diff --git a/.classpath b/.classpath index 7932b0db..283aacef 100644 --- a/.classpath +++ b/.classpath @@ -1,20 +1,10 @@ - - - - - - - - - - - + + - @@ -32,6 +22,9 @@ + + + diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 00000000..d008e42b --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,42 @@ +on: + release: + types: [published] + +permissions: + contents: write + +name: Release + +jobs: + build: + name: Java SDK Release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - name: Set up JDK 1.8 + uses: actions/setup-java@v1 + with: + java-version: 1.8 + server-username: MAVEN_USERNAME + server-password: MAVEN_PASSWORD + server-id: splunk-artifactory + - name: build + run: mvn package --file pom.xml -DskipTests=true + - name: Create GitHub Release + uses: softprops/action-gh-release@v1 + with: + files: ./splunk/target/*.jar + draft: true + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Deploy to Artifactory + run: mvn --batch-mode deploy -DskipTests=true + env: + MAVEN_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }} + MAVEN_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }} + + - name: Upload Artifact + uses: actions/upload-artifact@v3 + with: + name: java_sdk_docs + path: splunk/target/apidocs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 00000000..84ca35c8 --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,66 @@ +name: Java SDK Test + +on: + [push, pull_request] + +jobs: + test: + strategy: + fail-fast: false + matrix: + os: + - ubuntu-latest + java-version: + - 1.8 + splunk-version: + - "8.2" + - "latest" + runs-on: ${{ matrix.os }} + + services: + splunk: + image: splunk/splunk:${{matrix.splunk-version}} + env: + SPLUNK_START_ARGS: --accept-license + SPLUNK_PASSWORD: changed! + TEST_TCP_PORT: 10667 + TEST_UDP_PORT: 10668 + SPLUNK_HOME: "/opt/splunk" + SPLUNK_APPS_URL: https://github.com/splunk/sdk-app-collection/releases/download/v1.1.0/sdkappcollection.tgz + ports: + - 8000:8000 + - 8089:8089 + - 8088:8088 + - 10667:10667 + - 10668:10668/udp + + steps: + - uses: actions/checkout@v2 + - name: Set up JDK + uses: actions/setup-java@v1 + with: + java-version: 1.8 + + - name: Cache local Maven repository + uses: actions/cache@v2 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: ${{ runner.os }}-maven- + + - name: Create .splunkrc file + run: | + cd ~ + echo host=localhost >> .splunkrc + echo port=8089 >> .splunkrc + echo username=admin >> .splunkrc + echo password=changed! >> .splunkrc + echo scheme=https >> .splunkrc + echo version=${{ matrix.splunk }} >> .splunkrc + + - name: Test using maven + run: mvn test -fae + env: + SPLUNK_HOME: "/opt/splunk" + TEST_TCP_PORT: 10667 + TEST_UDP_PORT: 10668 diff --git a/.gitignore b/.gitignore index 7368135c..0f808f1f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,10 +1,38 @@ +# Java *.class + +# Mac OS X *.DS_Store* -*.swp + +# Generated directories +build +dist +out +target/ + +# Test & Coverage +TEST-com.splunk.*.xml + +# IntelliJ .idea/workspace.xml +.idea/misc.xml +.idea/ + +# Unknown +*.swp +*.properties .settings bin -build build.log -dist -out + +# Visual Studio +Debug +Release +launchers/shim/Release +launchers/shim/shim/Release +launchers/shim/x64 +launchers/shim/ipch/* +launchers/shim/shim.opensdf + + + diff --git a/.idea/ant.xml b/.idea/ant.xml deleted file mode 100644 index 4674eeac..00000000 --- a/.idea/ant.xml +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/.idea/codeStyleSettings.xml b/.idea/codeStyleSettings.xml new file mode 100644 index 00000000..9178b389 --- /dev/null +++ b/.idea/codeStyleSettings.xml @@ -0,0 +1,13 @@ + + + + + + + diff --git a/.idea/compiler.xml b/.idea/compiler.xml index a1b41c52..46a0de13 100644 --- a/.idea/compiler.xml +++ b/.idea/compiler.xml @@ -14,8 +14,15 @@ + + + - + + + + + diff --git a/.idea/copyright/profiles_settings.xml b/.idea/copyright/profiles_settings.xml index 3572571a..e7bedf33 100644 --- a/.idea/copyright/profiles_settings.xml +++ b/.idea/copyright/profiles_settings.xml @@ -1,5 +1,3 @@ - - - + \ No newline at end of file diff --git a/.idea/dictionaries/fross.xml b/.idea/dictionaries/fross.xml new file mode 100644 index 00000000..e742513d --- /dev/null +++ b/.idea/dictionaries/fross.xml @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/.idea/libraries/commons_cli_1_2.xml b/.idea/libraries/commons_cli_1_2.xml new file mode 100644 index 00000000..a8f4c09d --- /dev/null +++ b/.idea/libraries/commons_cli_1_2.xml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/gson.xml b/.idea/libraries/gson.xml new file mode 100644 index 00000000..f640c804 --- /dev/null +++ b/.idea/libraries/gson.xml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/junit_4_11.xml b/.idea/libraries/junit_4_11.xml new file mode 100644 index 00000000..8bc92e2d --- /dev/null +++ b/.idea/libraries/junit_4_11.xml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/libraries/opencsv.xml b/.idea/libraries/opencsv.xml new file mode 100644 index 00000000..c9a249d4 --- /dev/null +++ b/.idea/libraries/opencsv.xml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml deleted file mode 100644 index e6383318..00000000 --- a/.idea/misc.xml +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - - - - - - - - - http://www.w3.org/1999/xhtml - - - - - - diff --git a/.idea/modules.xml b/.idea/modules.xml index 66f9d540..6a702594 100644 --- a/.idea/modules.xml +++ b/.idea/modules.xml @@ -2,19 +2,10 @@ - - - - - - - - + - - - + diff --git a/.idea/scopes/scope_settings.xml b/.idea/scopes/scope_settings.xml new file mode 100644 index 00000000..922003b8 --- /dev/null +++ b/.idea/scopes/scope_settings.xml @@ -0,0 +1,5 @@ + + + + \ No newline at end of file diff --git a/examples/search/search.iml b/.idea/splunk-sdk-java.iml similarity index 53% rename from examples/search/search.iml rename to .idea/splunk-sdk-java.iml index be81447e..d6ebd480 100644 --- a/examples/search/search.iml +++ b/.idea/splunk-sdk-java.iml @@ -2,13 +2,8 @@ - - - + - - - - + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml index def6a6a1..9d32e507 100644 --- a/.idea/vcs.xml +++ b/.idea/vcs.xml @@ -2,6 +2,7 @@ + diff --git a/examples/info/info.iml b/ApplicationTestWithoutSetup/ApplicationTestWithoutSetup.iml similarity index 65% rename from examples/info/info.iml rename to ApplicationTestWithoutSetup/ApplicationTestWithoutSetup.iml index be81447e..d5c07432 100644 --- a/examples/info/info.iml +++ b/ApplicationTestWithoutSetup/ApplicationTestWithoutSetup.iml @@ -3,12 +3,10 @@ - + - - diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..8aad9ae9 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,678 @@ +# Splunk Enterprise SDK for Java Changelog + +## Version 1.9.5 + +### New Features and APIs +* Added static method _addClusterMasterURIsToHosts_ in HttpService class to update list of Valid Hosts with Cluster Master Hosts (GitHub PR [#215](https://github.com/splunk/splunk-sdk-java/pull/215)) +* Added instance method _getClusterMasters_ in Service class to get list of cluster master hosts + +## Version 1.9.4 + +### Minor Changes +* Added check for localhost IPv6 address, for IPv6 compatible apps (GitHub PR [#210](https://github.com/splunk/splunk-sdk-java/pull/210)) +* Updating SSL_SOCKET_FACTORY instance on changing _validateCertificates_ flag. (GitHub PR [#206](https://github.com/splunk/splunk-sdk-java/pull/210)) + +## Version 1.9.3 + +### Minor Changes +* Re-fetch logic for instancetype and version fields if not set within Service instance to avoid NPE (GitHub PR [#202](https://github.com/splunk/splunk-sdk-java/pull/202)) +* Check for local IP as alternative to _localhost_ within HostnameVerifier, addressing issue with certain local workflows + +## Version 1.9.2 + +### New Features and APIs +* Added feature that allows to update ACL properties of an entity (GitHub PR [#196](https://github.com/splunk/splunk-sdk-java/pull/196)) + +### Minor Changes +* Added null check for child to handle error when no value is passed for a parameter in modular-inputs (Ref issue [#198](https://github.com/splunk/splunk-sdk-java/issues/198) & GitHub PR [#199](https://github.com/splunk/splunk-sdk-java/pull/199)) + +## Version 1.9.1 + +### New Features and APIs +* SDK Support for third-party (Load Balancer) "sticky sessions"(cookie persistence) (Github PR [#192](https://github.com/splunk/splunk-sdk-java/pull/192)) +* Added Args option for Saved Search history method (GitHub Issue [#126](https://github.com/splunk/splunk-sdk-java/issues/126) & PR [#188](https://github.com/splunk/splunk-sdk-java/pull/188) ) + +### Minor Changes +* Special handling related to the semantic versioning of specific Search APIs functional in Splunk Enterprise 9.0.2 and (Splunk Cloud 9.0.2209). These SDK changes will enable seamless transition between the APIs based on the version of the Splunk Enterprise/Cloud (Github PR [#193](https://github.com/splunk/splunk-sdk-java/pull/193)) +* Updated checks to fetch Storage Passwords with wildcards in namespace. (GitHub PR [#187](https://github.com/splunk/splunk-sdk-java/pull/187)) + +## Version 1.9.0 + +### New Features and APIs +* SDK Support for splunkd search API changes, for Splunk 9.0+. (Github PR [#189](https://github.com/splunk/splunk-sdk-java/pull/189)) + +### Minor Changes +* Automated docs generation using GitHub actions. (Github PR [#184](https://github.com/splunk/splunk-sdk-java/pull/184)) + +## Version 1.8.0 + +### New Features and APIs +* Added a support to add custom headers in Service class. (Github PR [#176](https://github.com/splunk/splunk-sdk-java/pull/176)). +* SSL Certificate validation (default implementation) added. (Github PR [#175](https://github.com/splunk/splunk-sdk-java/pull/175)). + * Boolean flag is introduced to skip/validate certificate. Use _HttpService.setValidateCertificates()_ to enable/disable certificate validation. + * Breaking change: Certificate validation is now enforced by default, for local or non-production use cases use _HttpService.setValidateCertificates(false)_. +* Apps/app-install