public void TestCreateAndRemoveSavedSearchInNamespace()
{
Service service = Connect();
String username1 = "sdk-user1";
String username2 = "sdk-user2";
String appname1 = "sdk-app1";
String appname2 = "sdk-app2";
// Set up the application and users
SetupApps(service.GetApplications(), appname1, appname2);
SetupUsers(service.GetUsers(), username1, username2);
// Namespaces
Args splunkNamespace11 = CreateNamespace(username1, appname1);
Args splunkNamespace22 = CreateNamespace(username2, appname2);
Args splunkNamespacex1 = CreateNamespace("-", appname1);
// Create namespace specific searches
SavedSearchCollection savedSearches11 = service.GetSavedSearches(splunkNamespace11);
SavedSearchCollection savedSearches22 = service.GetSavedSearches(splunkNamespace22);
SavedSearchCollection savedSearchesx1 = service.GetSavedSearches(splunkNamespacex1);
// Remove test search "sdk-test-search" if it already exists
if (savedSearches11.ContainsKey("sdk-test-search"))
{
savedSearches11.Remove("sdk-test-search");
}
if (savedSearches22.ContainsKey("sdk-test-search"))
{
savedSearches22.Remove("sdk-test-search");
}
Assert.IsFalse(savedSearches11.ContainsKey("sdk-test-search"),
"SavedSearches11 already contains sdk-test-search, remove");
Assert.IsFalse(savedSearches22.ContainsKey("sdk-test-search"),
"SavedSearches22 already contains sdk-test-search, remove");
// Create test search
savedSearches11.Create("sdk-test-search", "search * | head 1");
savedSearches22.Create("sdk-test-search", "search * | head 2");
Assert.IsTrue(savedSearches11.ContainsKey("sdk-test-search"),
"Expected savedSearches11 to contain the key sdk-test-search");
Assert.IsTrue(savedSearches22.ContainsKey("sdk-test-search"),
"Expected savedSearches22 to contain the key sdk-test-search");
Assert.IsTrue(savedSearchesx1.ContainsKey("sdk-test-search", splunkNamespace11),
"Expected savedSearchesx1 to contain sdk-test-search in the namespace splunkNamespace11");
Assert.IsTrue(savedSearchesx1.Get("sdk-test-search", splunkNamespace11) != null,
"Expected savedSearchesx1 to have the test sdk-test-search for splunkNameSpace11");
// Remove a saved search through a specific namespace path
savedSearchesx1.Remove("sdk-test-search", splunkNamespace11);
Assert.IsFalse(savedSearchesx1.ContainsKey("sdk-test-search"),
"Expected the saved search sdk-test-search to be removed");
// Clean up applications and users
CleanupApps(service.GetApplications(), appname1, appname2);
CleanupUsers(service.GetUsers(), username1, username2);
}
public void SavedSearchHistory()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#69");
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
SavedSearch savedSearch = savedSearches.Create("sdk test1", search);
// Clear the history - even though we have a newly create saved search
// its possible there was a previous saved search with the same name
// that had a matching history.
Job[] history = savedSearch.History();
foreach (Job job in history)
{
job.Cancel();
}
history = savedSearch.History();
Assert.AreEqual(0, history.Length, this.assertRoot + "#70");
Job job1 = savedSearch.Dispatch();
this.Ready(job1);
history = savedSearch.History();
Assert.AreEqual(1, history.Length, this.assertRoot + "#71");
Assert.IsTrue(this.Contains(history, job1.Sid));
Job job2 = savedSearch.Dispatch();
this.Ready(job2);
history = savedSearch.History();
Assert.AreEqual(2, history.Length, this.assertRoot + "#72");
Assert.IsTrue(this.Contains(history, job1.Sid), this.assertRoot + "#73");
Assert.IsTrue(this.Contains(history, job2.Sid), this.assertRoot + "#74");
job1.Cancel();
history = savedSearch.History();
Assert.AreEqual(1, history.Length, this.assertRoot + "#75");
Assert.IsTrue(this.Contains(history, job2.Sid), this.assertRoot + "#76");
job2.Cancel();
history = savedSearch.History();
Assert.AreEqual(0, history.Length, this.assertRoot + "#77");
// Delete the saved search
savedSearches.Remove("sdk test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk test1"), this.assertRoot + "#78");
}
public void TestLiveNameSpace()
{
Service service = Connect();
String search = "search *";
// Establish naming convention for separate namespaces
String searchName = "sdk-test-search";
String username = "******";
String appname = "sdk-app";
Args splunkNameSpace1 = new Args();
Args splunkNameSpace2 = new Args();
splunkNameSpace1.Add("owner", username);
splunkNameSpace1.Add("app", appname);
splunkNameSpace2.Add("owner", "-");
splunkNameSpace2.Add("app", appname);
// Scrub to ensure apps doesn't already exist and then creates a new app with give appname
this.CreateApp(appname);
// Scrub to ensure users doesn't already exist
UserCollection users = service.GetUsers();
if (users.ContainsKey(username))
{
users.Remove(username);
}
Assert.IsFalse(users.ContainsKey(username), "Expected users to not contain the username: "******"abc", "user");
// Create namespace specific UNIQUE searches
SavedSearchCollection savedSearches1 = service.GetSavedSearches(splunkNameSpace1);
SavedSearchCollection savedSearches2 = service.GetSavedSearches(splunkNameSpace2);
// FIXME: figure out why create doesn't work.
//apps.Create("sdk-user", splunkNameSpace);
}
public void TestLiveNamespace1()
{
Service service = Connect();
String username = "******";
String password = "******";
String savedSearch = "sdk-test1";
String searchString = "search index=main * | 10";
// Setup a namespace
Args splunkNameSpace = new Args();
splunkNameSpace.Add("owner", username);
splunkNameSpace.Add("app", "search");
// Get all users, scrub and make our test user
UserCollection users = service.GetUsers();
if (users.ContainsKey(username))
{
users.Remove(username);
}
Assert.IsFalse(users.ContainsKey(username), "Expected users to not contain: " + username);
users.Create(username, password, "user");
Assert.IsTrue(users.ContainsKey(username), "Expected users to contain: " + username);
// Get saved searches for our new namespace, scrub and make our test saved searches
SavedSearchCollection savedSearches = service.GetSavedSearches(splunkNameSpace);
if (savedSearches.ContainsKey(savedSearch))
{
savedSearches.Remove(savedSearch);
}
Assert.IsFalse(savedSearches.ContainsKey(savedSearch), "Expected the saved search to not contain " + savedSearch);
}
/// <summary>
/// Asynchronously retrieves a collection of saved searches.
/// </summary>
/// <param name="args">
/// Arguments identifying the collection of <see cref="SavedSearch"/>
/// entries to retrieve.
/// </param>
/// <returns>
/// A new <see cref="SavedSearchCollection"/> containing the <see cref=
/// "SavedSearch"/> entries identified by <see cref="args"/>.
/// </returns>
/// <remarks>
/// This method uses the <a href="http://goo.gl/bKrRK0">GET
/// saved/searches</a> endpoint to retrieve a new <see cref=
/// "SavedSearchCollection"/> containing the <see cref="SavedSearch"/>
/// entries identified by <see cref="args"/>.
/// </remarks>
public async Task<SavedSearchCollection> GetSavedSearchesAsync(SavedSearchCollectionArgs args = null)
{
var resource = new SavedSearchCollection(this.Context, this.Namespace, args);
await resource.GetAsync();
return resource;
}
public async Task SavedSearchHistory()
{
using (var service = await SdkHelper.CreateService())
{
const string name = "sdk-test_SavedSearchHistory";
const string search = "search index=sdk-tests * earliest=-1m";
SavedSearchCollection savedSearches = service.SavedSearches;
await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
Count = 0, SortDirection = SortDirection.Descending
});
SavedSearch savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);
if (savedSearch != null)
{
await savedSearch.RemoveAsync();
}
// Create a saved search
savedSearch = await savedSearches.CreateAsync(name, search);
// Clear the history - even though we have a newly create saved search
// it's possible there was a previous saved search with the same name
// that had a matching history.
