public void SavedSearchHistory()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#69");
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
SavedSearch savedSearch = savedSearches.Create("sdk test1", search);
// Clear the history - even though we have a newly create saved search
// its possible there was a previous saved search with the same name
// that had a matching history.
Job[] history = savedSearch.History();
foreach (Job job in history)
{
job.Cancel();
}
history = savedSearch.History();
Assert.AreEqual(0, history.Length, this.assertRoot + "#70");
Job job1 = savedSearch.Dispatch();
this.Ready(job1);
history = savedSearch.History();
Assert.AreEqual(1, history.Length, this.assertRoot + "#71");
Assert.IsTrue(this.Contains(history, job1.Sid));
Job job2 = savedSearch.Dispatch();
this.Ready(job2);
history = savedSearch.History();
Assert.AreEqual(2, history.Length, this.assertRoot + "#72");
Assert.IsTrue(this.Contains(history, job1.Sid), this.assertRoot + "#73");
Assert.IsTrue(this.Contains(history, job2.Sid), this.assertRoot + "#74");
job1.Cancel();
history = savedSearch.History();
Assert.AreEqual(1, history.Length, this.assertRoot + "#75");
Assert.IsTrue(this.Contains(history, job2.Sid), this.assertRoot + "#76");
job2.Cancel();
history = savedSearch.History();
Assert.AreEqual(0, history.Length, this.assertRoot + "#77");
// Delete the saved search
savedSearches.Remove("sdk test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk test1"), this.assertRoot + "#78");
}
public void TestCreateAndRemoveSavedSearchInNamespace()
{
Service service = Connect();
String username1 = "sdk-user1";
String username2 = "sdk-user2";
String appname1 = "sdk-app1";
String appname2 = "sdk-app2";
// Set up the application and users
SetupApps(service.GetApplications(), appname1, appname2);
SetupUsers(service.GetUsers(), username1, username2);
// Namespaces
Args splunkNamespace11 = CreateNamespace(username1, appname1);
Args splunkNamespace22 = CreateNamespace(username2, appname2);
Args splunkNamespacex1 = CreateNamespace("-", appname1);
// Create namespace specific searches
SavedSearchCollection savedSearches11 = service.GetSavedSearches(splunkNamespace11);
SavedSearchCollection savedSearches22 = service.GetSavedSearches(splunkNamespace22);
SavedSearchCollection savedSearchesx1 = service.GetSavedSearches(splunkNamespacex1);
// Remove test search "sdk-test-search" if it already exists
if (savedSearches11.ContainsKey("sdk-test-search"))
{
savedSearches11.Remove("sdk-test-search");
}
if (savedSearches22.ContainsKey("sdk-test-search"))
{
savedSearches22.Remove("sdk-test-search");
}
Assert.IsFalse(savedSearches11.ContainsKey("sdk-test-search"),
"SavedSearches11 already contains sdk-test-search, remove");
Assert.IsFalse(savedSearches22.ContainsKey("sdk-test-search"),
"SavedSearches22 already contains sdk-test-search, remove");
// Create test search
savedSearches11.Create("sdk-test-search", "search * | head 1");
savedSearches22.Create("sdk-test-search", "search * | head 2");
Assert.IsTrue(savedSearches11.ContainsKey("sdk-test-search"),
"Expected savedSearches11 to contain the key sdk-test-search");
Assert.IsTrue(savedSearches22.ContainsKey("sdk-test-search"),
"Expected savedSearches22 to contain the key sdk-test-search");
Assert.IsTrue(savedSearchesx1.ContainsKey("sdk-test-search", splunkNamespace11),
"Expected savedSearchesx1 to contain sdk-test-search in the namespace splunkNamespace11");
Assert.IsTrue(savedSearchesx1.Get("sdk-test-search", splunkNamespace11) != null,
"Expected savedSearchesx1 to have the test sdk-test-search for splunkNameSpace11");
// Remove a saved search through a specific namespace path
savedSearchesx1.Remove("sdk-test-search", splunkNamespace11);
Assert.IsFalse(savedSearchesx1.ContainsKey("sdk-test-search"),
"Expected the saved search sdk-test-search to be removed");
// Clean up applications and users
CleanupApps(service.GetApplications(), appname1, appname2);
CleanupUsers(service.GetUsers(), username1, username2);
}
public void TestLiveNamespace1()
{
Service service = Connect();
String username = "******";
String password = "******";
String savedSearch = "sdk-test1";
String searchString = "search index=main * | 10";
// Setup a namespace
Args splunkNameSpace = new Args();
splunkNameSpace.Add("owner", username);
splunkNameSpace.Add("app", "search");
// Get all users, scrub and make our test user
UserCollection users = service.GetUsers();
if (users.ContainsKey(username))
{
users.Remove(username);
}
Assert.IsFalse(users.ContainsKey(username), "Expected users to not contain: " + username);
users.Create(username, password, "user");
Assert.IsTrue(users.ContainsKey(username), "Expected users to contain: " + username);
// Get saved searches for our new namespace, scrub and make our test saved searches
SavedSearchCollection savedSearches = service.GetSavedSearches(splunkNameSpace);
if (savedSearches.ContainsKey(savedSearch))
{
savedSearches.Remove(savedSearch);
}
Assert.IsFalse(savedSearches.ContainsKey(savedSearch), "Expected the saved search to not contain " + savedSearch);
}
public void SavedSearchDispatch()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#67");
// Create a saved search
Job job;
string search = "search index=sdk-tests * earliest=-1m";
SavedSearch savedSearch = savedSearches.Create("sdk-test1", search);
// Dispatch the saved search and wait for results.