replaced with **apps/local**. (Github PR [#168](https://github.com/splunk/splunk-sdk-java/pull/168)) +* Breaking change: HttpService.useTLS flag removed, please use _HttpService.setSslSecurityProtocol()_ to set a specific SSL/TLS implementation or else TLS v1.2 is used by default for Java 1.8. + +### Minor Changes + +* External Entities restricted in XML factory. (Github PR [#180](https://github.com/splunk/splunk-sdk-java/pull/180)). + * Prevent expansion of external entities in Document Builder factory. +* Headers modified in Socket creation. (Github PR [#179](https://github.com/splunk/splunk-sdk-java/pull/179)). + * Http Request uses raw request headers by including escape characters which seems vulnerable. It was replaced with PrintWriter methods to avoid escape characters. + * Host parameter used in Socket is omitted to prevent exposing it to external users. +* README.md file modified with all login methods along with Splunk Search creation example. (Github PR [#177](https://github.com/splunk/splunk-sdk-java/pull/177)). +* Deploy plugin is removed from Splunk module pom to avoid redundancy. (Github PR [#172](https://github.com/splunk/splunk-sdk-java/pull/172)). +* Setter methods for Session and Bearer token added along with test case. (Github PR [#171](https://github.com/splunk/splunk-sdk-java/pull/171)) + * **Use:** service.setSplunkToken() for session tokens and service.setBearerToken() for long-lived tokens. +* Modular input folder name renamed based on newer splunk folder name validation. (Github PR [#168](https://github.com/splunk/splunk-sdk-java/pull/168)) +* SDK app collection URL has been updated to v1.1.0 in docker compose file. (Github PR [#168](https://github.com/splunk/splunk-sdk-java/pull/168)) + * Test files in sdk app collections are modified based on python v3 syntax. +* Added Saved Search test case based on title. (Github PR [#166](https://github.com/splunk/splunk-sdk-java/pull/166)) + +## Version 1.7.1 + +### Minor Changes +* Dependency breaking changes are resolved. + +## Version 1.7.0 + +### New Features and APIs +* Added Credits.md file along with licences. (Github PR [#162](https://github.com/splunk/splunk-sdk-java/pull/162)). +* Improved TLS implementation as default behavior and turned on hostname verification for all hosts. (Github PR [#158](https://github.com/splunk/splunk-sdk-java/pull/158)). + +### Minor changes +* Replaced Travis CI with Github actions (Github PR [#161](https://github.com/splunk/splunk-sdk-java/pull/161)). +* Fixed Javadoc generation while project packaging. (Github PR [#159](https://github.com/splunk/splunk-sdk-java/pull/159)). +* Fixed breaking change of **Index.getMaxHotBuckets()** method behavior to return as String instead of int. +* SDK build is migrated from ant build tool to maven build tool (Github PR [#157](https://github.com/splunk/splunk-sdk-java/pull/157)). + * Dependencies directory for ant build is removed and maven dependencies are added using pom.xml. + * Dependencies are upgraded to its LTS version. + * Project structure is re-organized with respect to Maven. + +## Version 1.6.5 + +### Bug Fixes + +* Fixed bug for push back buffer is full when exporting data in XML (GitHub PR [#125](https://github.com/splunk/splunk-sdk-java/pull/125)). + +## Version 1.6.4 + +### Bug Fixes + +* Fixed bug in modinput Windows shims that caused Splunk Enterprise to fail to restart (GitHub PR [#120](https://github.com/splunk/splunk-sdk-java/pull/120)). +* Fixed bug with data model endpoint on Splunk Enterprise 7+ (GitHub PR [#117](https://github.com/splunk/splunk-sdk-java/pull/117)). +* Fixed bug with invalid `Index.submit()` forming an invalid REST API path for namespaced services ([#118](https://github.com/splunk/splunk-sdk-java/pull/118)). +* Fixed bug with `Value.toDate(string value)` not being thread safe (GitHub PR [#109](https://github.com/splunk/splunk-sdk-java/pull/109)). + +## Version 1.6.3 + +### New features and APIs + +* Added the `updated` property on all `Resource` objects (GitHub PR [#104](https://github.com/splunk/splunk-sdk-java/pull/104)). + +## Version 1.6.2 + +### Bug Fixes + +* Update modular input shims to ensure Java processes are killed (GitHub issue [#92](https://github.com/splunk/splunk-sdk-java/issues/92)). + +## Version 1.6.1 + +### Bug Fixes + +* Fix authentication issues when the Splunk `Set-Cookie` header is not the first one. + +## Version 1.6.0 + +### New features and APIs + +* Added support for retrieving `Password` entities scoped by realm and username. +* Added getter methods for embed `SavedSearch` properties. +* Added support for custom `HttpURLConnection` connection timeouts on `HttpService`. +* Performance improvement to `SavedSearch.dispatch()`. +* Added getter methods to the `Job` class for retrieving `long` values (`getEventCountLong`, `getResultCountLong`, `getScanCountLong`). +* Added `setFieldList()` to the `JobExportArgs` class. +* Added support for the `manualRebuilds` `DataModel` setting. + +### Bug Fixes + +* Fixed `SavedSearch.Dispatch()` throwing a `NullPointerException` in some load-balanced search head clustering environments. +* Fixed non-limit `PivotFilter` constructing the wrong JSON blob. + +### Minor changes + +* Added support for Travis CI. + +## Version 1.5.0 + +### New features and APIs + +* Added support for cookie-based authentication, for Splunk 6.2+. + +### Bug Fixes + +* Fixed failure parsing XML responses. Pull Request #76. +* Fixed bug where `Job` is never ready leading to infinite loops. + +### Minor changes + +* The SDK is now properly compiled with the `Command` class used in examples. + +## Version 1.4.0 + +### New features and APIs + +* Added support for Java 8, when manually configuring the `Service` class to use TLSv1.2, TLSv1.1, or TLSv1 defined in the `SSLSecurityProtocol` enum. The default is still SSLv3. +* Allow setting a custom `SSLSocketFactory` on the `HTTPService` and `Service` classes. + +### New examples + +* `ssl_protocols`: tries to connect to Splunk over HTTPS using different SSL/TLS protocols, then using a custom SSL and TLS `SSLSocketFactory`. + +### Minor changes + +* The SDK is now compiled with the `Command` class used in examples. + +## Version 1.3.2 + +### Performance improvements + +* `Job` objects will only be refreshed by `isReady()` if the `Job` is not ready. This minimizes HTTP requests when getting properties of the `Job`. +* The `Service` class now has a `getJob()` method that is used to retrieve a `Job` object by its sid String. This is better than calling `service.getJobs().get(sid)`, which has the overhead of getting all `Job` objects from Splunk in order to access a single `Job`. + +### New examples + +* `endpoint_instantiation`: shows how to manually instantiate any Splunk REST API endpoint. +* `get_job`: shows how to get a `Job` by its sid using the new `Service.getJob()` method. + +### Minor changes + +* The `Entity` and `EntityCollection` classes each have a public constructor, so any Splunk endpoint can be manually instantiated. +* The `FiredAlert` class now has a `getParsedExpirationTime()` method that returns a `Date` object. +* Some test have been modified to work with the latest release of Splunk Enterprise (6.2.x). + +## Version 1.3.1 + +* Removed deprecated functions from `DistributedConfiguration` class. +* Oneshot searches, called from `Index.upload`, can now be passed search arguments. +* Fixed a resource leak in the `Command.load` function. + +## Version 1.3 + +### New features and APIs + +* Added support for data models and pivots. + +### Bug Fixes + +* When setting the sourcetype of a modular input event, events are indexed properly. + Previously Splunk would encounter an error and skip them. Also updated some of the modular input test data to reflect this change. +* ResultsReaderXml now works with alternate XML parser libraries. + +## Version 1.2.2 + +### Bug fixes + +* Hot fix to ResultsReaderXml to work with woodstox XML parsing library. + +## Version 1.2.1 + +### New features and APIs + +* The Splunk Enterprise SDK for Java is fully compatible with Splunk Enterprise 6.0 as of this release. + +### Bug fixes + +* **JobCollection.create()** previously invalidated the collection and refreshed it to see whether the job had + appeared. This was problematic for Splunk Enterprise instances running many jobs at once. The method has been changed + to only interact with the endpoint specific to the newly created job. +* Namespaces that contain special characters such as '@' in their owner or app are now handled correctly. + +### Breaking changes + +* Removed **Application.isManageable** and **Application.setManageable**, since they are deprecated or nonexistent + in all supported Splunk versions as of this release. +* **OutputDefault.getMaxQueueSize** now returns a String instead of a long to match the behavior of + **setMaxQueueSize**. + +### Known issues + +* Certain combinations of requests and restarts of splunkd can cause splunkd to hang on OS X v10.8 Mountain Lion and + OS X v10.9 Mavericks running Splunk 6.0.0. This issue is not present when running Splunk Enterprise on earlier + versions of OS X. This will be fixed in a future release. + +* The modular input support in the Splunk Enterprise SDK for Java is not compatible with Windows Server 2003 or Windows Server + 2003 R2. + +## Version 1.2 + +### New features and APIs + +* Added support for building modular input scripts in Java using the Splunk Enterprise SDK for Java. + +### Bug fixes + +* Any errors returned by Splunk in formats besides XML (for example, when Splunk returns JSON + if an error occurs during a search with output_mode=json), are passed on as is in the resulting + HttpException, replacing the uninformative error about XML parsing that was produced before. + +## Version 1.1 + +### Breaking changes + +* The default setting for all search jobs is now `segmentation=none` unless + you explicitly set it otherwise. This setting returns results as a raw-text + string