JobCollection history = await savedSearch.GetHistoryAsync();
foreach (Job job in history)
{
await job.CancelAsync();
}
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
Job job1 = await savedSearch.DispatchAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));
Job job2 = await savedSearch.DispatchAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(2, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid));
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job1.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job2.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
//// Delete the saved search
await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
Count = 0, SortDirection = SortDirection.Descending
});
savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);
Assert.NotNull(savedSearch);
await savedSearch.RemoveAsync();
savedSearch = await savedSearches.GetOrNullAsync(savedSearch.Name);
Assert.Null(savedSearch);
}
}
public async Task SavedSearchesUpdateProperties()
{
using (var service = await SdkHelper.CreateService())
{
SavedSearchCollection savedSearches = service.SavedSearches;
const string name = "sdk-test_UpdateProperties";
const string search = "search index=sdk-tests * earliest=-1m";
//// Ensure test starts in a known good state
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
//// Create a saved search
testSearch = await savedSearches.CreateAsync(name, search);
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.NotNull(testSearch);
//// Read the saved search
await savedSearches.GetAllAsync();
testSearch = savedSearches.SingleOrDefault(a => a.Name == name);
Assert.True(testSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
bool updatedSnapshot = await testSearch.UpdateAsync(new SavedSearchAttributes()
{
IsVisible = false
});
Assert.True(updatedSnapshot);
Assert.False(testSearch.IsVisible);
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
// Create a saved search with some additional arguments
testSearch = await savedSearches.CreateAsync(name, search, new SavedSearchAttributes()
{
IsVisible = false
});
Assert.False(testSearch.IsVisible);
// Set email param attributes
var attributes = new SavedSearchAttributes()
{
ActionEmailAuthPassword = "******",
ActionEmailAuthUsername = "******",
ActionEmailBcc = "*****@*****.**",
ActionEmailCC = "*****@*****.**",
ActionEmailCommand = "$name1$",
ActionEmailFormat = EmailFormat.Plain,
ActionEmailFrom = "*****@*****.**",
//attrs.ActionEmailHostname = "dummy1.host.com",
ActionEmailInline = "true",
ActionEmailMailServer = "splunk.com",
ActionEmailMaxResults = 101,
ActionEmailMaxTime = "10s",
ActionEmailSendPdf = true, //??ActionEmailPdfView = "dummy",
ActionEmailSendResults = true, //??ActionEmailPreProcessResults = "*",
ActionEmailReportPaperOrientation = PaperOrientation.Landscape,
ActionEmailReportPaperSize = PaperSize.Letter,
ActionEmailReportServerEnabled = false,
//attrs.ActionEmailReportServerUrl = "splunk.com",
ActionEmailSubject = "sdk-subject",
ActionEmailTo = "*****@*****.**",
ActionEmailTrackAlert = false,
ActionEmailTtl = "61",
ActionEmailUseSsl = false,
ActionEmailUseTls = false,
ActionEmailWidthSortColumns = false,
ActionPopulateLookupCommand = "$name2$",
ActionPopulateLookupDestination = "dummypath",
ActionPopulateLookupHostName = "dummy2.host.com",
ActionPopulateLookupMaxResults = 102,
ActionPopulateLookupMaxTime = "20s",
ActionPopulateLookupTrackAlert = false,
ActionPopulateLookupTtl = "62",
ActionRssCommand = "$name3$",
//attrs.ActionRssHostname = "dummy3.host.com",
ActionRssMaxResults = 103,
ActionRssMaxTime = "30s",
ActionRssTrackAlert = "false",
ActionRssTtl = "63",
ActionScriptCommand = "$name4$",
ActionScriptFileName = "action_script_filename",
ActionScriptHostName = "dummy4.host.com",
ActionScriptMaxResults = 104,
ActionScriptMaxTime = "40s",
ActionScriptTrackAlert = false,
ActionScriptTtl = "64",
ActionSummaryIndexName = "default",
ActionSummaryIndexCommand = "$name5$",
//attrs.ActionSummaryIndexHostname = "dummy5.host.com",
ActionSummaryIndexInline = false,
ActionSummaryIndexMaxResults = 105,
ActionSummaryIndexMaxTime = "50s",
ActionSummaryIndexTrackAlert = false,
ActionSummaryIndexTtl = "65",
Actions = "rss,email,populate_lookup,script,summary_index"
};
await testSearch.UpdateAsync(attributes);
// check
Assert.True(testSearch.Actions.Email != null); //IsActionEmail));
Assert.True(testSearch.Actions.PopulateLookup != null);
Assert.True(testSearch.Actions.Rss != null);
Assert.True(testSearch.Actions.Script != null);
Assert.True(testSearch.Actions.SummaryIndex != null);
Assert.Equal("sdk-password", testSearch.Actions.Email.AuthPassword);
Assert.Equal("sdk-username", testSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.CC);
Assert.Equal("$name1$", testSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, testSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(testSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, testSearch.Actions.Email.MaxResults);
Assert.Equal("10s", testSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, testSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, testSearch.Actions.Email.ReportPaperSize);
Assert.False(testSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.True(testSearch.Actions.Email.SendPdf);
Assert.True(testSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", testSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", testSearch.Actions.Email.To);
Assert.False(testSearch.Actions.Email.TrackAlert);
Assert.Equal("61", testSearch.Actions.Email.Ttl);
Assert.False(testSearch.Actions.Email.UseSsl);
Assert.False(testSearch.Actions.Email.UseTls);
Assert.False(testSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", testSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", testSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", testSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, testSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", testSearch.Actions.PopulateLookup.MaxTime);
Assert.False(testSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", testSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", testSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, testSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", testSearch.Actions.Rss.MaxTime);
Assert.False(testSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", testSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", testSearch.Actions.Script.Command);
Assert.Equal("action_script_filename", testSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", testSearch.Actions.Script.Hostname);
Assert.Equal(104, testSearch.Actions.Script.MaxResults);
Assert.Equal("40s", testSearch.Actions.Script.MaxTime);
Assert.False(testSearch.Actions.Script.TrackAlert);
Assert.Equal("64", testSearch.Actions.Script.Ttl);
Assert.Equal("default", testSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", testSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(testSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, testSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", testSearch.Actions.SummaryIndex.MaxTime);
Assert.False(testSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", testSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search
await testSearch.RemoveAsync();
