-unchecked-string; " +
"auto_summarize.dispatch.ttl=some-unchecked-string; " +
"auto_summarize.max_disabled_buckets=some-unchecked-string; " +
"auto_summarize.max_summary_ratio=some-unchecked-string; " +
"auto_summarize.max_summary_size=some-unchecked-string; " +
"auto_summarize.max_time=some-unchecked-string; " +
"auto_summarize.suspend_period=some-unchecked-string; " +
"cron_schedule=some-unchecked-string; " +
"description=some-unchecked-string; " +
"disabled=t; " +
"dispatch.buckets=99; " +
"dispatch.earliest_time=some-unchecked-string; " +
"dispatch.latest_time=some-unchecked-string; " +
"dispatch.lookups=t; " +
"dispatch.max_count=99; " +
"dispatch.max_time=99; " +
"dispatch.reduce_freq=99; " +
"dispatch.rt_backfill=t; " +
"dispatch.spawn_process=t; " +
"dispatch.time_format=some-unchecked-string; " +
"is_scheduled=t; " +
"is_visible=t; " +
"max_concurrent=99; " +
"realtime_schedule=some-unchecked-string; " +
"restart_on_searchpeer_add=some-unchecked-string; " +
"run_on_startup=t; " +
"search=some-unchecked-string",
attributes.ToString());
Assert.Equal(new List<Argument>
{
new Argument("action.email.bcc", "some-unchecked-string"),
new Argument("action.email.cc", "some-unchecked-string"),
new Argument("action.email.command", "some-unchecked-string"),
new Argument("action.email.format", "Html"),
new Argument("action.email.from", "some-unchecked-string"),
new Argument("action.email.inline", "some-unchecked-string"),
new Argument("action.email.mailserver", "some-unchecked-string"),
new Argument("action.email.maxresults", "99"),
new Argument("action.email.maxtime", "some-unchecked-string"),
new Argument("action.email.reportCIDFontList", "some-unchecked-string"),
new Argument("action.email.reportIncludeSplunkLogo", "t"),
new Argument("action.email.reportPaperOrientation", "Landscape"),
new Argument("action.email.reportPaperSize", "Ledger"),
new Argument("action.email.reportServerEnabled", "t"),
new Argument("action.email.sendpdf", "t"),
new Argument("action.email.sendresults", "t"),
new Argument("action.email.subject", "some-unchecked-string"),
new Argument("action.email.to", "some-unchecked-string"),
new Argument("action.email.track_alert", "t"),
new Argument("action.email.ttl", "some-unchecked-string"),
new Argument("action.email.use_ssl", "t"),
new Argument("action.email.use_tls", "t"),
new Argument("action.email.width_sort_columns", "t"),
new Argument("action.populate_lookup.command", "some-unchecked-string"),
new Argument("action.populate_lookup.dest", "some-unchecked-string"),
new Argument("action.populate_lookup.hostname", "some-unchecked-string"),
new Argument("action.populate_lookup.maxresults", "99"),
new Argument("action.populate_lookup.maxtime", "some-unchecked-string"),
new Argument("action.populate_lookup.track_alert", "t"),
new Argument("action.populate_lookup.ttl", "some-unchecked-string"),
new Argument("action.rss.command", "some-unchecked-string"),
new Argument("action.rss.maxresults", "99"),
new Argument("action.rss.maxtime", "some-unchecked-string"),
new Argument("action.rss.track_alert", "some-unchecked-string"),
new Argument("action.rss.ttl", "some-unchecked-string"),
new Argument("action.script.command", "some-unchecked-string"),
new Argument("action.script.filename", "some-unchecked-string"),
new Argument("action.script.hostname", "some-unchecked-string"),
new Argument("action.script.maxresults", "99"),
new Argument("action.script.maxtime", "some-unchecked-string"),
new Argument("action.script.track_alert", "t"),
new Argument("action.script.ttl", "some-unchecked-string"),
new Argument("action.summary_index.command", "some-unchecked-string"),
new Argument("action.summary_index.inline", "t"),
new Argument("action.summary_index.maxresults", "99"),
new Argument("action.summary_index.maxtime", "some-unchecked-string"),
new Argument("action.summary_index.name", "some-unchecked-string"),
new Argument("action.summary_index.track_alert", "t"),
new Argument("action.summary_index.ttl", "some-unchecked-string"),
new Argument("actions", "some-unchecked-string"),