rather than a string in XML format. + +* The `ResultReaderCsv` class no longer supports streams from the `Service.export` method. + Instead, use the `ResultReaderXml` class with XML output, or use the `ResultReaderJson` + class with JSON output. + +### New features and APIs + +* New classes have been added, `MultiResultsReaderXml` and `MultiResultsReaderJson`, + to read search results streams with multiple result sets from `Service.Export` methods. + +* The `ResultsReader` classes now support `Iterable` and `Iterator` interfaces. + +* The `Event.getSegmentedRaw` method has been added to return raw data from events, preserving + segmentation information. + +### Bug fixes + +* The `ServiceInfo` class now uses the `services/*` endpoint rather than the + default namespace (`servicesNS/*`) for HTTP requests. This change is a workaround to + avoid a bug in Splunk that returns HTTP code 403 when the `server/info` endpoint + is accessed using certain namespaces. + +* The `ResultsReaderXml` class can now read search results streams from the + `Job.getResultsPreview` method. + +## Version 1.0 + +### New features and APIs + +* Specialized *args* classes have been added to make it easier to pass + entity-specific arguments: + - `CollectionArgs` + - `IndexCollectionArgs` + - `JobArgs` + - `JobEventsArgs` + - `JobExportArgs` + - `JobResultsArgs` + - `JobResultsPreviewArgs` + - `JobSummaryArgs` + - `SavedSearchCollectionArgs` + - `SavedSearchDispatchArgs` + + These new *args* classes are used with the following methods: + - `Service` constructor + - `Service.getSavedSearches` method + - `Service.getJobs` method + - `Service.getIndexes` method + - `Service.export` method + - `JobCollection.create` method + - `Job.getResults` method + - `Job.getResultsPreview` method + - `Job.getEvents` method + - `Job.getSummary` method + - `SavedSearch.dispatch` method + +* `ResultsReader.getNextEvent` now returns an `Event` object, which provides + better handling for multi-value fields. This change is backward-compatible + with older code that expects a `HashMap`. However this new + `Event` object is read-only. + +* Modular input functionality has been implemented (requiring Splunk 5.0+) + and the following classes have been added: + - `ModularInputKind` + - `ModularInputKindArgument` + + The `InputCollection` class also now handles arbitrary input kinds represented + by modular inputs. You can call `InputCollection.getInputKinds` to get the set + of `InputKinds` on the connected Splunk instance. + +* The `ReceiverBehavior` interface has been added to work with output streams. + +* The `IndexCollection` class has been added as a specialized collection class + for indexes. + +* The `JobCollection` class has been added as a specialized collection class for + jobs. + +* You can now programatically remove indexes using the `IndexCollection.remove` + method (requires Splunk 5.0+). + +* You can now send data to an input using the `TcpInputs.attach`, + `TcpInputs.submit`, and `UdpInput.submit` convenience methods. + +* You can now restrict inputs to a specified host using the `setRestrictToHost` + method on `TcpInput`, `TcpSplunkInput`, and `UdpInput` (this method requires + Splunk 5.0+). + +* The `DistributedConfiguration.enable` and `DistributedConfiguration.disable` + convenience methods have been added, allowing you to immediately enable or + disable the configuration. + +* The following methods have been added to the `Index` class: + - `getBucketRebuildMemoryHint` + - `getMaxTimeUnreplicatedNoAcks` + - `getMaxTimeUnreplicatedWithAcks` + - `setBucketRebuildMemoryHint` + - `setMaxTimeUnreplicatedNoAcks` + - `setMaxTimeUnreplicatedWithAcks` + +### Breaking changes + +* The JAR files have changed so that everything is now included in the + **splunk.jar** file. The **splunk-external.jar** and **splunk-sdk.jar** files + have been removed. + +* Arguments are now submitted to Splunk in a consistent order, which improves + behavior in certain cases. + +* The `InputKind` enum is now a class. The `InputKind` class has static members + identical to the enum values, but you can no longer use a `switch` statement + over the values. Instead, use a series of `if-else` blocks. This change was + necessary to support arbitrary modular input kinds. + +* All text is now consistently UTF-8 encoded. Previously, the platform-native + encoding was used in certain cases. For example: + - HTTP requests are sent in UTF-8. In particular the values of *args* + classes are always encoded in UTF-8. + - Results and events from jobs are read as UTF-8. + +* The `Index.setAssureUTF8` method fails for Splunk 5.0+ because this field has + become a global setting rather than a per-index setting. + +* The `Index.clean` method now throws `SplunkException.INTERRUPTED` when + interrupted. Additionally, the `maxSeconds` parameter is obeyed more + accurately. + +* The `WindowsRegistryInput.getType` and `WindowsRegistryInput.setType` method + type has changed to `String[]` instead of `String`. + +* The `DistributedPeer.getBuild` method now returns an `int` instead of a + `String` to be consistent with the `ServiceInfo.getBuild` method. + +* The `setRestrictToHost` method on `TcpInput`, `TcpSplunkInput`, and `UdpInput` + throws an exception for Splunk 4.x. Previously, this method failed silently. + +* The `StormService` class has been removed, but will be restored in a + subsequent release. + +* The methods in the `ResultsReader` class now throw `IOException` instead of a + plain `Exception`, so callers no longer need to handle a plain `Exception`. + +* The `SplunkException` class now provides error messages when printed. + +* The test suite has been completely cleaned up, resulting in better coverage + and faster performance, mostly by eliminating unnecessary restarts. The test + suite strictly requires tests to handle restart requests. + +* The `get`, `remove`, and `contains` methods for entity collections now throw + an exception when a wildcarded namespace is passed, rather than incorrectly + returning an empty list or taking no action. + +* The `HashMap` and `Event` objects returned by `ResultsReader.getNextEvent` are + now read-only. + +* The `SavedSearch.getDispatchMaxTime` method previously returned a `String`, + but now returns an `int`. + +* The `LicensePool.getSlavesUsageBytes` method now returns a map from each slave + GUID to its license usage, instead of returning a `long`. + +* The `Service.oneshot` method has been renamed to `Service.oneshotSearch`. + +* The `Service.oneshot(String query, Map inputArgs, Map outputArgs)` overload + has been removed, because `outputArgs` had no effect. + +* The `SavedSearch.setArgsWildcard` method has been removed. To set a wildcard + parameter, specify it as a key-value pair in a map and pass it to the + `SavedSearch.dispatch(java.util.Map args)` method. + +* The `SavedSearch.setActionWildcard` method has been removed. Use the specific + setters to update these parameters. + +* The `SavedSearch.setDispatchWildcard` method has been removed. Use the + specific setters to update these parameters. + +* The `Service.getFiredAlerts` method has been renamed to + `getFiredAlertsGroups`. + +* The `Entity.reload` method has been removed. + +* The `Entity.toUpdate` field is no longer public. + +* The `Service.search(query)` and `Service.search(query, args)` methods now + return a search job instead of blocking and returning results. + +* The `Service.search(query, inputArgs, outputArgs)` overload has been removed. + +* The `OutputServer.setsslRootCAPPath` method has been renamed to + `setSslRootCAPPath`. + +* The `SavedSearch.getDispatchReduceFreq` method, which returned a `String`, has + been replaced with `getDispatchReduceFrequency`, which returns an `int`. + +* The `setRestrictToHost` method has been removed from the `TcpInput` and + `UdpInput` classes. + +* The `Settings.setMgmtHostPort` method has been renamed to `setMgmtPort` and + this method now returns an `int`. + +### Bug fixes + +* The `Service.versionCompare` method has been fixed to work as expected. + +* The `OutputDefault.update` method has been fixed so that when a "name" + parameter is not specified, the method no longer fails. + +### Deprecated features + +The following list contains the main features that have been deprecated (trivial +changes are not included): + +* The public fields in the `ServiceArgs` class have been deprecated in favor of + the new setter methods to maintain consistency with the new *args* subclasses. + +* The `Application.isManageable` and `Application.setManageable` methods have + been deprecated in Splunk 5.0 and later. + +* The `DistributedConfiguration.getServerTimeout` method has been deprecated in + Splunk 5.0 and later. + + +## Version 0.8.0 (beta) + +### Breaking changes + +* Changed how isDone() behaves with respect to job creation. Previously if a job + was not ready on the server, calling job.isDone() would cause an exception. + Now, calling isDone() will return false under the two following conditions: + 1) The job has not yet been scheduled. 