try
{
await testSearch.GetAsync();
Assert.True(false);
}
catch (ResourceNotFoundException)
{ }
testSearch = await savedSearches.GetOrNullAsync(testSearch.Name);
Assert.Null(testSearch);
}
}
public async Task SavedSearchDispatchProperties()
{
using (var service = await SdkHelper.CreateService())
{
// Ensure correct start state
SavedSearchCollection savedSearches = service.SavedSearches;
string name = "sdk-test_DispatchProperties";
SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);
if (testSearch != null)
{
await testSearch.RemoveAsync();
}
await savedSearches.GetAllAsync();
Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name));
// Create a saved search
testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m");
// Dispatch the saved search with default arguments
Job job = await testSearch.DispatchAsync();
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Dispatch with some additional search options
job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
});
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
var savedSearchTemplateArgs = new SavedSearchTemplateArgs(
new Argument("action.email.authpassword ", "sdk-password"),
new Argument("action.email.authusername ", "sdk-username"),
new Argument("action.email.bcc ", "*****@*****.**"),
new Argument("action.email.cc ", "*****@*****.**"),
new Argument("action.email.command ", "$name1$"),
new Argument("action.email.format ", "text"),
new Argument("action.email.from ", "*****@*****.**"),
new Argument("action.email.hostname ", "dummy1.host.com"),
new Argument("action.email.inline ", "true"),
new Argument("action.email.mailserver ", "splunk.com"),
new Argument("action.email.maxresults ", "101"),
new Argument("action.email.maxtime ", "10s"),
new Argument("action.email.pdfview ", "dummy"),
new Argument("action.email.reportpaperorientation ", "landscape"),
new Argument("action.email.reportpapersize ", "letter"),
new Argument("action.email.reportserverenabled ", "false"),
new Argument("action.email.reportserverurl ", "splunk.com"),
new Argument("action.email.sendpdf ", "false"),
new Argument("action.email.sendresults ", "false"),
new Argument("action.email.subject ", "sdk-subject"),
new Argument("action.email.to ", "*****@*****.**"),
new Argument("action.email.trackalert ", "false"),
new Argument("action.email.ttl ", "61"),
new Argument("action.email.usessl ", "false"),
new Argument("action.email.usetls ", "false"),
new Argument("action.email.widthsortcolumns ", "false"),
new Argument("actions.populatelookup.command ", "$name2$"),
new Argument("actions.populatelookup.dest ", "dummypath"),
new Argument("actions.populatelookup.hostname ", "dummy2.host.com"),
new Argument("actions.populatelookup.maxresults ", "102"),
new Argument("actions.populatelookup.maxtime ", "20s"),
new Argument("actions.populatelookup.trackalert ", "false"),
new Argument("actions.populatelookup.ttl ", "62"),
new Argument("actions.rss.command ", "$name3$"),
new Argument("actions.rss.hostname ", "dummy3.host.com"),
new Argument("actions.rss.maxresults ", "103"),
new Argument("actions.rss.maxtime ", "30s"),
new Argument("actions.rss.trackalert ", "false"),
new Argument("actions.rss.ttl ", "63"),
new Argument("actionscriptcommand ", "$name4$"),
new Argument("actionscriptfilename ", "action_script_filename"),
new Argument("actionscripthostname ", "dummy4.host.com"),
new Argument("actionscriptmaxresults ", "104"),
new Argument("actionscriptmaxtime ", "40s"),
new Argument("actionscripttrackalert ", "false"),
new Argument("actionscriptttl ", "64"),
new Argument("actions.summaryindex.command ", "$name5$"),
new Argument("actions.summaryindex.hostname ", "dummy5.host.com"),
new Argument("actions.summaryindex.inline ", "false"),
new Argument("actions.summaryindex.maxresults ", "105"),
new Argument("actions.summaryindex.maxtime ", "50s"),
new Argument("actions.summaryindex.trackalert ", "false"),
new Argument("actions.summaryindex.ttl ", "65"),
new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
//// Same as the previous dispatch except using custom arg
job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs);
await job.TransitionAsync(DispatchState.Done);
await job.CancelAsync();
// Delete the saved search
await testSearch.RemoveAsync();
testSearch = await savedSearches.GetOrNullAsync(name);
Assert.Null(testSearch);
}
}
public async Task SavedSearchesProperties()
{
using (var service = await SdkHelper.CreateService())
{
SavedSearchCollection savedSearches = service.SavedSearches;
await savedSearches.GetAllAsync();
// Iterate saved searches and make sure we can read them
foreach (SavedSearch savedSearch in savedSearches)
{
string dummyString;
bool dummyBool;
//DateTime dummyDateTime;
int dummyInt;
// Resource properties
//dummyString = savedSearch.Name;
dummyString = savedSearch.Name;
//dummyString = savedSearch.Path;
// SavedSearch properties get
dummyString = savedSearch.Actions.Email.AuthPassword;
dummyString = savedSearch.Actions.Email.AuthUsername;
dummyBool = savedSearch.Actions.Email.SendResults;
dummyString = savedSearch.Actions.Email.Bcc;
dummyString = savedSearch.Actions.Email.CC;
dummyString = savedSearch.Actions.Email.Command;
EmailFormat emailFormat = savedSearch.Actions.Email.Format;
dummyBool = savedSearch.Actions.Email.Inline;
dummyString = savedSearch.Actions.Email.MailServer;
dummyInt = savedSearch.Actions.Email.MaxResults;
dummyString = savedSearch.Actions.Email.MaxTime;
PaperOrientation paperOrientation = savedSearch.Actions.Email.ReportPaperOrientation;
PaperSize paperSize = savedSearch.Actions.Email.ReportPaperSize;
dummyBool = savedSearch.Actions.Email.ReportServerEnabled;
//dummyString = savedSearch.Actions.Email.ReportServerUrl;
dummyBool = savedSearch.Actions.Email.SendPdf;
dummyBool = savedSearch.Actions.Email.SendResults;
dummyString = savedSearch.Actions.Email.Subject;
dummyString = savedSearch.Actions.Email.To;
dummyBool = savedSearch.Actions.Email.TrackAlert;
dummyString = savedSearch.Actions.Email.Ttl;
dummyBool = savedSearch.Actions.Email.UseSsl;
dummyBool = savedSearch.Actions.Email.UseTls;
dummyBool = savedSearch.Actions.Email.WidthSortColumns;
dummyString = savedSearch.Actions.PopulateLookup.Command;
dummyString = savedSearch.Actions.PopulateLookup.Destination;
dummyString = savedSearch.Actions.PopulateLookup.Hostname;
dummyInt = savedSearch.Actions.PopulateLookup.MaxResults;
dummyString = savedSearch.Actions.PopulateLookup.MaxTime;
dummyBool = savedSearch.Actions.PopulateLookup.TrackAlert;
dummyString = savedSearch.Actions.PopulateLookup.Ttl;
dummyString = savedSearch.Actions.Rss.Command;
//dummyString = savedSearch.Actions.Rss.Hostname;
dummyInt = savedSearch.Actions.Rss.MaxResults;
dummyString = savedSearch.Actions.Rss.MaxTime;
dummyBool = savedSearch.Actions.Rss.TrackAlert;
dummyString = savedSearch.Actions.Rss.Ttl;
SavedSearch.ActionsAdapter.ScriptAdapter scriptT = savedSearch.Actions.Script;
dummyString = scriptT.FileName;
dummyString = scriptT.Hostname;
dummyInt = scriptT.MaxResults;
dummyString = scriptT.MaxTime;
dummyBool = scriptT.TrackAlert;
dummyString = scriptT.Ttl;
dummyString = savedSearch.Actions.SummaryIndex.Name;
dummyString = savedSearch.Actions.SummaryIndex.Command;
//dummyString = savedSearch.Actions.SummaryIndex.Hostname;