new Argument("alert.digest_mode", "t"),
new Argument("alert.expires", "some-unchecked-string"),
new Argument("alert.severity", "Warning"),
new Argument("alert.track", "Automatic"),
new Argument("alert_comparator", "GreaterThan"),
new Argument("alert_condition", "some-unchecked-string"),
new Argument("alert_threshold", "some-unchecked-string"),
new Argument("alert_type", "Always"),
new Argument("auto_summarize", "t"),
new Argument("auto_summarize.command", "some-unchecked-string"),
new Argument("auto_summarize.cron_schedule", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.time_format", "some-unchecked-string"),
new Argument("auto_summarize.dispatch.ttl", "some-unchecked-string"),
new Argument("auto_summarize.max_disabled_buckets", "some-unchecked-string"),
new Argument("auto_summarize.max_summary_ratio", "some-unchecked-string"),
new Argument("auto_summarize.max_summary_size", "some-unchecked-string"),
new Argument("auto_summarize.max_time", "some-unchecked-string"),
new Argument("auto_summarize.suspend_period", "some-unchecked-string"),
new Argument("cron_schedule", "some-unchecked-string"),
new Argument("description", "some-unchecked-string"),
new Argument("disabled", "t"),
new Argument("dispatch.buckets", "99"),
new Argument("dispatch.earliest_time", "some-unchecked-string"),
new Argument("dispatch.latest_time", "some-unchecked-string"),
new Argument("dispatch.lookups", "t"),
new Argument("dispatch.max_count", "99"),
new Argument("dispatch.max_time", "99"),
new Argument("dispatch.reduce_freq", "99"),
new Argument("dispatch.rt_backfill", "t"),
new Argument("dispatch.spawn_process", "t"),
new Argument("dispatch.time_format", "some-unchecked-string"),
new Argument("is_scheduled", "t"),
new Argument("is_visible", "t"),
new Argument("max_concurrent", "99"),
new Argument("realtime_schedule", "some-unchecked-string"),
new Argument("restart_on_searchpeer_add", "some-unchecked-string"),
new Argument("run_on_startup", "t"),
new Argument("search", "some-unchecked-string")
},
attributes);
}
public Task<bool> UpdateAsync(string search = null, SavedSearchAttributes attributes = null,
SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null)
{
Contract.Requires<ArgumentException>(!(search == null && attributes == null && dispatchArgs == null && templateArgs == null));
return default(Task<bool>);
}
public void SavedSearchesCRUD()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
SavedSearch savedSearch;
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
//savedSearches.Create("sdk-test1", search);
SavedSearchAttributes attrs = new SavedSearchAttributes() { Search = search };
service.CreateSavedSearchAsync(savedSearchTitle, attrs).Wait();
savedSearches.GetAsync().Wait();
Assert.True(savedSearches.Any(a => a.Name == savedSearchTitle));
// Read the saved search
//savedSearch = savedSearches.Get("sdk-test1");
savedSearch = savedSearches.Where(a => a.Name == savedSearchTitle).SingleOrDefault();
Assert.True(savedSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
savedSearch.UpdateAsync(new SavedSearchAttributes() { IsVisible = false }, null, null).Wait();
//savedSearch.Refresh();
Assert.False(savedSearch.IsVisible);
// Delete the saved search
//savedSearches.("sdk-test1");
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search with some additional arguments
//savedSearch = savedSearches.Create("sdk-test1", search, new Args("is_visible", false));
savedSearch =
service.CreateSavedSearchAsync(
savedSearchTitle,
new SavedSearchAttributes() { Search = search, IsVisible = false }).Result;
Assert.False(savedSearch.IsVisible);
// set email params
attrs = new SavedSearchAttributes();
//attrs.ActionEmailAuthPassword = "******";
//attrs.ActionEmailAuthUsername = "******";
attrs.ActionEmailBcc = "*****@*****.**";
attrs.ActionEmailCC = "*****@*****.**";
attrs.ActionEmailCommand = "$name1$";
attrs.ActionEmailFormat = EmailFormat.Plain;
attrs.ActionEmailFrom = "*****@*****.**";
//attrs.ActionEmailHostname = "dummy1.host.com";
attrs.ActionEmailInline = "true";