job = savedSearch.Dispatch();
this.Wait(job);
job.Results().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.buckets", 100));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Dispatch with some additional search options
job = savedSearch.Dispatch(new Args("dispatch.earliest_time", "aaaa"));
this.Wait(job);
job.Timeline().Close();
job.Cancel();
var savedSearchDispatchArgs = new SavedSearchDispatchArgs();
savedSearchDispatchArgs.ActionEmailAuthPassword = "******";
savedSearchDispatchArgs.ActionEmailAuthUsername = "******";
savedSearchDispatchArgs.ActionEmailBcc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCc = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailCommand = "$name1$";
savedSearchDispatchArgs.ActionEmailFormat = "text";
savedSearchDispatchArgs.ActionEmailFrom = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailHostname = "dummy1.host.com";
savedSearchDispatchArgs.ActionEmailInline = true;
savedSearchDispatchArgs.ActionEmailMailServer = "splunk.com";
savedSearchDispatchArgs.ActionEmailMaxResults = 101;
savedSearchDispatchArgs.ActionEmailMaxTime = "10s";
savedSearchDispatchArgs.ActionEmailPdfView = "dummy";
savedSearchDispatchArgs.ActionEmailReportPaperOrientation = "landscape";
savedSearchDispatchArgs.ActionEmailReportPaperSize = "letter";
savedSearchDispatchArgs.ActionEmailReportServerEnabled = false;
savedSearchDispatchArgs.ActionEmailReportServerUrl = "splunk.com";
savedSearchDispatchArgs.ActionEmailSendPdf = false;
savedSearchDispatchArgs.ActionEmailSendResults = false;
savedSearchDispatchArgs.ActionEmailSubject = "sdk-subject";
savedSearchDispatchArgs.ActionEmailTo = "*****@*****.**";
savedSearchDispatchArgs.ActionEmailTrackAlert = false;
savedSearchDispatchArgs.ActionEmailTtl = "61";
savedSearchDispatchArgs.ActionEmailUseSsl = false;
savedSearchDispatchArgs.ActionEmailUseTls = false;
savedSearchDispatchArgs.ActionEmailWidthSortColumns = false;
savedSearchDispatchArgs.ActionPopulateLookupCommand = "$name2$";
savedSearchDispatchArgs.ActionPopulateLookupDest = "dummypath";
savedSearchDispatchArgs.ActionPopulateLookupHostname = "dummy2.host.com";
savedSearchDispatchArgs.ActionPopulateLookupMaxResults = 102;
savedSearchDispatchArgs.ActionPopulateLookupMaxTime = "20s";
savedSearchDispatchArgs.ActionPopulateLookupTrackAlert = false;
savedSearchDispatchArgs.ActionPopulateLookupTtl = "62";
savedSearchDispatchArgs.ActionRssCommand = "$name3$";
savedSearchDispatchArgs.ActionRssHostname = "dummy3.host.com";
savedSearchDispatchArgs.ActionRssMaxResults = 103;
savedSearchDispatchArgs.ActionRssMaxTime = "30s";
savedSearchDispatchArgs.ActionRssTrackAlert = false;
savedSearchDispatchArgs.ActionRssTtl = "63";
savedSearchDispatchArgs.ActionScriptCommand = "$name4$";
savedSearchDispatchArgs.ActionScriptFilename = "action_script_filename";
savedSearchDispatchArgs.ActionScriptHostname = "dummy4.host.com";
savedSearchDispatchArgs.ActionScriptMaxResults = 104;
savedSearchDispatchArgs.ActionScriptMaxTime = "40s";
savedSearchDispatchArgs.ActionScriptTrackAlert = false;
savedSearchDispatchArgs.ActionScriptTtl = "64";
savedSearchDispatchArgs.ActionSummaryIndexCommand = "$name5$";
savedSearchDispatchArgs.ActionSummaryIndexHostname = "dummy5.host.com";
savedSearchDispatchArgs.ActionSummaryIndexInline = false;