dummyBool = savedSearch.Actions.SummaryIndex.Inline;
dummyInt = savedSearch.Actions.SummaryIndex.MaxResults;
dummyString = savedSearch.Actions.SummaryIndex.MaxTime;
dummyBool = savedSearch.Actions.SummaryIndex.TrackAlert;
dummyString = savedSearch.Actions.SummaryIndex.Ttl;
dummyBool = savedSearch.Alert.DigestMode;
dummyString = savedSearch.Alert.Expires;
AlertSeverity alertSeverity = savedSearch.Alert.Severity;
SavedSearch.AlertAdapter.SuppressAdapter suppress = savedSearch.Alert.Suppress;
dummyString = suppress.Fields;
dummyString = suppress.Period;
AlertTrack track = savedSearch.Alert.Track;
AlertComparator comparator = savedSearch.Alert.Comparator;
dummyString = savedSearch.Alert.Condition;
dummyString = savedSearch.Alert.Threshold;
AlertType alertType = savedSearch.Alert.AlertType;
dummyString = savedSearch.CronSchedule;
dummyString = savedSearch.Description;
dummyInt = savedSearch.Dispatch.Buckets;
dummyString = savedSearch.Dispatch.EarliestTime;
//dummyString = savedSearch.Dispatch.LatestTime;
dummyBool = savedSearch.Dispatch.Lookups;
dummyInt = savedSearch.Dispatch.MaxCount;
dummyInt = savedSearch.Dispatch.MaxTime;
dummyInt = savedSearch.Dispatch.ReduceFreq;
dummyBool = savedSearch.Dispatch.RealTimeBackfill;
dummyBool = savedSearch.Dispatch.SpawnProcess;
dummyString = savedSearch.Dispatch.TimeFormat;
dummyString = savedSearch.Dispatch.Ttl;
SavedSearch.DisplayAdapter display = savedSearch.Display;
dummyInt = savedSearch.MaxConcurrent;
//dummyDateTime = savedSearch.NextScheduledTime;
dummyString = savedSearch.QualifiedSearch;
dummyBool = savedSearch.RealTimeSchedule;
dummyString = savedSearch.Request.UIDispatchApp;
dummyString = savedSearch.Request.UIDispatchView;
dummyBool = savedSearch.RestartOnSearchPeerAdd;
dummyBool = savedSearch.RunOnStartup;
dummyString = savedSearch.Search;
//dummyString = savedSearch.Vsid;
dummyBool = savedSearch.Actions.Email.IsEnabled;
dummyBool = savedSearch.Actions.PopulateLookup.IsEnabled;
dummyBool = savedSearch.Actions.Rss.IsEnabled;
//dummyBool = savedSearch.IsActionScript;
dummyBool = savedSearch.Actions.SummaryIndex.IsEnabled;
dummyBool = savedSearch.IsDisabled;
dummyBool = savedSearch.IsScheduled;
dummyBool = savedSearch.IsVisible;
}
for (int i = 0; i < savedSearches.Count; i++)
{
SavedSearch savedSearch = savedSearches[i];
string dummyString;
bool dummyBool;
//DateTime dummyDateTime;
int dummyInt;
// Resource properties
//dummyString = savedSearch.Name;
dummyString = savedSearch.Name;
//dummyString = savedSearch.Path;
// SavedSearch properties get
dummyString = savedSearch.Actions.Email.AuthPassword;
dummyString = savedSearch.Actions.Email.AuthUsername;
dummyBool = savedSearch.Actions.Email.SendResults;
dummyString = savedSearch.Actions.Email.Bcc;
dummyString = savedSearch.Actions.Email.CC;
dummyString = savedSearch.Actions.Email.Command;
EmailFormat emailFormat = savedSearch.Actions.Email.Format;
dummyBool = savedSearch.Actions.Email.Inline;
dummyString = savedSearch.Actions.Email.MailServer;
dummyInt = savedSearch.Actions.Email.MaxResults;
dummyString = savedSearch.Actions.Email.MaxTime;
PaperOrientation paperOrientation = savedSearch.Actions.Email.ReportPaperOrientation;
PaperSize paperSize = savedSearch.Actions.Email.ReportPaperSize;
dummyBool = savedSearch.Actions.Email.ReportServerEnabled;
//dummyString = savedSearch.Actions.Email.ReportServerUrl;
dummyBool = savedSearch.Actions.Email.SendPdf;
dummyBool = savedSearch.Actions.Email.SendResults;
dummyString = savedSearch.Actions.Email.Subject;
dummyString = savedSearch.Actions.Email.To;
dummyBool = savedSearch.Actions.Email.TrackAlert;
dummyString = savedSearch.Actions.Email.Ttl;
dummyBool = savedSearch.Actions.Email.UseSsl;
dummyBool = savedSearch.Actions.Email.UseTls;
dummyBool = savedSearch.Actions.Email.WidthSortColumns;
dummyString = savedSearch.Actions.PopulateLookup.Command;
dummyString = savedSearch.Actions.PopulateLookup.Destination;
dummyString = savedSearch.Actions.PopulateLookup.Hostname;
dummyInt = savedSearch.Actions.PopulateLookup.MaxResults;
dummyString = savedSearch.Actions.PopulateLookup.MaxTime;
dummyBool = savedSearch.Actions.PopulateLookup.TrackAlert;
dummyString = savedSearch.Actions.PopulateLookup.Ttl;
dummyString = savedSearch.Actions.Rss.Command;
//dummyString = savedSearch.Actions.Rss.Hostname;
dummyInt = savedSearch.Actions.Rss.MaxResults;
dummyString = savedSearch.Actions.Rss.MaxTime;
dummyBool = savedSearch.Actions.Rss.TrackAlert;
dummyString = savedSearch.Actions.Rss.Ttl;
SavedSearch.ActionsAdapter.ScriptAdapter script = savedSearch.Actions.Script;
dummyString = script.FileName;
dummyString = script.Hostname;
dummyInt = script.MaxResults;
dummyString = script.MaxTime;
dummyBool = script.TrackAlert;
dummyString = script.Ttl;
dummyString = savedSearch.Actions.SummaryIndex.Name;
dummyString = savedSearch.Actions.SummaryIndex.Command;
//dummyString = savedSearch.Actions.SummaryIndex.Hostname;
dummyBool = savedSearch.Actions.SummaryIndex.Inline;
dummyInt = savedSearch.Actions.SummaryIndex.MaxResults;
dummyString = savedSearch.Actions.SummaryIndex.MaxTime;
dummyBool = savedSearch.Actions.SummaryIndex.TrackAlert;
dummyString = savedSearch.Actions.SummaryIndex.Ttl;
dummyBool = savedSearch.Alert.DigestMode;
dummyString = savedSearch.Alert.Expires;
AlertSeverity alertSeverity = savedSearch.Alert.Severity;
SavedSearch.AlertAdapter.SuppressAdapter suppress = savedSearch.Alert.Suppress;
dummyString = suppress.Fields;
dummyString = suppress.Period;
AlertTrack track = savedSearch.Alert.Track;
AlertComparator comparator = savedSearch.Alert.Comparator;
dummyString = savedSearch.Alert.Condition;
dummyString = savedSearch.Alert.Threshold;
AlertType alertType = savedSearch.Alert.AlertType;
dummyString = savedSearch.CronSchedule;
dummyString = savedSearch.Description;
dummyInt = savedSearch.Dispatch.Buckets;
dummyString = savedSearch.Dispatch.EarliestTime;
//dummyString = savedSearch.Dispatch.LatestTime;
dummyBool = savedSearch.Dispatch.Lookups;
dummyInt = savedSearch.Dispatch.MaxCount;
dummyInt = savedSearch.Dispatch.MaxTime;
dummyInt = savedSearch.Dispatch.ReduceFreq;
dummyBool = savedSearch.Dispatch.RealTimeBackfill;
dummyBool = savedSearch.Dispatch.SpawnProcess;
dummyString = savedSearch.Dispatch.TimeFormat;
dummyString = savedSearch.Dispatch.Ttl;
SavedSearch.DisplayAdapter display = savedSearch.Display;
dummyInt = savedSearch.MaxConcurrent;
//dummyDateTime = savedSearch.NextScheduledTime;
dummyString = savedSearch.QualifiedSearch;
dummyBool = savedSearch.RealTimeSchedule;
dummyString = savedSearch.Request.UIDispatchApp;
dummyString = savedSearch.Request.UIDispatchView;
dummyBool = savedSearch.RestartOnSearchPeerAdd;
dummyBool = savedSearch.RunOnStartup;
dummyString = savedSearch.Search;
//dummyString = savedSearch.Vsid;
dummyBool = savedSearch.Actions.Email.IsEnabled;
dummyBool = savedSearch.Actions.PopulateLookup.IsEnabled;
dummyBool = savedSearch.Actions.Rss.IsEnabled;
//dummyBool = savedSearch.IsActionScript;
dummyBool = savedSearch.Actions.SummaryIndex.IsEnabled;
dummyBool = savedSearch.IsDisabled;
dummyBool = savedSearch.IsScheduled;
dummyBool = savedSearch.IsVisible;
}
}
}
public void SavedSearches()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Iterate saved searches and make sure we can read them.