2) The job has been scheduled but the + results are not ready. In addition, isDone() implicitly invokes job.refresh() + so the caller does not need to. This simplifies the code waiting for a job + result to this: (with a 500 millisecond polling interval) + + ``` + while (!job.isDone()) { + sleep(500); + } + ``` + +* Added isReady() method to the Job class. This method detects whether or + not the job is ready to return data (i.e. be queried). It also implicitly + invokes job.refresh(). This allows for jobs with previews but that have not + necessarily completed to be accessed: (with a 500 millisecond polling + interval) + + ``` + while (!job.isReady()) { + sleep(500); + } + ``` + +* All Job class accessors will call refresh once before accessing the object. + +### Bug fixes + +* Fixed ordering of collections when using pagination. Previously the order + could be random. Now it maintains the order of the entities returned by the + server. + +* Fixed XML streaming reader to properly work with paginated result sets. + +* Large collections can cause a default JVM to run out of memory: The Atom + parsing uses the streaming XML parser as opposed to a DOM parser. + +* Fixed Index class getSync() method to return an integer instead of a boolean. + +* Added Index class get method getEnableOnlineBucketRepair(). + +* Added Index class get method getMaxBloomBackfillBucketAge(). + +## Version 0.5.0 (preview) + +### New APIs +* `StormService` class +* `Receiver` class +* `Upload` class +* New setter methods for all classes +* New getter methods for various classes + +### New features +* Added support for a default index, allowing optional parameters + for streaming connections. The `Index` class now uses the new `Receiver` + class. + +* Added a paginate feature for Splunk return data. This feature allows for + `count` and `offset` methods to page through Splunk meta data instead of + retrieving all the data at once: + + ``` + ConfCollection confs; + Args args = new Args(); + args.put("count", 30); + args.put("offset", 0); + + confs = service.getConfs(args); + // ... operate on the first 30 elements + offset = offset + 30; + args.put("offset", offset) + confs = service.getConfs(args); + // ... operate on the next 30 elements + ``` + +* Added a namespacing feature as optional arguments (`app`, `owner`, `sharing`) + to the collection's `create` and `get` methods. For more information about + namespaces, see + ["Overview of the Splunk Enterprise SDK for Java"](http://dev.splunk.com/view/java-sdk/SP-CAAAECN) + on the Developer Portal. + + The following example shows how to use the optional namespace to restrict + creating and selecting saved searches to the namespace "owner = magilicuddy, + app = oneMeanApp": + + ``` + String searchName = "My scoped search"; + String search = "index=main * | head 10"; + args args = new Args(); + args.put("owner", "magilicuddy"); + args.put("app", "oneMeanApp"); + + // ... other creation arguments also get set into the args map + + savedSearches.create(searchName, search, args); + ``` + + This example shows how to returns all saved searches within the same scoped + namespace: + + ``` + args args = new Args(); + args.put("owner", "magilicuddy"); + args.put("app", "oneMeanApp"); + SavedSearchCollection + mySavedSearches = service.getSavedSearches(args); + ``` + +* Added an XML, JSON, and CSV streaming results reader. This feature allows you + to retrieve event data using an incremental streaming mechanism. Return data + is in key-value pairs. The XML form uses built-in JDK XML parsing support. The + JSON and CSV form requires third-party JSON and CSV tokenizers, which are + included as ancillary .jar files in the SDK. The JSON and CSV streaming + results reader, which requires the external tokenizers, are contained in a + separate Splunk .jar file named `splunk-external.jar`. + + The following example uses the built-in XML streaming reader: + + ``` + Job job = service.getJobs().create(query, queryArgs); + ... + + HashMap map; + stream = job.getResults(outputArgs); + ResultsReader resultsReader = new ResultsReaderXml(stream); + while ((map = resultsReader.getNextEvent()) != null) { + for (String key: map.keySet()) + System.out.println(key + " --> " + map.get(key)); + } + ``` + +* Added support for Splunk Storm. Instead of connecting to `Service`, you + connect to the new `StormService` class using similar arguments. Then, get a + `Receiver` object and log events. `StormService` requires the `index` key and + `sourcetype` parameters when sending events: + + ``` + // the storm token provided by Splunk + Args loginArgs = new Args("StormToken", + "p-n8SwuWEqPlyOXdDU4PjxavFdAn1CnJea9LirgTvzmIhMEBys6w7UJUCtxp_7g7Q9XopR5dW0w="); + Storm service = StormService.connect(loginArgs); + + // get the receiver object + Receiver receiver = service.getReceiver(); + + // index and source type are required for storm event submission + Args logArgs = new Args(); + logArgs.put("index", "0e8a2df0834211e1a6fe123139335741"); + logArgs.put("sourcetype", "yoursourcetype"); + + // log an event. + receiver.log("This is a test event from the SDK", logArgs); + ``` + +### Minor additions + +* Added a `genevents` example to generate events and push into Splunk using + various methods. +* Added a second time format when parsing time. A second time format is required + to accommodate the `data/input/oneshot` endpoint that does not return a + standard time format and does not allow a time-format specifier. +* Added a streaming reader to search examples. The main search example `search` + shows how to use all three result readers. There are build + modifications in build.xml to include the ancillary .jar files for JSON and + CSV. +* Added an `Input` example to display Splunk inputs and their attributes. +* Added an alias `log` for `submit` to the `Receiver` class. +* Updated eclipse .classpath file, accounting for new additions. + +### Bug fixes + +* Fixed argument processing in the tail example. +* Fixed timing window during search job creation; added `JOB_NOT_READY` + exception. +* Fixed `Index` cleaning to require a timeout value; added `TIMEOUT` exception. +* Fixed `LicensePool` type to use string quota instead of integer. This change + allows for `MAX` and `[M|G|T]`. +* Fixed `action` when trying to update `Settings`. +* Fixed user creation to force lowercase usernames. +* Fixed the missing get methods for `ServiceInfo`. +* Fixed a number of getter methods. + +## Version 0.1.0 (preview) + +Initial Splunk Enterprise SDK for Java release. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 00000000..26b75753 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,35 @@ +# Contributing Guidelines + +## How to contribute + +If you would like to contribute to this project, see [Contributions to Splunk](https://www.splunk.com/en_us/form/contributions.html) for more information. + +## Issues and bug reports + +If you're seeing some unexpected behavior with this project, please create an [issue](https://github.com/splunk/splunk-sdk-java/issues) on GitHub with the following information: + +1. Version of this project you're using (ex: 1.4.0) +2. Platform version (ex: Windows Server 2012) +3. Framework version (ex: Java 8) +4. Splunk Enterprise version (ex: 8.0) +5. Other relevant information (ex: local/remote environment, Splunk network configuration, standalone or distributed deployment, are load balancers used) + +Alternatively, if you have a Splunk question please ask on [Splunk Answers](https://community.splunk.com/t5/Splunk-Development/ct-p/developer-tools). + +## Pull requests + +We love to see pull requests! + +To create a pull request: + +1. Fill out the [Individual Contributor Agreement](https://www.splunk.com/en_us/form/contributions.html). +2. Fork the [repository](https://github.com/splunk/splunk-sdk-java). +3. Make changes to the **develop** branch, preferably with tests. +4. Create a [pull request](https://github.com/splunk/splunk-sdk-java/pulls) against the **develop** branch. + +## Contact us + +If you have a paid Splunk Enterprise or Splunk Cloud license, you can contact [Support](https://www.splunk.com/en_us/support-and-services.html) with questions. + +You can reach the Splunk Developer Platform team at _devinfo@splunk.com_. + diff --git a/CREDITS.md b/CREDITS.md new file mode 100644 index 00000000..9afabf92 --- /dev/null +++ b/CREDITS.md @@ -0,0 +1,12 @@ +# Third-party software credits + +Some of the components included in the Splunk Enterprise SDK for Java are licensed under free or open source licenses. We wish to thank the contributors to those projects. + +| Contributor | Description | License | +|:----------- |:----------- |:------- | +| [opencsv](https://sourceforge.net/p/opencsv/source/ci/master/tree/) | For reading and writing CSV in Java | [Apache](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-OPENCSV) | +| [commons-cli](https://github.com/apache/commons-cli) | A package of Java utility classes for the classes that are in java.lang's hierarchy | [Apache](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-COMMONS) | +| [gson](https://github.com/google/gson) | Convert Java Objects into their JSON representation | [Apache](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-GSON) | +| [junit](https://github.com/junit-team/junit4) | Unit testing framework for Java | [Eclipse](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-JUNIT) | +| [jacoco](https://github.com/jacoco/jacoco) | JaCoCo runtime agent to your tests and allows basic report creation. | [Eclipse](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-JACOCO) | +| [netbeans-api](https://github.com/apache/netbeans) | OpenIDE Utilities | [Apache](https://github.com/splunk/splunk-sdk-java/blob/master/licenses/LICENSE-NETBEANS) | \ No newline at end of file diff --git a/LICENSE b/LICENSE index d6456956..75b52484 100755 --- a/LICENSE +++ b/LICENSE @@ -1,202 +1,202 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/Makefile b/Makefile new file mode 100644 index 00000000..123c4cb1 --- /dev/null +++ b/Makefile @@ -0,0 +1,48 @@ +# text reset +NO_COLOR=\033[0m +# green +OK_COLOR=\033[32;01m +# red +ERROR_COLOR=\033[31;01m +# cyan +WARN_COLOR=\033[36;01m +# yellow +ATTN_COLOR=\033[33;01m + +ROOT_DIR := $(shell git rev-parse --show-toplevel) + +VERSION := `git describe --tags --dirty 2>/dev/null` +COMMITHASH := `git rev-parse --short HEAD 2>/dev/null` +DATE := `date "+%FT%T%z"` + +.PHONY: all +all: init test + +init: + @echo "$(ATTN_COLOR)==> init $(NO_COLOR)" + +.PHONY: test +test: + @echo "$(ATTN_COLOR)==> test $(NO_COLOR)" +# @ant test + @mvn test + +.PHONY: test_specific +test_specific: + @echo "$(ATTN_COLOR)==> test_specific $(NO_COLOR)" + @sh ./scripts/test_specific.sh + +.PHONY: up +up: + @echo "$(ATTN_COLOR)==> up $(NO_COLOR)" + @docker-compose up -d + +.PHONY: wait_up +wait_up: + @echo "$(ATTN_COLOR)==> wait_up $(NO_COLOR)" + @for