attrs.ActionEmailMailServer = "splunk.com";
attrs.ActionEmailMaxResults = 101;
attrs.ActionEmailMaxTime = "10s";
attrs.ActionEmailSendPdf = true; //??ActionEmailPdfView = "dummy";
attrs.ActionEmailSendResults = true; //??ActionEmailPreProcessResults = "*";
attrs.ActionEmailReportPaperOrientation = PaperOrientation.Landscape;
attrs.ActionEmailReportPaperSize = PaperSize.Letter;
attrs.ActionEmailReportServerEnabled = false;
//attrs.ActionEmailReportServerUrl = "splunk.com";
attrs.ActionEmailSendPdf = false;
attrs.ActionEmailSendResults = false;
attrs.ActionEmailSubject = "sdk-subject";
attrs.ActionEmailTo = "*****@*****.**";
attrs.ActionEmailTrackAlert = false;
attrs.ActionEmailTtl = "61";
attrs.ActionEmailUseSsl = false;
attrs.ActionEmailUseTls = false;
attrs.ActionEmailWidthSortColumns = false;
attrs.ActionPopulateLookupCommand = "$name2$";
attrs.ActionPopulateLookupDestination = "dummypath";
attrs.ActionPopulateLookupHostname = "dummy2.host.com";
attrs.ActionPopulateLookupMaxResults = 102;
attrs.ActionPopulateLookupMaxTime = "20s";
attrs.ActionPopulateLookupTrackAlert = false;
attrs.ActionPopulateLookupTtl = "62";
attrs.ActionRssCommand = "$name3$";
//attrs.ActionRssHostname = "dummy3.host.com";
attrs.ActionRssMaxResults = 103;
attrs.ActionRssMaxTime = "30s";
attrs.ActionRssTrackAlert = "false";
attrs.ActionRssTtl = "63";
attrs.ActionScriptCommand = "$name4$";
const string ActionScriptFilename = "action_script_filename";
attrs.ActionScriptFileName = ActionScriptFilename;
attrs.ActionScriptHostname = "dummy4.host.com";
attrs.ActionScriptMaxResults = 104;
attrs.ActionScriptMaxTime = "40s";
attrs.ActionScriptTrackAlert = false;
attrs.ActionScriptTtl = "64";
attrs.ActionSummaryIndexName = "default";
attrs.ActionSummaryIndexCommand = "$name5$";
//attrs.ActionSummaryIndexHostname = "dummy5.host.com";
attrs.ActionSummaryIndexInline = false;
attrs.ActionSummaryIndexMaxResults = 105;
attrs.ActionSummaryIndexMaxTime = "50s";
attrs.ActionSummaryIndexTrackAlert = false;
attrs.ActionSummaryIndexTtl = "65";
attrs.Actions = "rss,email,populate_lookup,script,summary_index";
attrs.Search = search;
savedSearch.UpdateAsync(attrs, null, null).Wait();
// check
Assert.True(savedSearch.Actions.Email != null); //IsActionEmail));
Assert.True(savedSearch.Actions.PopulateLookup != null);
Assert.True(savedSearch.Actions.Rss != null);
Assert.True(savedSearch.Actions.Script != null);
Assert.True(savedSearch.Actions.SummaryIndex != null);
//Assert.Equal("sdk-password", savedSearch.Actions.Email.AuthPassword);
//Assert.Equal("sdk-username", savedSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.CC);
Assert.Equal("$name1$", savedSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, savedSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(savedSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, savedSearch.Actions.Email.MaxResults);
Assert.Equal("10s", savedSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, savedSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, savedSearch.Actions.Email.ReportPaperSize);
Assert.False(savedSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.False(savedSearch.Actions.Email.SendPdf);
Assert.False(savedSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", savedSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.To);
Assert.False(savedSearch.Actions.Email.TrackAlert);
Assert.Equal("61", savedSearch.Actions.Email.Ttl);
Assert.False(savedSearch.Actions.Email.UseSsl);
Assert.False(savedSearch.Actions.Email.UseTls);
Assert.False(savedSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", savedSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", savedSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", savedSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, savedSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", savedSearch.Actions.PopulateLookup.MaxTime);
Assert.False(savedSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", savedSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", savedSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, savedSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", savedSearch.Actions.Rss.MaxTime);