foreach (SavedSearch savedSearch in savedSearches.Values)
{
string dummyString;
bool dummyBool;
DateTime dummyDateTime;
int dummyInt;
// Resource properties
dummyString = savedSearch.Name;
dummyString = savedSearch.Title;
dummyString = savedSearch.Path;
// SavedSearch properties get
dummyString = savedSearch.ActionEmailAuthPassword;
dummyString = savedSearch.ActionEmailAuthUsername;
dummyBool = savedSearch.ActionEmailSendResults;
dummyString = savedSearch.ActionEmailBcc;
dummyString = savedSearch.ActionEmailCc;
dummyString = savedSearch.ActionEmailCommand;
dummyString = savedSearch.ActionEmailFormat;
dummyBool = savedSearch.ActionEmailInline;
dummyString = savedSearch.ActionEmailMailServer;
dummyInt = savedSearch.ActionEmailMaxResults;
dummyString = savedSearch.ActionEmailMaxTime;
dummyString = savedSearch.ActionEmailReportPaperOrientation;
dummyString = savedSearch.ActionEmailReportPaperSize;
dummyBool = savedSearch.ActionEmailReportServerEnabled;
dummyString = savedSearch.ActionEmailReportServerUrl;
dummyBool = savedSearch.ActionEmailSendPdf;
dummyBool = savedSearch.ActionEmailSendResults;
dummyString = savedSearch.ActionEmailSubject;
dummyString = savedSearch.ActionEmailTo;
dummyBool = savedSearch.ActionEmailTrackAlert;
dummyString = savedSearch.ActionEmailTtl;
dummyBool = savedSearch.ActionEmailUseSsl;
dummyBool = savedSearch.ActionEmailUseTls;
dummyBool = savedSearch.ActionEmailWidthSortColumns;
dummyString = savedSearch.ActionPopulateLookupCommand;
dummyString = savedSearch.ActionPopulateLookupDest;
dummyString = savedSearch.ActionPopulateLookupHostname;
dummyInt = savedSearch.ActionPopulateLookupMaxResults;
dummyString = savedSearch.ActionPopulateLookupMaxTime;
dummyBool = savedSearch.ActionPopulateLookupTrackAlert;
dummyString = savedSearch.ActionPopulateLookupTtl;
dummyString = savedSearch.ActionRssCommand;
dummyString = savedSearch.ActionRssHostname;
dummyInt = savedSearch.ActionRssMaxResults;
dummyString = savedSearch.ActionRssMaxTime;
dummyBool = savedSearch.ActionRssTrackAlert;
dummyString = savedSearch.ActionRssTtl;
dummyString = savedSearch.ActionScriptCommand;
dummyString = savedSearch.ActionScriptFilename;
dummyString = savedSearch.ActionScriptHostname;
dummyInt = savedSearch.ActionScriptMaxResults;
dummyString = savedSearch.ActionScriptMaxTime;
dummyBool = savedSearch.ActionScriptTrackAlert;
dummyString = savedSearch.ActionScriptTtl;
dummyString = savedSearch.ActionSummaryIndexName;
dummyString = savedSearch.ActionSummaryIndexCommand;
dummyString = savedSearch.ActionSummaryIndexHostname;
dummyBool = savedSearch.ActionSummaryIndexInline;
dummyInt = savedSearch.ActionSummaryIndexMaxResults;
dummyString = savedSearch.ActionSummaryIndexMaxTime;
dummyBool = savedSearch.ActionSummaryIndexTrackAlert;
dummyString = savedSearch.ActionSummaryIndexTtl;
dummyBool = savedSearch.AlertDigestMode;
dummyString = savedSearch.AlertExpires;
dummyInt = savedSearch.AlertSeverity;
dummyBool = savedSearch.AlertSuppress;
dummyString = savedSearch.AlertSuppressFields;
dummyString = savedSearch.AlertSuppressPeriod;
dummyString = savedSearch.AlertTrack;
dummyString = savedSearch.AlertComparator;
dummyString = savedSearch.AlertCondition;
dummyString = savedSearch.AlertThreshold;
dummyString = savedSearch.AlertType;
dummyString = savedSearch.CronSchedule;
dummyString = savedSearch.Description;
dummyInt = savedSearch.DispatchBuckets;
dummyString = savedSearch.DispatchEarliestTime;
dummyString = savedSearch.DispatchLatestTime;
dummyBool = savedSearch.DispatchLookups;
dummyInt = savedSearch.DispatchMaxCount;
dummyString = savedSearch.DispatchMaxTime;
dummyInt = savedSearch.DispatchReduceFreq;
dummyBool = savedSearch.DispatchRtBackfill;
dummyBool = savedSearch.DispatchSpawnProcess;
dummyString = savedSearch.DispatchTimeFormat;
dummyString = savedSearch.DispatchTtl;
dummyString = savedSearch.DisplayView;
dummyInt = savedSearch.MaxConcurrent;
dummyDateTime = savedSearch.NextScheduledTime;
dummyString = savedSearch.QualifiedSearch;
dummyInt = savedSearch.RealtimeSchedule;
dummyString = savedSearch.RequestUiDispatchApp;
dummyString = savedSearch.RequestUiDispatchView;
dummyBool = savedSearch.RestartOnSearchPeerAdd;
dummyBool = savedSearch.RunOnStartup;
dummyString = savedSearch.Search;
dummyString = savedSearch.Vsid;
dummyBool = savedSearch.IsActionEmail;
dummyBool = savedSearch.IsActionPopulateLookup;
dummyBool = savedSearch.IsActionRss;
dummyBool = savedSearch.IsActionScript;
dummyBool = savedSearch.IsActionSummaryIndex;
dummyBool = savedSearch.IsDisabled;
dummyBool = savedSearch.IsScheduled;
dummyBool = savedSearch.IsVisible;
}
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#67");
// Create a saved search
Job job;
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch = savedSearches.Create("sdk-test1", search);
// Dispatch the saved search and wait for results.
job = savedSearch.Dispatch();
this.Wait(job);
job.Results().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.buckets", 100));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.earliest_time", "aaaa"));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
var savedSearchDispatchArgs = new SavedSearchDispatchArgs();
savedSearchDispatchArgs.ActionEmailAuthPassword = "******";
savedSearchDispatchArgs.ActionEmailAuthUsername = "******";
savedSearchDispatchArgs.ActionEmailBcc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCommand = "$name1$";
savedSearchDispatchArgs.ActionEmailFormat = "text";
savedSearchDispatchArgs.ActionEmailFrom = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailHostname = "dummy1.host.com";
savedSearchDispatchArgs.ActionEmailInline = true;
savedSearchDispatchArgs.ActionEmailMailServer = "splunk.com";
savedSearchDispatchArgs.ActionEmailMaxResults = 101;
savedSearchDispatchArgs.ActionEmailMaxTime = "10s";
savedSearchDispatchArgs.ActionEmailPdfView = "dummy";
savedSearchDispatchArgs.ActionEmailReportPaperOrientation = "landscape";
savedSearchDispatchArgs.ActionEmailReportPaperSize = "letter";
savedSearchDispatchArgs.ActionEmailReportServerEnabled = false;
savedSearchDispatchArgs.ActionEmailReportServerUrl = "splunk.com";
savedSearchDispatchArgs.ActionEmailSendPdf = false;
savedSearchDispatchArgs.ActionEmailSendResults = false;
savedSearchDispatchArgs.ActionEmailSubject = "sdk-subject";
savedSearchDispatchArgs.ActionEmailTo = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailTrackAlert = false;
savedSearchDispatchArgs.ActionEmailTtl = "61";