i in `seq 0 180`; do if docker exec -it splunk /sbin/checkstate.sh &> /dev/null; then break; fi; printf "\rWaiting for Splunk for %s seconds..." $$i; sleep 1; done + +.PHONY: down +down: + @echo "$(ATTN_COLOR)==> down $(NO_COLOR)" + @docker-compose stop diff --git a/README.md b/README.md index 051bb373..8c63c07f 100644 --- a/README.md +++ b/README.md @@ -1,449 +1,414 @@ -# The Splunk Software Development Kit for Java (Preview Release) +[![Java SDK Test](https://github.com/splunk/splunk-sdk-java/actions/workflows/test.yml/badge.svg?branch=master)](https://github.com/splunk/splunk-sdk-java/actions/workflows/test.yml) +# The Splunk Software Development Kit for Java -This SDK contains library code and examples designed to enable developers to -build applications using Splunk. +#### Version 1.9.5 + +The Splunk Software Development Kit (SDK) for Java contains library code and +examples designed to enable developers to build applications using Splunk. Splunk is a search engine and analytic environment that uses a distributed -map-reduce architecture to efficiently index, search and process large +map-reduce architecture to efficiently index, search and process large time-varying data sets. The Splunk product is popular with system administrators for aggregation and -monitoring of IT machine data, security, compliance and a wide variety of +monitoring of IT machine data, security, compliance and a wide variety of other scenarios that share a requirement to efficiently index, search, analyze and generate real-time notifications from large volumes of time series data. -The Splunk developer platform enables developers to take advantage of the +The Splunk developer platform enables developers to take advantage of the same technology used by the Splunk product to build exciting new applications that are enabled by Splunk's unique capabilities. -## License -The Splunk Software Development Kit for Java is licensed under the Apache -License 2.0. Details can be found in the file LICENSE. +## Getting started with the Splunk SDK for Java -## This SDK is a Preview Release +The Splunk SDK for Java contains library code and examples that show how to +programmatically interact with Splunk for a variety of scenarios including +searching, saved searches, data inputs, and many more, along with building +complete applications. -1. This Preview release is a pre-beta release. There will also be a beta - release prior to a general release. It is incomplete and may have bugs. +The information in this Readme provides steps to get going quickly, but for more +in-depth information be sure to visit the +[Splunk Developer Portal](http://dev.splunk.com/view/java-sdk/SP-CAAAECN). -2. The Apache license only applies to the SDK and no other Software provided - by Splunk. +### Requirements -3. Splunk in using the Apache license is not providing any warranties, - indemnification or accepting any liabilities with the Preview SDK. +Here's what you need to get going with the Splunk SDK for Java. -4. Splunk is not accepting any Contributions to the Preview release of - the SDK. - All Contributions during the Preview SDK will be returned without review. +#### Splunk -## Getting started with the Splunk Java SDK +If you haven't already installed Splunk, download it +[here](http://www.splunk.com/download). For more about installing and running +Splunk and system requirements, see +[Installing & Running Splunk](http://dev.splunk.com/view/SP-CAAADRV). The Splunk SDK for Java has been tested with Splunk Enterprise 9.0 and 8.2. -The Splunk Java SDK contains library code and examples that show how to -programmatically interact with Splunk for a variety of scenarios including -searching, saved searches, data inputs, and many more, along with building -complete applications. +#### Splunk SDK for Java -### Requirements +[Get the Splunk SDK for Java](http://dev.splunk.com/view/SP-CAAAECN)—download the SDK as a ZIP, then extract the files and build the SDK. Or, download the JAR and add it to your project. -Here's what you need to get going with the Splunk Java SDK. +If you want to contribute to the SDK, clone the repository from [GitHub](https://github.com/splunk/splunk-sdk-java). -#### Splunk - -If you haven't already installed Splunk, download it here: -http://www.splunk.com/download. For more about installing and running Splunk -and system requirements, see Installing & Running Splunk -(http://dev.splunk.com/view/SP-CAAADRV). +#### Java using Maven -#### Splunk Java SDK +You can use [Apache Maven](http://maven.apache.org/) to build your Splunk SDK for Java projects. With a few updates to your project's `pom.xml` file, it will retrieve all necessary dependencies and seamlessly build your project. -Get the Splunk Java SDK from GitHub (https://github.com/) and clone the -resources to your computer. For example, use the following command: +To add the Splunk SDK for Java `.JAR` file as a dependency: -> git clone https://github.com/splunk/splunk-sdk-java.git +1. Add the repository to your project's `pom.xml` file: -#### Java and Ant +```xml + + ... + + splunk-artifactory + Splunk Releases + http://splunk.jfrog.io/splunk/ext-releases-local + + +``` -You'll need Java SE version 6 or higher, which you can download from the -Oracle web site -(http://www.oracle.com/technetwork/java/javase/downloads/index.html). +2. Add the dependency to the `pom.xml` file: -You'll also need Ant, which you can install from the Apache website -(http://ant.apache.org/bindownload.cgi). +```xml + + ... + + com.splunk + splunk + 1.9.5 + + +``` -If you are using Windows, you'll need to make sure the following system -variables are created and set: +Be sure to update the version number to match the version of the Splunk SDK for Java that you are using. -* ANT_HOME should be set to the location where Ant is installed. +> Note: You can make similar changes to use [Gradle](http://www.gradle.org/) as well. -* JAVA_HOME should be set to the directory where the JDK is installed. +### Building the SDK and documentation -* PATH should include the path to the %ANT_HOME%\bin directory. +To build the SDK, open a command prompt in the **/splunk-sdk-java** +directory and enter: -For full installation instructions, you can find more information here: - -* Java Platform Installation - (http://www.oracle.com/technetwork/java/javase/index-137561.html) + mvn -* Installing Apache Ant - (http://ant.apache.org/manual/install.html) +or -### Building the SDK and documentation + mvn package -To build the SDK, open a command prompt at the root of the Splunk Java SDK -repository and enter: +This command builds all of the .class and .jar files. If you just want to build +the .class files, enter: -> ant + mvn compile To remove all build artifacts from the repository, enter: -> ant clean + mvn clean -To build the documentation for the SDK, enter: +To build the documentation for the SDK, it is being automatically generated with mvn package, otherwise enter: -> ant javadoc + cd splunk + mvn javadoc:javadoc -If you are interested in more control of the build process, see the build.xml -file. You can also type the following command from anywhere in the repository -and Ant will find the root build file: +### Usage +#### Login using username and password +```java +import com.splunk.Service; +import com.splunk.ServiceArgs; -> ant {target} -find +/** + * Login using username and password + */ +public class SplunkLogin { -### Examples and unit tests + static Service service = null; + public static void main(String args[]) { + ServiceArgs loginArgs = new ServiceArgs(); + loginArgs.setPort(8089); + loginArgs.setHost("localhost"); + loginArgs.setScheme("https"); + loginArgs.setUsername("USERNAME"); // Use your username + loginArgs.setPassword("PASSWORD"); // Use your password + + // Initialize the SDK client + service = Service.connect(loginArgs); + } +} +``` + +#### Login using Session Token +```java +import com.splunk.Service; +import com.splunk.ServiceArgs; + +/** + * Login using Session token + */ +public class SplunkLogin { + + static Service service = null; + /** + * Session Token. + * Actual token length would be longer than this token length. + */ + static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5"; + + public static void main(String args[]) { + ServiceArgs loginArgs = new ServiceArgs(); + loginArgs.setPort(8089); + loginArgs.setHost("localhost"); + loginArgs.setScheme("https"); + loginArgs.setToken(String.format("Splunk %s", token)); + + // Initialize the SDK client + service = Service.connect(loginArgs); + } +} +``` +* Login using username and password will create Session token internally. +* Login using Credentials (username & password) OR directly using Session token are similar. +* In above two approaches, there is one limitation that expiration time of Session token cannot be extended. User has to re-login every time when token expires. +* To overcome this limitation, **Authentication** token is used instead of Session token. +* In **Authentication** token, user has a provision to set token expiration time. Splunk allows user to set relative/absolute time for token expiration. +* In other words, **Authentication** token is configurable whereas Session token cannot be configured. + +#### Login using Authentication Token (RECOMMENDED) +```java +import com.splunk.Service; +import com.splunk.ServiceArgs; + +/** + * Login using Authentication token + */ +public class SplunkLogin { + + static Service service = null; + /** + * Authentication Token. + * Actual token length would be longer than this token length. + */ + static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5"; + + public static void main(String args[]) { + ServiceArgs loginArgs = new ServiceArgs(); + loginArgs.setPort(8089); + loginArgs.setHost("localhost"); + loginArgs.setScheme("https"); + loginArgs.setToken(String.format("Bearer %s", token)); + + // Initialize the SDK client + service = Service.connect(loginArgs); + } +} +``` + +#### Example of