Assert.False(savedSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", savedSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", savedSearch.Actions.Script.Command);
Assert.Equal(ActionScriptFilename, savedSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", savedSearch.Actions.Script.Hostname);
Assert.Equal(104, savedSearch.Actions.Script.MaxResults);
Assert.Equal("40s", savedSearch.Actions.Script.MaxTime);
Assert.False(savedSearch.Actions.Script.TrackAlert);
Assert.Equal("64", savedSearch.Actions.Script.Ttl);
Assert.Equal("default", savedSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", savedSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(savedSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, savedSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", savedSearch.Actions.SummaryIndex.MaxTime);
Assert.False(savedSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", savedSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search - using alternative method
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
public void SavedSearchesCRUD()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
SavedSearch savedSearch;
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
//savedSearches.Create("sdk-test1", search);
SavedSearchAttributes attrs = new SavedSearchAttributes()
{
Search = search
};
service.CreateSavedSearchAsync(savedSearchTitle, attrs).Wait();
savedSearches.GetAsync().Wait();
Assert.True(savedSearches.Any(a => a.Name == savedSearchTitle));
// Read the saved search
//savedSearch = savedSearches.Get("sdk-test1");
savedSearch = savedSearches.Where(a => a.Name == savedSearchTitle).SingleOrDefault();
Assert.True(savedSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
savedSearch.UpdateAsync(new SavedSearchAttributes()
{
IsVisible = false
}, null, null).Wait();
//savedSearch.Refresh();
Assert.False(savedSearch.IsVisible);
// Delete the saved search
//savedSearches.("sdk-test1");
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search with some additional arguments
//savedSearch = savedSearches.Create("sdk-test1", search, new Args("is_visible", false));
savedSearch =
service.CreateSavedSearchAsync(
savedSearchTitle,
new SavedSearchAttributes()
{
Search = search, IsVisible = false
}).Result;
Assert.False(savedSearch.IsVisible);
// set email params
attrs = new SavedSearchAttributes();
//attrs.ActionEmailAuthPassword = "******";
//attrs.ActionEmailAuthUsername = "******";
attrs.ActionEmailBcc = "*****@*****.**";
attrs.ActionEmailCC = "*****@*****.**";
attrs.ActionEmailCommand = "$name1$";
attrs.ActionEmailFormat = EmailFormat.Plain;
attrs.ActionEmailFrom = "*****@*****.**";
//attrs.ActionEmailHostname = "dummy1.host.com";
attrs.ActionEmailInline = "true";
attrs.ActionEmailMailServer = "splunk.com";
attrs.ActionEmailMaxResults = 101;
attrs.ActionEmailMaxTime = "10s";
attrs.ActionEmailSendPdf = true; //??ActionEmailPdfView = "dummy";
attrs.ActionEmailSendResults = true; //??ActionEmailPreProcessResults = "*";
attrs.ActionEmailReportPaperOrientation = PaperOrientation.Landscape;
attrs.ActionEmailReportPaperSize = PaperSize.Letter;
attrs.ActionEmailReportServerEnabled = false;
//attrs.ActionEmailReportServerUrl = "splunk.com";
attrs.ActionEmailSendPdf = false;
attrs.ActionEmailSendResults = false;
attrs.ActionEmailSubject = "sdk-subject";
attrs.ActionEmailTo = "*****@*****.**";
attrs.ActionEmailTrackAlert = false;
attrs.ActionEmailTtl = "61";
attrs.ActionEmailUseSsl = false;
attrs.ActionEmailUseTls = false;
attrs.ActionEmailWidthSortColumns = false;
attrs.ActionPopulateLookupCommand = "$name2$";
attrs.ActionPopulateLookupDestination = "dummypath";
attrs.ActionPopulateLookupHostname = "dummy2.host.com";
attrs.ActionPopulateLookupMaxResults = 102;
attrs.ActionPopulateLookupMaxTime = "20s";
attrs.ActionPopulateLookupTrackAlert = false;
attrs.ActionPopulateLookupTtl = "62";
attrs.ActionRssCommand = "$name3$";