savedSearchDispatchArgs.ActionEmailUseSsl = false;
savedSearchDispatchArgs.ActionEmailUseTls = false;
savedSearchDispatchArgs.ActionEmailWidthSortColumns = false;
savedSearchDispatchArgs.ActionPopulateLookupCommand = "$name2$";
savedSearchDispatchArgs.ActionPopulateLookupDest = "dummypath";
savedSearchDispatchArgs.ActionPopulateLookupHostname = "dummy2.host.com";
savedSearchDispatchArgs.ActionPopulateLookupMaxResults = 102;
savedSearchDispatchArgs.ActionPopulateLookupMaxTime = "20s";
savedSearchDispatchArgs.ActionPopulateLookupTrackAlert = false;
savedSearchDispatchArgs.ActionPopulateLookupTtl = "62";
savedSearchDispatchArgs.ActionRssCommand = "$name3$";
savedSearchDispatchArgs.ActionRssHostname = "dummy3.host.com";
savedSearchDispatchArgs.ActionRssMaxResults = 103;
savedSearchDispatchArgs.ActionRssMaxTime = "30s";
savedSearchDispatchArgs.ActionRssTrackAlert = false;
savedSearchDispatchArgs.ActionRssTtl = "63";
savedSearchDispatchArgs.ActionScriptCommand = "$name4$";
savedSearchDispatchArgs.ActionScriptFilename = "action_script_filename";
savedSearchDispatchArgs.ActionScriptHostname = "dummy4.host.com";
savedSearchDispatchArgs.ActionScriptMaxResults = 104;
savedSearchDispatchArgs.ActionScriptMaxTime = "40s";
savedSearchDispatchArgs.ActionScriptTrackAlert = false;
savedSearchDispatchArgs.ActionScriptTtl = "64";
savedSearchDispatchArgs.ActionSummaryIndexCommand = "$name5$";
savedSearchDispatchArgs.ActionSummaryIndexHostname = "dummy5.host.com";
savedSearchDispatchArgs.ActionSummaryIndexInline = false;
savedSearchDispatchArgs.ActionSummaryIndexMaxResults = 105;
savedSearchDispatchArgs.ActionSummaryIndexMaxTime = "50s";
savedSearchDispatchArgs.ActionSummaryIndexTrackAlert = false;
savedSearchDispatchArgs.ActionSummaryIndexTtl = "65";
savedSearchDispatchArgs.Actions = "rss,email,populate_lookup,script,summary_index";
// Same as the previous dispatch except using custom arg
job = savedSearch.Dispatch(savedSearchDispatchArgs);
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Delete the saved search
savedSearches.Remove("sdk-test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#68");
}
public void SavedSearchesCRUD()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#1");
SavedSearch savedSearch;
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
savedSearches.Create("sdk-test1", search);
Assert.IsTrue(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#2");
// Read the saved search
savedSearch = savedSearches.Get("sdk-test1");
Assert.IsTrue(savedSearch.IsVisible, this.assertRoot + "#3");
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
savedSearch.Update(new Args("is_visible", false));
savedSearch.Refresh();
Assert.IsFalse(savedSearch.IsVisible, this.assertRoot + "#4");
// Delete the saved search
savedSearches.Remove("sdk-test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#5");
// Create a saved search with some additional arguments
savedSearch = savedSearches.Create("sdk-test1", search, new Args("is_visible", false));
Assert.IsFalse(savedSearch.IsVisible, this.assertRoot + "#6");
// set email params
savedSearch.ActionEmailAuthPassword = "******";
savedSearch.ActionEmailAuthUsername = "******";
savedSearch.ActionEmailBcc = "*****@*****.**";
savedSearch.ActionEmailCc = "*****@*****.**";
savedSearch.ActionEmailCommand = "$name1$";
savedSearch.ActionEmailFormat = "text";
savedSearch.ActionEmailFrom = "*****@*****.**";
savedSearch.ActionEmailHostname = "dummy1.host.com";
savedSearch.ActionEmailInline = true;
savedSearch.ActionEmailMailServer = "splunk.com";
savedSearch.ActionEmailMaxResults = 101;
savedSearch.ActionEmailMaxTime = "10s";
savedSearch.ActionEmailPdfView = "dummy";
savedSearch.ActionEmailPreProcessResults = "*";
savedSearch.ActionEmailReportPaperOrientation = "landscape";
savedSearch.ActionEmailReportPaperSize = "letter";
savedSearch.ActionEmailReportServerEnabled = false;
savedSearch.ActionEmailReportServerUrl = "splunk.com";
savedSearch.ActionEmailSendPdf = false;
savedSearch.ActionEmailSendResults = false;
savedSearch.ActionEmailSubject = "sdk-subject";
savedSearch.ActionEmailTo = "*****@*****.**";
savedSearch.ActionEmailTrackAlert = false;
savedSearch.ActionEmailTtl = "61";
savedSearch.ActionEmailUseSsl = false;
savedSearch.ActionEmailUseTls = false;
savedSearch.ActionEmailWidthSortColumns = false;
savedSearch.ActionPopulateLookupCommand = "$name2$";
savedSearch.ActionPopulateLookupDest = "dummypath";
savedSearch.ActionPopulateLookupHostname = "dummy2.host.com";
savedSearch.ActionPopulateLookupMaxResults = 102;
savedSearch.ActionPopulateLookupMaxTime = "20s";
savedSearch.ActionPopulateLookupTrackAlert = false;
savedSearch.ActionPopulateLookupTtl = "62";
savedSearch.ActionRssCommand = "$name3$";
savedSearch.ActionRssHostname = "dummy3.host.com";
savedSearch.ActionRssMaxResults = 103;
savedSearch.ActionRssMaxTime = "30s";
savedSearch.ActionRssTrackAlert = false;
savedSearch.ActionRssTtl = "63";
savedSearch.ActionScriptCommand = "$name4$";
const string ActionScriptFilename = "action_script_filename";
savedSearch.ActionScriptFilename = ActionScriptFilename;
savedSearch.ActionScriptHostname = "dummy4.host.com";
savedSearch.ActionScriptMaxResults = 104;
savedSearch.ActionScriptMaxTime = "40s";
savedSearch.ActionScriptTrackAlert = false;
savedSearch.ActionScriptTtl = "64";
savedSearch.ActionSummaryIndexName = "default";
savedSearch.ActionSummaryIndexCommand = "$name5$";
savedSearch.ActionSummaryIndexHostname = "dummy5.host.com";
savedSearch.ActionSummaryIndexInline = false;
savedSearch.ActionSummaryIndexMaxResults = 105;
savedSearch.ActionSummaryIndexMaxTime = "50s";
savedSearch.ActionSummaryIndexTrackAlert = false;
savedSearch.ActionSummaryIndexTtl = "65";
savedSearch.Actions = "rss,email,populate_lookup,script,summary_index";
savedSearch.Search = search;
savedSearch.Update();
// check
Assert.IsTrue(savedSearch.IsActionEmail, this.assertRoot + "#7");
Assert.IsTrue(savedSearch.IsActionPopulateLookup, this.assertRoot + "#8");
Assert.IsTrue(savedSearch.IsActionRss, this.assertRoot + "#9");
Assert.IsTrue(savedSearch.IsActionScript, this.assertRoot + "#10");
Assert.IsTrue(savedSearch.IsActionSummaryIndex, this.assertRoot + "#11");
Assert.AreEqual("sdk-password", savedSearch.ActionEmailAuthPassword, this.assertRoot + "#12");
Assert.AreEqual("sdk-username", savedSearch.ActionEmailAuthUsername, this.assertRoot + "#13");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailBcc, this.assertRoot + "#14");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailCc, this.assertRoot + "#15");