running a simple search by first creating the search job +```java +import com.splunk.Job; +import com.splunk.ResultsReader; +import com.splunk.ResultsReaderXml; +import com.splunk.Service; +import com.splunk.ServiceArgs; + +/** + * Logged in using Authentication token. + * Assuming that authentication token is already created from Splunk web. + * Create Job using search creation. + * Read results and print _raw fields + */ +public class SearchExample { + + static Service service = null; + + /** + * Authentication Token. + * Actual token length would be longer than this token length. + */ + static String token = "1k_Ostpl6NBe4iVQ5d6I3Ohla_U5"; + + public static void main(String args[]) { + + ServiceArgs loginArgs = new ServiceArgs(); + loginArgs.setPort(8089); + loginArgs.setHost("localhost"); + loginArgs.setScheme("https"); + loginArgs.setToken(String.format("Bearer %s", token)); + + // Initialize the SDK client + service = Service.connect(loginArgs); + + // Run a simple search by first creating the search job + Job job = service.getJobs().create("search index=_internal | head 10"); + + // Waiting for search results to be ready + while (!job.isReady()) { + try { + Thread.sleep(500); // 500 ms + } catch (Exception e) { + // Handle exception here. + } + } -The Splunk Java SDK includes several examples and unit tests that are run at -the command line. + // Read results + try { + ResultsReader reader = new ResultsReaderXml(job.getEvents()); + // Iterate over events and print _raw field + reader.forEach(event -> System.out.println(event.get("_raw"))); + + } catch (Exception e) { + // Handle exception here. + } + } +} +``` + +For more information on authentication using tokens, please visit [Splunk Docs](https://docs.splunk.com/Documentation/Splunk/latest/Security/Setupauthenticationwithtokens). + +### Unit tests + +The Splunk SDK for Java includes several unit tests that are run at +the command line. #### Set up the .splunkrc file -To connect to Splunk, many of the SDK examples and unit tests take command- -line arguments that specify values for the host, port, and login credentials -for Splunk. For convenience during development, you can store these arguments -as key-value pairs in a text file named .splunkrc. Then, when you don't -specify these arguments at the command line, the SDK examples and unit tests -use the values from the .splunkrc file. +To connect to Splunk, many of the SDK examples and unit tests take command-line +arguments that specify values for the host, port, and login credentials for +Splunk. For convenience during development, you can store these arguments as +key-value pairs in a text file named **.splunkrc**. Then, the SDK examples and +unit tests use the values from the **.splunkrc** file when you don't specify +them. -To use a .splunkrc file, create a text file with the following format: +To use this convenience file, create a text file with the following format: - # Host at which Splunk is reachable (OPTIONAL) + # Splunk host (default: localhost) host=localhost - # Port at which Splunk is reachable (OPTIONAL) - # Use the admin port, which is 8089 by default. + # Splunk admin port (default: 8089) port=8089 # Splunk username username=admin # Splunk password password=changeme - # Access scheme (OPTIONAL) + # Access scheme (default: https) scheme=https - # Application context (OPTIONAL) - app=MyApp - # Owner context (OPTIONAL) - owner=User1 + # Your version of Splunk (default: 5.0) + version=5.0 -Save the file as .splunkrc in the current user's home directory. +Save the file as **.splunkrc** in the current user's home directory. -* For example on Mac OS X, save the file as: +* For example, on Mac OS X, save the file as: - > ~/.splunkrc + ~/.splunkrc -* On Windows, save the file as: +* On Windows, save the file as: - > C:\Users\currentusername\\.splunkrc + C:\Users\currentusername\.splunkrc You might get errors in Windows when you try to name the file because ".splunkrc" looks like a nameless file with an extension. You can use - the command line to create this file--go to the - C:\Users\currentusername directory and enter the following command: - - > Notepad.exe .splunkrc - - Click Yes, then continue creating the file. + the command line to create this file—go to the + **C:\Users\currentusername** directory and enter the following command: -NOTE: Storing login credentials in the .splunkrc file is only for convenience -during development—this file isn't part of the Splunk platform and -shouldn't be used for storing user credentials for production. And, if you're -at all concerned about the security of your credentials, just enter them at -the command line rather than saving them in the .splunkrc file. + Notepad.exe .splunkrc + Click **Yes**, then continue creating the file. -#### Run examples - -After you build the SDK, examples are put in the splunk-sdk- -java/dist/examples directory. To run the examples, run the Java interpreter -at the command line using the -jar flag to specify the target example jar -file, and include any arguments that are required by the example. To get help -for an example, use the --help argument with an example. - -For example, to see the command-line arguments for the Search example, open a -command prompt in the splunk-sdk-java directory and enter: - -> java -jar dist/examples/search.jar --help - -To run the Search example, open a command prompt in the splunk-sdk-java -directory and enter: - -> java -jar dist/examples/search.jar "search * | head 10" --output_mode=csv - -There is also a helper script called run in the root of the repository that -simplifies running the SDK examples. For example, on Mac OS X you could -simply enter: - -> ./run search "search * | head 10" --output_mode=csv +**Note**: Storing login credentials in the **.splunkrc** file is only for +convenience during development. This file isn't part of the Splunk platform and +shouldn't be used for storing user credentials for production. And, if you're +at all concerned about the security of your credentials, just enter them at +the command line rather than saving them in this file. #### Run unit tests -To run the SDK unit tests, open a command prompt at the root of the Splunk -Java SDK repository and enter: +To run the SDK unit tests, open a command prompt in the **/splunk-sdk-java** +directory and enter: -> ant test + mvn test -To run the units from anywhere in the repository, enter: +You can also run specific test classes by passing the class to the -Dtest= +option, e.g., -> ant test -find + mvn test -Dtest=AtomFeedTest -It's also possible to run the units within Java IDEs such as IntelliJ and -Eclipse. For example, to open the Splunk Java SDK project in Eclipse: -1. Click File, Import. -2. Click General, Existing Projects into Workspace, then click Next. -3. In Select root directory, type the path to the Splunk Java SDK root - directory (or click Browse to locate it), then click Finish. +The maven configuration can also produce an HTML report of all the tests automatically when **mvn package / mvn test** are executed. +Alternate way to generate report is using below command under splunk directory: -## The Splunk Java SDK components + mvn jacoco:report -The Splunk developer platform consists of three primary components: splunkd, -the engine; splunkweb, the app framework that sits on top of the engine; and -the Splunk SDKs that interface with the REST API and extension points. +The report will be written in **/splunk-sdk-java/splunk/target/site/surefire-report.html**. -The Splunk Java SDK lets you target splunkd by making calls against the -engine's REST API and accessing the various splunkd extension points such as -custom search commands, lookup functions, scripted inputs, and custom REST -handlers. +It's also possible to run the units within Java IDEs such as IntelliJ and +Eclipse. For example, to open the Splunk SDK for Java project in Eclipse: -For more information about the API, see the Splunk Java SDK documentation -(http://splunk.github.com/splunk-sdk-java/docs/0.1.0/index.html). +1. Click **File**, **Import**. +2. Click **General**, **Existing Projects into Workspace**, then click + **Next**. +3. In **Select root directory**, type the path to the Splunk SDK for Java root + directory (or click **Browse** to locate it), then click **Finish**. -### Service +#### Measure code coverage -The Service class is the primary entry point for the client library. -Construct an instance of the Service class and provide any arguments that are -required to connect to an available Splunk server. Once the Service instance -is created, call the login() method and provide login credentials. Once you -have an authenticated Service instance, you can use it to navigate, -enumerate, and operate on a wide variety of Splunk resources. You can also -use it to issue searches and make REST API calls. +Measurement of code coverage is generated along with mvn package / mvn test: -The following example creates a Service instance and prints the Splunk -version number: + mvn jacoco:report - import com.splunk.Service; - - public class Program { - public static void run(String[] args) { - Service service = new Service("localhost", 8089); - service.login("admin", "changeme"); - ServiceInfo serviceInfo = service.getInfo(); - System.out.println(serviceInfo.getVersion()); - } - } - -The Service class provides a variety of constructor overloads to handle -various scenarios that require different combinations of arguments. In the -most general case, the Service class takes a map of arguments, which -simplifies passing large and varying combinations of arguments, as shown in -the following example: - - Map args = new HashMap(); - args.put("host", "localhost"); - args.put("port", 8089); - Service service = new Service(args); - service.login("admin", "changeme"); - -The Service class also provides a static helper method that takes a map and -combines the construction and authentication of the instance into a single -call. Because