savedSearchDispatchArgs.ActionSummaryIndexMaxResults = 105;
savedSearchDispatchArgs.ActionSummaryIndexMaxTime = "50s";
savedSearchDispatchArgs.ActionSummaryIndexTrackAlert = false;
savedSearchDispatchArgs.ActionSummaryIndexTtl = "65";
savedSearchDispatchArgs.Actions = "rss,email,populate_lookup,script,summary_index";
// Same as the previous dispatch except using custom arg
job = savedSearch.Dispatch(savedSearchDispatchArgs);
this.Wait(job);
job.Timeline().Close();
job.Cancel();
// Delete the saved search
savedSearches.Remove("sdk-test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#68");
}
public void SavedSearchesCRUD()
{
Service service = this.Connect();
SavedSearchCollection savedSearches = service.GetSavedSearches();
// Ensure test starts in a known good state
if (savedSearches.ContainsKey("sdk-test1"))
{
savedSearches.Remove("sdk-test1");
}
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#1");
SavedSearch savedSearch;
string search = "search index=sdk-tests * earliest=-1m";
// Create a saved search
savedSearches.Create("sdk-test1", search);
Assert.IsTrue(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#2");
// Read the saved search
savedSearch = savedSearches.Get("sdk-test1");
Assert.IsTrue(savedSearch.IsVisible, this.assertRoot + "#3");
// CONSIDER: Test some additinal default property values.
// Update search properties, but don't specify required args to test
// pulling them from the existing object
savedSearch.Update(new Args("is_visible", false));
savedSearch.Refresh();
Assert.IsFalse(savedSearch.IsVisible, this.assertRoot + "#4");
// Delete the saved search
savedSearches.Remove("sdk-test1");
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#5");
// Create a saved search with some additional arguments
savedSearch = savedSearches.Create("sdk-test1", search, new Args("is_visible", false));
Assert.IsFalse(savedSearch.IsVisible, this.assertRoot + "#6");
// set email params
savedSearch.ActionEmailAuthPassword = "******";
savedSearch.ActionEmailAuthUsername = "******";
savedSearch.ActionEmailBcc = "*****@*****.**";
savedSearch.ActionEmailCc = "*****@*****.**";
savedSearch.ActionEmailCommand = "$name1$";
savedSearch.ActionEmailFormat = "text";
savedSearch.ActionEmailFrom = "*****@*****.**";
savedSearch.ActionEmailHostname = "dummy1.host.com";
savedSearch.ActionEmailInline = true;
savedSearch.ActionEmailMailServer = "splunk.com";
savedSearch.ActionEmailMaxResults = 101;
savedSearch.ActionEmailMaxTime = "10s";
savedSearch.ActionEmailPdfView = "dummy";
savedSearch.ActionEmailPreProcessResults = "*";
savedSearch.ActionEmailReportPaperOrientation = "landscape";
savedSearch.ActionEmailReportPaperSize = "letter";
savedSearch.ActionEmailReportServerEnabled = false;
savedSearch.ActionEmailReportServerUrl = "splunk.com";
savedSearch.ActionEmailSendPdf = false;
savedSearch.ActionEmailSendResults = false;
savedSearch.ActionEmailSubject = "sdk-subject";
savedSearch.ActionEmailTo = "*****@*****.**";
savedSearch.ActionEmailTrackAlert = false;
savedSearch.ActionEmailTtl = "61";
savedSearch.ActionEmailUseSsl = false;
savedSearch.ActionEmailUseTls = false;
savedSearch.ActionEmailWidthSortColumns = false;
savedSearch.ActionPopulateLookupCommand = "$name2$";
savedSearch.ActionPopulateLookupDest = "dummypath";
savedSearch.ActionPopulateLookupHostname = "dummy2.host.com";