Assert.AreEqual("$name1$", savedSearch.ActionEmailCommand, this.assertRoot + "#16");
Assert.AreEqual("text", savedSearch.ActionEmailFormat, this.assertRoot + "#17");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailFrom, this.assertRoot + "#18");
Assert.AreEqual("dummy1.host.com", savedSearch.ActionEmailHostname, this.assertRoot + "#19");
Assert.IsTrue(savedSearch.ActionEmailInline, this.assertRoot + "#20");
Assert.AreEqual("splunk.com", savedSearch.ActionEmailMailServer, this.assertRoot + "#21");
Assert.AreEqual(101, savedSearch.ActionEmailMaxResults, this.assertRoot + "#22");
Assert.AreEqual("10s", savedSearch.ActionEmailMaxTime, this.assertRoot + "#23");
Assert.AreEqual("dummy", savedSearch.ActionEmailPdfView, this.assertRoot + "#24");
Assert.AreEqual("*", savedSearch.ActionEmailPreProcessResults, this.assertRoot + "#25");
Assert.AreEqual("landscape", savedSearch.ActionEmailReportPaperOrientation, this.assertRoot + "#26");
Assert.AreEqual("letter", savedSearch.ActionEmailReportPaperSize, this.assertRoot + "#27");
Assert.IsFalse(savedSearch.ActionEmailReportServerEnabled, this.assertRoot + "#28");
Assert.AreEqual("splunk.com", savedSearch.ActionEmailReportServerUrl, this.assertRoot + "#29");
Assert.IsFalse(savedSearch.ActionEmailSendPdf, this.assertRoot + "#30");
Assert.IsFalse(savedSearch.ActionEmailSendResults, this.assertRoot + "#31");
Assert.AreEqual("sdk-subject", savedSearch.ActionEmailSubject, this.assertRoot + "#32");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailTo, this.assertRoot + "#33");
Assert.IsFalse(savedSearch.ActionEmailTrackAlert, this.assertRoot + "#34");
Assert.AreEqual("61", savedSearch.ActionEmailTtl, this.assertRoot + "#35");
Assert.IsFalse(savedSearch.ActionEmailUseSsl, this.assertRoot + "#36");
Assert.IsFalse(savedSearch.ActionEmailUseTls, this.assertRoot + "#37");
Assert.IsFalse(savedSearch.ActionEmailWidthSortColumns, this.assertRoot + "#38");
Assert.AreEqual("$name2$", savedSearch.ActionPopulateLookupCommand, this.assertRoot + "#39");
Assert.AreEqual("dummypath", savedSearch.ActionPopulateLookupDest, this.assertRoot + "#40");
Assert.AreEqual("dummy2.host.com", savedSearch.ActionPopulateLookupHostname, this.assertRoot + "#41");
Assert.AreEqual(102, savedSearch.ActionPopulateLookupMaxResults, this.assertRoot + "#42");
Assert.AreEqual("20s", savedSearch.ActionPopulateLookupMaxTime, this.assertRoot + "#43");
Assert.IsFalse(savedSearch.ActionPopulateLookupTrackAlert, this.assertRoot + "#44");
Assert.AreEqual("62", savedSearch.ActionPopulateLookupTtl, this.assertRoot + "#45");
Assert.AreEqual("$name3$", savedSearch.ActionRssCommand, this.assertRoot + "#46");
Assert.AreEqual("dummy3.host.com", savedSearch.ActionRssHostname, this.assertRoot + "#47");
Assert.AreEqual(103, savedSearch.ActionRssMaxResults, this.assertRoot + "#48");
Assert.AreEqual("30s", savedSearch.ActionRssMaxTime, this.assertRoot + "#49");
Assert.IsFalse(savedSearch.ActionRssTrackAlert, this.assertRoot + "#50");
Assert.AreEqual("63", savedSearch.ActionRssTtl, this.assertRoot + "#51");
Assert.AreEqual("$name4$", savedSearch.ActionScriptCommand, this.assertRoot + "#52");
Assert.AreEqual(ActionScriptFilename, savedSearch.ActionScriptFilename);
Assert.AreEqual("dummy4.host.com", savedSearch.ActionScriptHostname, this.assertRoot + "#53");
Assert.AreEqual(104, savedSearch.ActionScriptMaxResults, this.assertRoot + "#54");
Assert.AreEqual("40s", savedSearch.ActionScriptMaxTime, this.assertRoot + "#55");
Assert.IsFalse(savedSearch.ActionScriptTrackAlert, this.assertRoot + "#56");
Assert.AreEqual("64", savedSearch.ActionScriptTtl, this.assertRoot + "#57");
Assert.AreEqual("default", savedSearch.ActionSummaryIndexName, this.assertRoot + "#58");
Assert.AreEqual("$name5$", savedSearch.ActionSummaryIndexCommand, this.assertRoot + "#59");
Assert.AreEqual("dummy5.host.com", savedSearch.ActionSummaryIndexHostname, this.assertRoot + "#60");
Assert.IsFalse(savedSearch.ActionSummaryIndexInline, this.assertRoot + "#61");
Assert.AreEqual(105, savedSearch.ActionSummaryIndexMaxResults, this.assertRoot + "#62");
Assert.AreEqual("50s", savedSearch.ActionSummaryIndexMaxTime, this.assertRoot + "#63");
Assert.IsFalse(savedSearch.ActionSummaryIndexTrackAlert, this.assertRoot + "#64");
Assert.AreEqual("65", savedSearch.ActionSummaryIndexTtl, this.assertRoot + "#65");
// Delete the saved search - using alternative method
savedSearch.Remove();
savedSearches.Refresh();
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#66");
}
public async Task SavedSearchHistory()
{
using (var service = this.Connect())
{
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = await service.GetSavedSearchesAsync(
new SavedSearchCollectionArgs { Count = 0 });
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
await service.RemoveSavedSearchAsync(savedSearchTitle);
await savedSearches.GetAsync();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
SavedSearch savedSearch = await service.CreateSavedSearchAsync(savedSearchTitle,
new SavedSearchAttributes()
{
Search = search
});
// Clear the history - even though we have a newly create saved search
// it's possible there was a previous saved search with the same name
// that had a matching history.
JobCollection history = await savedSearch.GetHistoryAsync();
foreach (Job job in history)
{
await job.CancelAsync();
}
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
Job job1 = await savedSearch.DispatchAsync();
this.Ready(job1);
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));
Job job2 = await savedSearch.DispatchAsync();
this.Ready(job2);
history = await savedSearch.GetHistoryAsync();
Assert.Equal(2, history.Count);
Assert.True(history.Any(a => a.Sid == job1.Sid));
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job1.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(1, history.Count);
Assert.True(history.Any(a => a.Sid == job2.Sid));
await job2.CancelAsync();
history = await savedSearch.GetHistoryAsync();
Assert.Equal(0, history.Count);
//// Delete the saved search
await service.RemoveSavedSearchAsync("sdk-test1");
await savedSearches.GetAsync();
Assert.False(savedSearches.Any(a => a.Name == "sdk-test1"));
}
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch =
service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes()
{
Search = search
}).Result;
// Dispatch the saved search and wait for results.