of its flexibility, it is the method that is used most often in -the SDK examples and unit tests. The following example shows how to use this -helper method: - - Map args = new HashMap(); - args.put("host", "localhost"); - args.put("port", 8089); - args.put("scheme", "https"); - args.put("app", "MyApp"); - args.put("owner", "nobody"); - args.put("username", "admin"); - args.put("password", "changeme"); - Service service = Service.connect(args); - -### Entities and collections - -The Splunk REST API consists of over 160 endpoints that provide access to -almost every feature of Splunk. The majority of the Splunk Java SDK API -follows a convention of exposing resources as collections of entities, where -an entity is a resource that has properties, actions, and metadata that -describes the entity. The entity/collection pattern provides a consistent -approach to interacting with resources and collections of resources. - -For example, the following code prints all Splunk users: - - Service service = Service.connect(...); - for (User user : service.getUsers().values()) - System.out.println(user.getName()); - -Similarly, the following code prints all the Splunk apps: - - Service service = Service.connect(...); - for (Application app : service.getApplications().values()) - System.out.println(app.getName()); - -Collections use a common mechanism to create and remove entities. Entities -use a common mechanism to retrieve and update property values, and access -entity metadata. Once you're familiar with this pattern, you'll have a -reasonable understanding of how the SDK and underlying REST API work. - -The SDK contains the base classes Entity and EntityCollection, both of which -derive from the common base class Resource. Note that Service is not a -Resource, but is a container that provides access to all features associated -with a Splunk instance. - -The class hierarchy for the core SDK library is as follows: - - Service - Resource - Entity - ResourceCollection - EntityCollection - -### Client state - -Instances of the Resource class maintain a client-side copy of the state of -the corresponding Splunk resource. For example, an entity will have a copy of -its properties, and a collection will have a copy of its members. When you -request a property (or collection member), the local copy is returned if it's -available. Otherwise, a new copy is requested from the server if it's not -available or if the local copy is known to be out of date (for example, when -the update method was just called). - -Note: In general, there is no way to determine whether your local client -state is in sync with the server other than forcing a refresh of the -corresponding Resource instance. - -The Resource class provides the following methods for managing client-side -state: - -* The `refresh` method unconditionally refreshes the client state for the - object. - -* The `invalidate` method marks the local state as invalid, and it is - refreshed the next time the object's state is accessed. - -* The `validate` method checks whether the local state has been marked - invalid and calls the refresh method if necessary. - - -### Search - -One of the primary features of Splunk is running searches and retrieving -search results. The following code example shows how to create a search job, -poll for completion, and retrieve the result stream: - - Service service = Service.connect(...); - Job job = service.getJobs().create("search * | head 10") - while (!job.isDone()) { - Thread.sleep(2000); - job.refresh(); - } - InputStream stream = job.getResults(); - -The SDK API has many features such as real-time search, numerous search -options, various types of search results, and the ability to execute -synchronous and asynchronous search requests. To explore core search -features, see the Search example included in the SDK. +To view the coverage report, open +**/splunk-sdk-java/splunk/target/test-report/index.html** in your web browser. ## Repository - + - - - - - - - - - - - - - + + - - - - - - +
build -This directory is created by the build and contains intermediate build +/argsGeneratorThis directory is created by the build and contains intermediate build ouputs
dist -This directory is created by the build and contains final build -outputs
docs -Documentation
examples -Examples demonstrating various SDK features
lib -3rd party libraries used by examples and unit tests/splunk/targetThis directory is created by the build and contains intermediate build +ouputs
splunk +/splunk/src/main Source for com.splunk
splunk-sdk -Source for com.splunk.sdk, utilities shared by examples and -units
tests +/splunk/src/test Source for unit tests
### Changelog -The file CHANGELOG.md in the root of the repository contains a description -of changes for each version of the SDK. You can also find it online at: - -* https://github.com/splunk/splunk-sdk-java/blob/master/CHANGELOG.md +The **CHANGELOG.md** file in the root of the repository contains a description +of changes for each version of the SDK. You can also find it online at +[https://github.com/splunk/splunk-sdk-java/blob/master/CHANGELOG.md](https://github.com/splunk/splunk-sdk-java/blob/master/CHANGELOG.md). ### Branches -The `master` branch always represents a stable and released version of the -SDK. -You can read more about our branching model on our Wiki: - -* https://github.com/splunk/splunk-sdk-java/wiki/Branching-Model - -## Resources - -You can find anything having to do with developing on Splunk at the Splunk -developer portal: - -* http://dev.splunk.com +The **master** branch always represents a stable and released version of the SDK. +You can read more about our branching model on our Wiki at +[https://github.com/splunk/splunk-sdk-java/wiki/Branching-Model](https://github.com/splunk/splunk-sdk-java/wiki/Branching-Model). -For Splunk Java SDK reference documentation, see: +## Documentation and resources -* http://splunk.github.com/splunk-sdk-java/docs/0.1.0/index.html +If you need to know more: -You can also find reference documentation for the REST API: +* For all things developer with Splunk, your main resource is the [Splunk Developer Portal](http://dev.splunk.com). -* http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI +* For conceptual and how-to documentation, see the [Overview of the Splunk SDK for Java](http://dev.splunk.com/view/SP-CAAAECN). -For an introduction to the Splunk product and some of its capabilities: +* For API reference documentation, see the [Splunk SDK for Java Reference](http://docs.splunk.com/Documentation/JavaSDK). -* http://docs.splunk.com/Documentation/Splunk/latest/User/SplunkOverview +* For more about the Splunk REST API, see the [REST API Reference](http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI). -For more information on the SDK and this repository check out our GitHub Wiki +* For more about about Splunk in general, see [Splunk>Docs](http://docs.splunk.com/Documentation/Splunk). -* https://github.com/splunk/splunk-sdk-java/wiki/ +* For more about this SDK's repository, see our [GitHub Wiki](https://github.com/splunk/splunk-sdk-java/wiki/). ## Community @@ -452,46 +417,72 @@ Stay connected with other developers building on Splunk. - + - - - -
EmailEmail devinfo@splunk.com
Issues +Issues https://github.com/splunk/splunk-sdk-java/issues/
Answers +Answers http://splunk-base.splunk.com/tags/java/
Blog +Blog http://blogs.splunk.com/dev/
Twitter +Twitter @splunkdev
+ ### How to contribute -We aren't ready to accept code contributions yet, but will be shortly. Check -this README for more updates soon. +If you would like to contribute to the SDK, go here for more information: + +* [Splunk and open source](http://dev.splunk.com/view/opensource/SP-CAAAEDM) + +* [Individual contributions](http://dev.splunk.com/goto/individualcontributions) + +* [Company contributions](http://dev.splunk.com/view/companycontributions/SP-CAAAEDR) ### Support -* SDKs in Preview will not be Splunk supported. Once the Java SDK moves to an - Open Beta we will provide more detail on support. +1. You will be granted support if you or your company are already covered + under an existing maintenance/support agreement. Send an email to + _support@splunk.com_ and include "Splunk SDK for Java" in the subject line. + +2. If you are not covered under an existing maintenance/support agreement, you + can find help through the broader community at: + + +3. Splunk will NOT provide support for SDKs if the core library (the + code in the splunk directory) has been modified. If you modify an SDK + and want support, you can find help through the broader community and Splunk + answers (see above). We would also like to know why you modified the core + library—please send feedback to _devinfo@splunk.com_. +4. File any issues on [GitHub](https://github.com/splunk/splunk-sdk-java/issues). -* Issues should be filed here: - https://github.com/splunk/splunk-sdk-java/issues ### Contact Us -You can reach the Dev Platform team at devinfo@splunk.com +You can reach the Developer Platform team at _devinfo@splunk.com_. + +## License +The Splunk Java Software Development Kit is licensed under the Apache +License 2.0. Details can be found in the LICENSE file. diff --git a/argsGenerator/README.md b/argsGenerator/README.md new file mode 100644 index 00000000..a0294583 --- /dev/null +++ b/argsGenerator/README.md @@ -0,0 +1,128 @@ +# Args Class Generator + +This tool generates custom `Args` subclasses based on the REST API documentation for the associated endpoint. + + +## Example Usage + +``` +./gen_args_class.py < specs/JobArgs_POST__search_jobs.argspec > Output.java +``` + + +## Quickstart + +For each class that you want to generate, an `.argspec` file must be created that defines the specific parameters supported by the Args class, along with its Java datatype and documentation. + +For example, the specification: + +``` +auto_cancel +AutoCancel +int +Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. +- +The number of seconds after which to cancel a job. +=== +``` + +...generates the following code: + +``` + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. + * + * @param autoCancel + * The number of seconds after which to cancel a job. + */ + public void setAutoCancel(int autoCancel) { + this.put("auto_cancel", autoCancel); + } + + /* END AUTOGENERATED CODE */ +``` + +Notice that the generator does not generate an entire class, but rather only its methods. +The user must manually: + +* Create the class definition and documentation. +* Add the constructor. +* Add any nested `enum` types that the generated setters require. + + +## Argument Specification Format + +Any line that begins with `#` is a comment and will be ignored. Blank lines are significant (and are not ignored). + +Any line at the beginning of the file that begins with `!