savedSearch.ActionPopulateLookupMaxResults = 102;
savedSearch.ActionPopulateLookupMaxTime = "20s";
savedSearch.ActionPopulateLookupTrackAlert = false;
savedSearch.ActionPopulateLookupTtl = "62";
savedSearch.ActionRssCommand = "$name3$";
savedSearch.ActionRssHostname = "dummy3.host.com";
savedSearch.ActionRssMaxResults = 103;
savedSearch.ActionRssMaxTime = "30s";
savedSearch.ActionRssTrackAlert = false;
savedSearch.ActionRssTtl = "63";
savedSearch.ActionScriptCommand = "$name4$";
const string ActionScriptFilename = "action_script_filename";
savedSearch.ActionScriptFilename = ActionScriptFilename;
savedSearch.ActionScriptHostname = "dummy4.host.com";
savedSearch.ActionScriptMaxResults = 104;
savedSearch.ActionScriptMaxTime = "40s";
savedSearch.ActionScriptTrackAlert = false;
savedSearch.ActionScriptTtl = "64";
savedSearch.ActionSummaryIndexName = "default";
savedSearch.ActionSummaryIndexCommand = "$name5$";
savedSearch.ActionSummaryIndexHostname = "dummy5.host.com";
savedSearch.ActionSummaryIndexInline = false;
savedSearch.ActionSummaryIndexMaxResults = 105;
savedSearch.ActionSummaryIndexMaxTime = "50s";
savedSearch.ActionSummaryIndexTrackAlert = false;
savedSearch.ActionSummaryIndexTtl = "65";
savedSearch.Actions = "rss,email,populate_lookup,script,summary_index";
savedSearch.Search = search;
savedSearch.Update();
// check
Assert.IsTrue(savedSearch.IsActionEmail, this.assertRoot + "#7");
Assert.IsTrue(savedSearch.IsActionPopulateLookup, this.assertRoot + "#8");
Assert.IsTrue(savedSearch.IsActionRss, this.assertRoot + "#9");
Assert.IsTrue(savedSearch.IsActionScript, this.assertRoot + "#10");
Assert.IsTrue(savedSearch.IsActionSummaryIndex, this.assertRoot + "#11");
Assert.AreEqual("sdk-password", savedSearch.ActionEmailAuthPassword, this.assertRoot + "#12");
Assert.AreEqual("sdk-username", savedSearch.ActionEmailAuthUsername, this.assertRoot + "#13");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailBcc, this.assertRoot + "#14");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailCc, this.assertRoot + "#15");
Assert.AreEqual("$name1$", savedSearch.ActionEmailCommand, this.assertRoot + "#16");
Assert.AreEqual("text", savedSearch.ActionEmailFormat, this.assertRoot + "#17");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailFrom, this.assertRoot + "#18");
Assert.AreEqual("dummy1.host.com", savedSearch.ActionEmailHostname, this.assertRoot + "#19");
Assert.IsTrue(savedSearch.ActionEmailInline, this.assertRoot + "#20");
Assert.AreEqual("splunk.com", savedSearch.ActionEmailMailServer, this.assertRoot + "#21");
Assert.AreEqual(101, savedSearch.ActionEmailMaxResults, this.assertRoot + "#22");
Assert.AreEqual("10s", savedSearch.ActionEmailMaxTime, this.assertRoot + "#23");
Assert.AreEqual("dummy", savedSearch.ActionEmailPdfView, this.assertRoot + "#24");
Assert.AreEqual("*", savedSearch.ActionEmailPreProcessResults, this.assertRoot + "#25");
Assert.AreEqual("landscape", savedSearch.ActionEmailReportPaperOrientation, this.assertRoot + "#26");
Assert.AreEqual("letter", savedSearch.ActionEmailReportPaperSize, this.assertRoot + "#27");
Assert.IsFalse(savedSearch.ActionEmailReportServerEnabled, this.assertRoot + "#28");
Assert.AreEqual("splunk.com", savedSearch.ActionEmailReportServerUrl, this.assertRoot + "#29");
