private static async Task Run(Service service) { await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password); string savedSearchName = "example_search"; string savedSearchQuery = "search index=_internal | head 10"; // Delete the saved search if it exists before we start. SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(savedSearchName); if (savedSearch != null) { await savedSearch.RemoveAsync(); } savedSearch = await service.SavedSearches.CreateAsync(savedSearchName, savedSearchQuery); Job savedSearchJob = await savedSearch.DispatchAsync(); using (SearchResultStream stream = await savedSearchJob.GetSearchResultsAsync()) { foreach (SearchResult result in stream) { Console.WriteLine(result); } } await savedSearch.RemoveAsync(); }
/// <summary> /// Asynchronously dispatches a <see cref="SavedSearch"/> just like the /// scheduler would. /// </summary> /// <param name="name"> /// The name of the <see cref="SavedSearch"/> to dispatch. /// </param> /// <param name="dispatchArgs"> /// A set of arguments to the dispatcher. /// </param> /// <param name="templateArgs"> /// A set of template arguments to the <see cref="SavedSearch"/>. /// </param> /// <returns> /// The search <see cref="Job"/> that was dispatched. /// </returns> /// <remarks> /// This method uses the <a href="http://goo.gl/AfzBJO">POST /// saved/searches/{name}/dispatch</a> endpoint to dispatch the <see /// cref="SavedSearch"/> identified by <see cref="name"/>. /// </remarks> public async Task<Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null, SavedSearchTemplateArgs templateArgs = null) { var savedSearch = new SavedSearch(this.Context, this.Namespace, name); var job = await savedSearch.DispatchAsync(dispatchArgs, templateArgs); return job; }
public async Task SavedSearchHistory() { using (var service = await SdkHelper.CreateService()) { const string name = "sdk-test_SavedSearchHistory"; const string search = "search index=sdk-tests * earliest=-1m"; SavedSearchCollection savedSearches = service.SavedSearches; await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter { Count = 0, SortDirection = SortDirection.Descending }); SavedSearch savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name); if (savedSearch != null) { await savedSearch.RemoveAsync(); } // Create a saved search savedSearch = await savedSearches.CreateAsync(name, search); // Clear the history - even though we have a newly create saved search // it's possible there was a previous saved search with the same name // that had a matching history. JobCollection history = await savedSearch.GetHistoryAsync(); foreach (Job job in history) { await job.CancelAsync(); } history = await savedSearch.GetHistoryAsync(); Assert.Equal(0, history.Count); Job job1 = await savedSearch.DispatchAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(1, history.Count); Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid)); Job job2 = await savedSearch.DispatchAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(2, history.Count); Assert.True(history.Any(a => a.Sid == job1.Sid)); Assert.True(history.Any(a => a.Sid == job2.Sid)); await job1.CancelAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(1, history.Count); Assert.True(history.Any(a => a.Sid == job2.Sid)); await job2.CancelAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(0, history.Count); //// Delete the saved search await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter { Count = 0, SortDirection = SortDirection.Descending }); savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name); Assert.NotNull(savedSearch); await savedSearch.RemoveAsync(); savedSearch = await savedSearches.GetOrNullAsync(savedSearch.Name); Assert.Null(savedSearch); } }
public async Task SavedSearchDispatchProperties() { using (var service = await SdkHelper.CreateService()) { // Ensure correct start state SavedSearchCollection savedSearches = service.SavedSearches; string name = "sdk-test_DispatchProperties"; SavedSearch testSearch = await savedSearches.GetOrNullAsync(name); if (testSearch != null) { await testSearch.RemoveAsync(); } await savedSearches.GetAllAsync(); Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name)); // Create a saved search testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m"); // Dispatch the saved search with default arguments Job job = await testSearch.DispatchAsync(); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Dispatch with some additional search options job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Dispatch with some additional search options job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); var savedSearchTemplateArgs = new SavedSearchTemplateArgs( new Argument("action.email.authpassword ", "sdk-password"), new Argument("action.email.authusername ", "sdk-username"), new Argument("action.email.bcc ", "*****@*****.**"), new Argument("action.email.cc ", "*****@*****.**"), new Argument("action.email.command ", "$name1$"), new Argument("action.email.format ", "text"), new Argument("action.email.from ", "*****@*****.**"), new Argument("action.email.hostname ", "dummy1.host.com"), new Argument("action.email.inline ", "true"), new Argument("action.email.mailserver ", "splunk.com"), new Argument("action.email.maxresults ", "101"), new Argument("action.email.maxtime ", "10s"), new Argument("action.email.pdfview ", "dummy"), new Argument("action.email.reportpaperorientation ", "landscape"), new Argument("action.email.reportpapersize ", "letter"), new Argument("action.email.reportserverenabled ", "false"), new Argument("action.email.reportserverurl ", "splunk.com"), new Argument("action.email.sendpdf ", "false"), new Argument("action.email.sendresults ", "false"), new Argument("action.email.subject ", "sdk-subject"), new Argument("action.email.to ", "*****@*****.