/// <summary> /// Returns the input stream I/O handle for the preview results from /// this job, adding optional parameters. /// </summary> /// <param name="args">The optional parameters.</param> /// <returns>The preview results input <see cref="Stream"/> I/O /// handle.</returns> public Stream ResultsPreview(JobResultsPreviewArgs args) { return this.ResultsPreview((Args) args); }
/// <summary> /// The main program /// </summary> /// <param name="argv">The command line arguments</param> public static void Main(string[] argv) { Command cli = Command.Splunk("search_realtime"); cli.AddRule("search", typeof(string), "search string"); cli.Parse(argv); if (!cli.Opts.ContainsKey("search")) { System.Console.WriteLine( "Search query string required, use --search=\"query\""); Environment.Exit(1); } var service = Service.Connect(cli.Opts); // Realtime window is 5 minutes var queryArgs = new JobArgs { SearchMode = JobArgs.SearchModeEnum.Realtime, EarliestTime = "rt-5m", LatestTime = "rt", }; var job = service.GetJobs().Create( (string)cli.Opts["search"], queryArgs); var outputArgs = new JobResultsPreviewArgs { OutputMode = JobResultsPreviewArgs.OutputModeEnum.Xml, // Return all entries. Count = 0 }; for (var i = 0; i < 5; i++) { System.Console.WriteLine(); System.Console.WriteLine(); System.Console.WriteLine("Snapshot " + i + ":"); using (var stream = job.ResultsPreview(outputArgs)) { using(var rr = new ResultsReaderXml(stream)) { foreach (var @event in rr) { System.Console.WriteLine("EVENT:"); foreach (string key in @event.Keys) { System.Console.WriteLine( " " + key + " -> " + @event[key]); } } } } Thread.Sleep(500); } job.Cancel(); }
/// <summary> /// Returns the input stream I/O handle for the preview results from /// this job, adding optional parameters. /// </summary> /// <param name="args">The optional parameters.</param> /// <returns>The preview results input <see cref="Stream"/> I/O /// handle.</returns> public Stream ResultsPreview(JobResultsPreviewArgs args) { return(this.ResultsPreview((Args)args)); }