Assert.IsFalse(savedSearch.ActionEmailSendPdf, this.assertRoot + "#30");
Assert.IsFalse(savedSearch.ActionEmailSendResults, this.assertRoot + "#31");
Assert.AreEqual("sdk-subject", savedSearch.ActionEmailSubject, this.assertRoot + "#32");
Assert.AreEqual("*****@*****.**", savedSearch.ActionEmailTo, this.assertRoot + "#33");
Assert.IsFalse(savedSearch.ActionEmailTrackAlert, this.assertRoot + "#34");
Assert.AreEqual("61", savedSearch.ActionEmailTtl, this.assertRoot + "#35");
Assert.IsFalse(savedSearch.ActionEmailUseSsl, this.assertRoot + "#36");
Assert.IsFalse(savedSearch.ActionEmailUseTls, this.assertRoot + "#37");
Assert.IsFalse(savedSearch.ActionEmailWidthSortColumns, this.assertRoot + "#38");
Assert.AreEqual("$name2$", savedSearch.ActionPopulateLookupCommand, this.assertRoot + "#39");
Assert.AreEqual("dummypath", savedSearch.ActionPopulateLookupDest, this.assertRoot + "#40");
Assert.AreEqual("dummy2.host.com", savedSearch.ActionPopulateLookupHostname, this.assertRoot + "#41");
Assert.AreEqual(102, savedSearch.ActionPopulateLookupMaxResults, this.assertRoot + "#42");
Assert.AreEqual("20s", savedSearch.ActionPopulateLookupMaxTime, this.assertRoot + "#43");
Assert.IsFalse(savedSearch.ActionPopulateLookupTrackAlert, this.assertRoot + "#44");
Assert.AreEqual("62", savedSearch.ActionPopulateLookupTtl, this.assertRoot + "#45");
Assert.AreEqual("$name3$", savedSearch.ActionRssCommand, this.assertRoot + "#46");
Assert.AreEqual("dummy3.host.com", savedSearch.ActionRssHostname, this.assertRoot + "#47");
Assert.AreEqual(103, savedSearch.ActionRssMaxResults, this.assertRoot + "#48");
Assert.AreEqual("30s", savedSearch.ActionRssMaxTime, this.assertRoot + "#49");
Assert.IsFalse(savedSearch.ActionRssTrackAlert, this.assertRoot + "#50");
Assert.AreEqual("63", savedSearch.ActionRssTtl, this.assertRoot + "#51");
Assert.AreEqual("$name4$", savedSearch.ActionScriptCommand, this.assertRoot + "#52");
Assert.AreEqual(ActionScriptFilename, savedSearch.ActionScriptFilename);
Assert.AreEqual("dummy4.host.com", savedSearch.ActionScriptHostname, this.assertRoot + "#53");
Assert.AreEqual(104, savedSearch.ActionScriptMaxResults, this.assertRoot + "#54");
Assert.AreEqual("40s", savedSearch.ActionScriptMaxTime, this.assertRoot + "#55");
Assert.IsFalse(savedSearch.ActionScriptTrackAlert, this.assertRoot + "#56");
Assert.AreEqual("64", savedSearch.ActionScriptTtl, this.assertRoot + "#57");
Assert.AreEqual("default", savedSearch.ActionSummaryIndexName, this.assertRoot + "#58");
Assert.AreEqual("$name5$", savedSearch.ActionSummaryIndexCommand, this.assertRoot + "#59");
Assert.AreEqual("dummy5.host.com", savedSearch.ActionSummaryIndexHostname, this.assertRoot + "#60");
Assert.IsFalse(savedSearch.ActionSummaryIndexInline, this.assertRoot + "#61");
Assert.AreEqual(105, savedSearch.ActionSummaryIndexMaxResults, this.assertRoot + "#62");
Assert.AreEqual("50s", savedSearch.ActionSummaryIndexMaxTime, this.assertRoot + "#63");
Assert.IsFalse(savedSearch.ActionSummaryIndexTrackAlert, this.assertRoot + "#64");
Assert.AreEqual("65", savedSearch.ActionSummaryIndexTtl, this.assertRoot + "#65");
// Delete the saved search - using alternative method
savedSearch.Remove();
savedSearches.Refresh();
Assert.IsFalse(savedSearches.ContainsKey("sdk-test1"), this.assertRoot + "#66");
}