**"), new Argument("action.email.trackalert ", "false"), new Argument("action.email.ttl ", "61"), new Argument("action.email.usessl ", "false"), new Argument("action.email.usetls ", "false"), new Argument("action.email.widthsortcolumns ", "false"), new Argument("actions.populatelookup.command ", "$name2$"), new Argument("actions.populatelookup.dest ", "dummypath"), new Argument("actions.populatelookup.hostname ", "dummy2.host.com"), new Argument("actions.populatelookup.maxresults ", "102"), new Argument("actions.populatelookup.maxtime ", "20s"), new Argument("actions.populatelookup.trackalert ", "false"), new Argument("actions.populatelookup.ttl ", "62"), new Argument("actions.rss.command ", "$name3$"), new Argument("actions.rss.hostname ", "dummy3.host.com"), new Argument("actions.rss.maxresults ", "103"), new Argument("actions.rss.maxtime ", "30s"), new Argument("actions.rss.trackalert ", "false"), new Argument("actions.rss.ttl ", "63"), new Argument("actionscriptcommand ", "$name4$"), new Argument("actionscriptfilename ", "action_script_filename"), new Argument("actionscripthostname ", "dummy4.host.com"), new Argument("actionscriptmaxresults ", "104"), new Argument("actionscriptmaxtime ", "40s"), new Argument("actionscripttrackalert ", "false"), new Argument("actionscriptttl ", "64"), new Argument("actions.summaryindex.command ", "$name5$"), new Argument("actions.summaryindex.hostname ", "dummy5.host.com"), new Argument("actions.summaryindex.inline ", "false"), new Argument("actions.summaryindex.maxresults ", "105"), new Argument("actions.summaryindex.maxtime ", "50s"), new Argument("actions.summaryindex.trackalert ", "false"), new Argument("actions.summaryindex.ttl ", "65"), new Argument("actions ", "rss,email,populate_lookup,script,summary_index")); //// Same as the previous dispatch except using custom arg job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs); await job.TransitionAsync(DispatchState.Done); await job.CancelAsync(); // Delete the saved search await testSearch.RemoveAsync(); testSearch = await savedSearches.GetOrNullAsync(name); Assert.Null(testSearch); } }
public async Task SavedSearchHistory() { using (var service = this.Connect()) { string savedSearchTitle = "sdk-test1"; SavedSearchCollection savedSearches = await service.GetSavedSearchesAsync( new SavedSearchCollectionArgs { Count = 0 }); // Ensure test starts in a known good state if (savedSearches.Any(a => a.Name == savedSearchTitle)) { await service.RemoveSavedSearchAsync(savedSearchTitle); await savedSearches.GetAsync(); } Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); string search = "search index=sdk-tests * earliest=-1m"; // Create a saved search SavedSearch savedSearch = await service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }); // Clear the history - even though we have a newly create saved search // it's possible there was a previous saved search with the same name // that had a matching history. JobCollection history = await savedSearch.GetHistoryAsync(); foreach (Job job in history) { await job.CancelAsync(); } history = await savedSearch.GetHistoryAsync(); Assert.Equal(0, history.Count); Job job1 = await savedSearch.DispatchAsync(); this.Ready(job1); history = await savedSearch.GetHistoryAsync(); Assert.Equal(1, history.Count); Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid)); Job job2 = await savedSearch.DispatchAsync(); this.Ready(job2); history = await savedSearch.GetHistoryAsync(); Assert.Equal(2, history.Count); Assert.True(history.Any(a => a.Sid == job1.Sid)); Assert.True(history.Any(a => a.Sid == job2.Sid)); await job1.CancelAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(1, history.Count); Assert.True(history.Any(a => a.Sid == job2.Sid)); await job2.CancelAsync(); history = await savedSearch.GetHistoryAsync(); Assert.Equal(0, history.Count); //// Delete the saved search await service.RemoveSavedSearchAsync("sdk-test1"); await savedSearches.GetAsync(); Assert.False(savedSearches.Any(a => a.Name == "sdk-test1")); } }
public void SavedSearchDispatch() { Service service = this.Connect(); string savedSearchTitle = "sdk-test1"; SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result; // Ensure test starts in a known good state if (savedSearches.Any(a => a.Name == savedSearchTitle)) { service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); savedSearches.GetAsync().Wait(); } Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); // Create a saved search string search = "search index=sdk-tests * earliest=-1m"; SavedSearch savedSearch = service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes() { Search = search }).Result; // Dispatch the saved search and wait for results. Job job = savedSearch.DispatchAsync().Result; job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchBuckets = 100 }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Dispatch with some additional search options job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs() { DispatchEarliestTime = "aaaa" }).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs(); if (this.VersionCompare(service, "6.0") < 0) { savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password")); savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username")); savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$")); savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text")); savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com")); savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true")); savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101")); savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s")); savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape")); savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com")); savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject")); savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**")); savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61")); savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false")); savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62")); savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$")); savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103")); savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s")); savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63")); savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$")); savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename")); savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104")); savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s")); savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false")); savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65")); savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index")); } //// Same as the previous dispatch except using custom arg job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result; this.Wait(job); //job.Timeline().Close(); job.CancelAsync().Wait(); // Delete the saved search service.RemoveSavedSearchAsync(savedSearchTitle).Wait(); Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle)); }