//attrs.ActionRssHostname = "dummy3.host.com";
attrs.ActionRssMaxResults = 103;
attrs.ActionRssMaxTime = "30s";
attrs.ActionRssTrackAlert = "false";
attrs.ActionRssTtl = "63";
attrs.ActionScriptCommand = "$name4$";
const string ActionScriptFilename = "action_script_filename";
attrs.ActionScriptFileName = ActionScriptFilename;
attrs.ActionScriptHostname = "dummy4.host.com";
attrs.ActionScriptMaxResults = 104;
attrs.ActionScriptMaxTime = "40s";
attrs.ActionScriptTrackAlert = false;
attrs.ActionScriptTtl = "64";
attrs.ActionSummaryIndexName = "default";
attrs.ActionSummaryIndexCommand = "$name5$";
//attrs.ActionSummaryIndexHostname = "dummy5.host.com";
attrs.ActionSummaryIndexInline = false;
attrs.ActionSummaryIndexMaxResults = 105;
attrs.ActionSummaryIndexMaxTime = "50s";
attrs.ActionSummaryIndexTrackAlert = false;
attrs.ActionSummaryIndexTtl = "65";
attrs.Actions = "rss,email,populate_lookup,script,summary_index";
attrs.Search = search;
savedSearch.UpdateAsync(attrs, null, null).Wait();
// check
Assert.True(savedSearch.Actions.Email != null); //IsActionEmail));
Assert.True(savedSearch.Actions.PopulateLookup != null);
Assert.True(savedSearch.Actions.Rss != null);
Assert.True(savedSearch.Actions.Script != null);
Assert.True(savedSearch.Actions.SummaryIndex != null);
//Assert.Equal("sdk-password", savedSearch.Actions.Email.AuthPassword);
//Assert.Equal("sdk-username", savedSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.CC);
Assert.Equal("$name1$", savedSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, savedSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(savedSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, savedSearch.Actions.Email.MaxResults);
Assert.Equal("10s", savedSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, savedSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, savedSearch.Actions.Email.ReportPaperSize);
Assert.False(savedSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.False(savedSearch.Actions.Email.SendPdf);
Assert.False(savedSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", savedSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.To);
Assert.False(savedSearch.Actions.Email.TrackAlert);
Assert.Equal("61", savedSearch.Actions.Email.Ttl);
Assert.False(savedSearch.Actions.Email.UseSsl);
Assert.False(savedSearch.Actions.Email.UseTls);
Assert.False(savedSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", savedSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", savedSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", savedSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, savedSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", savedSearch.Actions.PopulateLookup.MaxTime);
Assert.False(savedSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", savedSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", savedSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, savedSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", savedSearch.Actions.Rss.MaxTime);
Assert.False(savedSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", savedSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", savedSearch.Actions.Script.Command);
Assert.Equal(ActionScriptFilename, savedSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", savedSearch.Actions.Script.Hostname);
Assert.Equal(104, savedSearch.Actions.Script.MaxResults);
Assert.Equal("40s", savedSearch.Actions.Script.MaxTime);
Assert.False(savedSearch.Actions.Script.TrackAlert);
Assert.Equal("64", savedSearch.Actions.Script.Ttl);
Assert.Equal("default", savedSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", savedSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(savedSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, savedSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", savedSearch.Actions.SummaryIndex.MaxTime);
Assert.False(savedSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", savedSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search - using alternative method
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