Job job = savedSearch.DispatchAsync().Result;
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchBuckets = 100
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Dispatch with some additional search options
job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
{
DispatchEarliestTime = "aaaa"
}).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();
if (this.VersionCompare(service, "6.0") < 0)
{
savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
}
//// Same as the previous dispatch except using custom arg
job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result;
this.Wait(job);
//job.Timeline().Close();
job.CancelAsync().Wait();
// Delete the saved search
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}
public void SavedSearchesCRUD()
{
Service service = this.Connect();
string savedSearchTitle = "sdk-test1";
SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;
// Ensure test starts in a known good state
if (savedSearches.Any(a => a.Name == savedSearchTitle))
{
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
}
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
SavedSearch savedSearch;
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
//savedSearches.Create("sdk-test1", search);
SavedSearchAttributes attrs = new SavedSearchAttributes()
{
Search = search
};
service.CreateSavedSearchAsync(savedSearchTitle, attrs).Wait();
savedSearches.GetAsync().Wait();
Assert.True(savedSearches.Any(a => a.Name == savedSearchTitle));
// Read the saved search
//savedSearch = savedSearches.Get("sdk-test1");
savedSearch = savedSearches.Where(a => a.Name == savedSearchTitle).SingleOrDefault();
Assert.True(savedSearch.IsVisible);
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
savedSearch.UpdateAsync(new SavedSearchAttributes()
{
IsVisible = false
}, null, null).Wait();
//savedSearch.Refresh();
Assert.False(savedSearch.IsVisible);
// Delete the saved search
//savedSearches.("sdk-test1");
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
// Create a saved search with some additional arguments
//savedSearch = savedSearches.Create("sdk-test1", search, new Args("is_visible", false));
savedSearch =
service.CreateSavedSearchAsync(
savedSearchTitle,
new SavedSearchAttributes()
{
Search = search, IsVisible = false
}).Result;
Assert.False(savedSearch.IsVisible);
// set email params
attrs = new SavedSearchAttributes();
//attrs.ActionEmailAuthPassword = "******";
//attrs.ActionEmailAuthUsername = "******";
attrs.ActionEmailBcc = "*****@*****.**";
attrs.ActionEmailCC = "*****@*****.**";
attrs.ActionEmailCommand = "$name1$";
attrs.ActionEmailFormat = EmailFormat.Plain;
attrs.ActionEmailFrom = "*****@*****.**";
//attrs.ActionEmailHostname = "dummy1.host.com";
attrs.ActionEmailInline = "true";
attrs.ActionEmailMailServer = "splunk.com";
attrs.ActionEmailMaxResults = 101;
attrs.ActionEmailMaxTime = "10s";
attrs.ActionEmailSendPdf = true; //??ActionEmailPdfView = "dummy";
attrs.ActionEmailSendResults = true; //??ActionEmailPreProcessResults = "*";
attrs.ActionEmailReportPaperOrientation = PaperOrientation.Landscape;
attrs.ActionEmailReportPaperSize = PaperSize.Letter;
attrs.ActionEmailReportServerEnabled = false;
//attrs.ActionEmailReportServerUrl = "splunk.com";
attrs.ActionEmailSendPdf = false;
attrs.ActionEmailSendResults = false;
attrs.ActionEmailSubject = "sdk-subject";
attrs.ActionEmailTo = "*****@*****.**";
attrs.ActionEmailTrackAlert = false;
attrs.ActionEmailTtl = "61";
attrs.ActionEmailUseSsl = false;
attrs.ActionEmailUseTls = false;
attrs.ActionEmailWidthSortColumns = false;
attrs.ActionPopulateLookupCommand = "$name2$";
attrs.ActionPopulateLookupDestination = "dummypath";
attrs.ActionPopulateLookupHostname = "dummy2.host.com";
attrs.ActionPopulateLookupMaxResults = 102;
attrs.ActionPopulateLookupMaxTime = "20s";
attrs.ActionPopulateLookupTrackAlert = false;
attrs.ActionPopulateLookupTtl = "62";
attrs.ActionRssCommand = "$name3$";
//attrs.ActionRssHostname = "dummy3.host.com";
attrs.ActionRssMaxResults = 103;
attrs.ActionRssMaxTime = "30s";
attrs.ActionRssTrackAlert = "false";
attrs.ActionRssTtl = "63";
attrs.ActionScriptCommand = "$name4$";
const string ActionScriptFilename = "action_script_filename";
attrs.ActionScriptFileName = ActionScriptFilename;
attrs.ActionScriptHostname = "dummy4.host.com";
attrs.ActionScriptMaxResults = 104;
attrs.ActionScriptMaxTime = "40s";
attrs.ActionScriptTrackAlert = false;
attrs.ActionScriptTtl = "64";
attrs.ActionSummaryIndexName = "default";
attrs.ActionSummaryIndexCommand = "$name5$";
//attrs.ActionSummaryIndexHostname = "dummy5.host.com";
attrs.ActionSummaryIndexInline = false;
attrs.ActionSummaryIndexMaxResults = 105;
attrs.ActionSummaryIndexMaxTime = "50s";
attrs.ActionSummaryIndexTrackAlert = false;
attrs.ActionSummaryIndexTtl = "65";
attrs.Actions = "rss,email,populate_lookup,script,summary_index";
attrs.Search = search;
savedSearch.UpdateAsync(attrs, null, null).Wait();
// check
Assert.True(savedSearch.Actions.Email != null); //IsActionEmail));
Assert.True(savedSearch.Actions.PopulateLookup != null);
Assert.True(savedSearch.Actions.Rss != null);
Assert.True(savedSearch.Actions.Script != null);
Assert.True(savedSearch.Actions.SummaryIndex != null);
//Assert.Equal("sdk-password", savedSearch.Actions.Email.AuthPassword);
//Assert.Equal("sdk-username", savedSearch.Actions.Email.AuthUsername);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.Bcc);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.CC);
Assert.Equal("$name1$", savedSearch.Actions.Email.Command);
Assert.Equal(EmailFormat.Plain, savedSearch.Actions.Email.Format);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.From);
//Assert.Equal("dummy1.host.com", savedSearch.Actions.Email.Hostname);
Assert.True(savedSearch.Actions.Email.Inline);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.MailServer);
Assert.Equal(101, savedSearch.Actions.Email.MaxResults);
Assert.Equal("10s", savedSearch.Actions.Email.MaxTime);
//Assert.Equal("dummy", savedSearch.Actions.Email.PdfView);
//Assert.Equal("*", savedSearch.Actions.Email.PreProcessResults);
Assert.Equal(PaperOrientation.Landscape, savedSearch.Actions.Email.ReportPaperOrientation);
Assert.Equal(PaperSize.Letter, savedSearch.Actions.Email.ReportPaperSize);
Assert.False(savedSearch.Actions.Email.ReportServerEnabled);
//Assert.Equal("splunk.com", savedSearch.Actions.Email.ReportServerUrl);
Assert.False(savedSearch.Actions.Email.SendPdf);
Assert.False(savedSearch.Actions.Email.SendResults);
Assert.Equal("sdk-subject", savedSearch.Actions.Email.Subject);
Assert.Equal("*****@*****.**", savedSearch.Actions.Email.To);
Assert.False(savedSearch.Actions.Email.TrackAlert);
Assert.Equal("61", savedSearch.Actions.Email.Ttl);
Assert.False(savedSearch.Actions.Email.UseSsl);
Assert.False(savedSearch.Actions.Email.UseTls);
Assert.False(savedSearch.Actions.Email.WidthSortColumns);
Assert.Equal("$name2$", savedSearch.Actions.PopulateLookup.Command);
Assert.Equal("dummypath", savedSearch.Actions.PopulateLookup.Destination);
Assert.Equal("dummy2.host.com", savedSearch.Actions.PopulateLookup.Hostname);
Assert.Equal(102, savedSearch.Actions.PopulateLookup.MaxResults);
Assert.Equal("20s", savedSearch.Actions.PopulateLookup.MaxTime);
Assert.False(savedSearch.Actions.PopulateLookup.TrackAlert);
Assert.Equal("62", savedSearch.Actions.PopulateLookup.Ttl);
Assert.Equal("$name3$", savedSearch.Actions.Rss.Command);
//Assert.Equal("dummy3.host.com", savedSearch.Actions.Rss.Hostname);
Assert.Equal(103, savedSearch.Actions.Rss.MaxResults);
Assert.Equal("30s", savedSearch.Actions.Rss.MaxTime);
Assert.False(savedSearch.Actions.Rss.TrackAlert);
Assert.Equal("63", savedSearch.Actions.Rss.Ttl);
Assert.Equal("$name4$", savedSearch.Actions.Script.Command);
Assert.Equal(ActionScriptFilename, savedSearch.Actions.Script.FileName);
Assert.Equal("dummy4.host.com", savedSearch.Actions.Script.Hostname);
Assert.Equal(104, savedSearch.Actions.Script.MaxResults);
Assert.Equal("40s", savedSearch.Actions.Script.MaxTime);
Assert.False(savedSearch.Actions.Script.TrackAlert);
Assert.Equal("64", savedSearch.Actions.Script.Ttl);
Assert.Equal("default", savedSearch.Actions.SummaryIndex.Name);
Assert.Equal("$name5$", savedSearch.Actions.SummaryIndex.Command);
//Assert.Equal("dummy5.host.com", savedSearch.Actions.SummaryIndex.Hostname);
Assert.False(savedSearch.Actions.SummaryIndex.Inline);
Assert.Equal(105, savedSearch.Actions.SummaryIndex.MaxResults);
Assert.Equal("50s", savedSearch.Actions.SummaryIndex.MaxTime);
Assert.False(savedSearch.Actions.SummaryIndex.TrackAlert);
Assert.Equal("65", savedSearch.Actions.SummaryIndex.Ttl);
// Delete the saved search - using alternative method
service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
savedSearches.GetAsync().Wait();
Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
}