` is a directive and will change the behavior of the generator. For example: + +``` +# Some arguments are defined multiple times by different copied sections. +# Ignore errors related to this. The first version wins. +!SET ignore_duplicates 1 +``` + +The rest of the file is a series of argument definitions: + +``` +<< machine name >> +<< Java name (upper camelcase) >> +<< Java type >> +<< method description line #1 >> +<< method description line .. >> +<< method description line #n >> +- +<< parameter description line #1 >> +<< parameter description line .. >> +<< parameter description line #n >> +=== +``` + +Note that the last specification must still end with a `===` line. + +### Special Java Types + +A few values for `<< Java type >>` are handled specially: + +* `String[]-MULTIPLE` - Each value will be a separate parameter. + * For example "f = {1,2,3}" would appear as `f=1&f=2&f=3` in the final URL. +* `String[]-CSV` - Values will be submitted as a single comma-separated parameter. + * For example "f = {1,2,3}" would appear as `f=1,2,3` in the final URL. + +### Custom Setter Code + +For more complex cases where the generated accessor is not appropriate (like the Java type `Date`), you can also specify custom code for an argument by adding a `!CODE` line after the argument description and follow that line with custom Java code. + +For example: + +``` +dispatch.earliest_time +DispatchEarliestTime +Date +Sets the earliest time for this search. +- +A date that specifies the earliest time for this search. +!CODE + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchEarliestTime); + this.put("dispatch.earliest_time", timeString); +=== +``` + +...generates this code: + +``` + /** + * Sets the earliest time for this search. + * + * @param dispatchEarliestTime + * A date that specifies the earliest time for this search. + */ + public void setDispatchEarliestTime(Date dispatchEarliestTime) { + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchEarliestTime); + this.put("dispatch.earliest_time", timeString); + } +``` \ No newline at end of file diff --git a/argsGenerator/gen_args_class.py b/argsGenerator/gen_args_class.py new file mode 100755 index 00000000..a5c3d720 --- /dev/null +++ b/argsGenerator/gen_args_class.py @@ -0,0 +1,159 @@ +#!/usr/bin/env python + +import sys + +input = sys.stdin +output = sys.stdout + + +def read_line(): + """ + Returns the next line from the input, including the EOL sequence. + Throws StopIteration on EOF. + + Skips comment lines automatically. + """ + while True: + line = next(input) + if line.startswith('#'): + continue + return line + + +def lowercase_first_letter(string): + return string[0].lower() + string[1:] + + +output.write(""" /* BEGIN AUTOGENERATED CODE */ + +""") + +ignore_duplicates = False +args_already_seen = set() +ignored_machine_names = set() + +try: + while True: + machine_name = read_line()[:-1] + if machine_name.startswith('!'): + # Actually this is a directive. Process it. + directive = machine_name + if directive == '!SET ignore_duplicates 1': + ignore_duplicates = True + elif directive.startswith('!SUPPRESS '): + machine_name = directive[len('!SUPPRESS '):] + ignored_machine_names.add(machine_name) + else: + sys.exit("Unknown directive: %s" % directive) + continue + java_name = read_line()[:-1] + type = read_line()[:-1] + + description_lines = [] + reading_description = True + code_lines = None + while True: + line = read_line() + if line.startswith('!CODE'): + code_lines = [] + reading_description = False + continue + if line.startswith('='): + break + + if reading_description: + description_lines.append(line) + else: + code_lines.append(line) + + if not java_name[0].isupper(): + sys.exit("Expected first letter to be uppercase: %s" % java_name) + java_name_lower = lowercase_first_letter(java_name) + + # Generate the setter code + if code_lines is not None: + # Custom code for this setter + code = ''.join(code_lines)[:-1]; + else: + # Standard code for this setter, depending on its parameter type + code = """ this.put("%s", %s);""" % (machine_name, java_name_lower) + if '[]' in type or type == 'Date': + if type == 'String[]-MULTIPLE': + type = 'String[]' + code = """ this.put("%s", %s);""" % (machine_name, java_name_lower) + elif type == 'String[]-CSV': + type = 'String[]' + code = """ StringBuilder csv = new StringBuilder(); + for (int i = 0, n = %s.length; i < n; i++) { + if (i != 0) { + csv.append(","); + } + csv.append(%s[i]); + } + + this.put("%s", String.valueOf(csv));""" % (java_name_lower, java_name_lower, machine_name) + else: + sys.exit("Don't know how to encode an array of type: %s" % type); + + # Split description_lines -> {method_description_lines, param_description_lines} + method_description_lines = [] + param_description_lines = [] + saw_description_separator = False + for line in description_lines: + if line.startswith('-'): + saw_description_separator = True + continue + + if not saw_description_separator: + method_description_lines.append(line) + else: + param_description_lines.append(line) + + if not saw_description_separator: + print ('WARNING: No separate method description found for ' + + 'argument %s. This is against convention.') % machine_name + param_description_lines = method_description_lines + method_description_lines = [] + + # Format method_description_lines + method_description_formatted = '' + if method_description_lines != []: + for line in method_description_lines: + method_description_formatted += ' * %s' % line + method_description_formatted += ' * \n' + + # Format param_description_lines + param_description_formatted = '' + for line in param_description_lines: + param_description_formatted += ' * %s' % line + + cur_arg = (machine_name, type) + if cur_arg in args_already_seen: + if ignore_duplicates: + continue + else: + sys.exit("Multiple definitions for argument: %s %s" % ( + type, machine_name)); + else: + args_already_seen.add(cur_arg) + + # Output the current argument + if machine_name not in ignored_machine_names: + output.write(""" /** +%s * @param %s +%s */ + public void set%s(%s %s) { +%s + } + +""" % (method_description_formatted, + java_name_lower, param_description_formatted, + java_name, type, java_name_lower, + code)) + +except StopIteration: + # Done! + pass + +output.write(""" /* END AUTOGENERATED CODE */ +""") \ No newline at end of file diff --git a/argsGenerator/specs/CollectionArgs__GET_collection.argspec b/argsGenerator/specs/CollectionArgs__GET_collection.argspec new file mode 100644 index 00000000..01d52797 --- /dev/null +++ b/argsGenerator/specs/CollectionArgs__GET_collection.argspec @@ -0,0 +1,63 @@ +app +App +String +Sets the app context in which to list the collection. +- +The app context in which to list the collection. A {@code null} value indicates no app context, and a value of {@code "-"} indicates an app wildcard. +=== +owner +Owner +String +Sets the owner context in which to list the collection. +- +The owner context in which to list the collection. A value of {@code "-"} indicates a wildcard, and a {@code null} value indicates no owner context. +=== +sharing +Sharing +String +Sets the sharing context in which to list the collection. +- +The sharing context in which to list the collection. Valid values are "user", "app", "global", and "system". +=== +count +Count +int +Sets the maximum number of entries to return. +- +The maximum number of entries to return. To return all entries, specify 0. +=== +offset +Offset +int +Sets the index of the first entry to return. +- +The index of the first entry to return. +=== +search +Search +String +Sets a search query to filter the response. The response matches field values against the search query. For example, "foo" matches any object that has "foo" as a substring in a field, and "field_name=field_value" restricts the match to a single field. +- +A search query to filter the response. +=== +sort_dir +SortDirection +SortDirection +Sets the direction to sort entries. +- +The sorting order--ascending or descending. +=== +sort_key +SortKey +String +Sets the field to use for sorting. +- +The field to sort by. +=== +sort_mode +SortMode +SortMode +Sets the mode to use for sorting. +- +The collating sequence for sorting entries. +=== diff --git a/argsGenerator/specs/IndexCollectionArgs__GET_data_indexes.argspec b/argsGenerator/specs/IndexCollectionArgs__GET_data_indexes.argspec new file mode 100644 index 00000000..4b073d67 --- /dev/null +++ b/argsGenerator/specs/IndexCollectionArgs__GET_data_indexes.argspec @@ -0,0 +1,17 @@ +count +Count +int +Sets the maximum number of entries to return. +- +The maximum number of entries to return. To return all entries, specify -1. +!CODE + super.setCount(count); +=== +summarize +Summarize +boolean +Sets whether to omits certain index details to provide a faster response. +- +{@code true} to omit index details for a faster response, +{@code false} if not. +=== diff --git a/argsGenerator/specs/JobArgs__POST_search_jobs.argspec b/argsGenerator/specs/JobArgs__POST_search_jobs.argspec new file mode 100644 index 00000000..3b00c1af --- /dev/null +++ b/argsGenerator/specs/JobArgs__POST_search_jobs.argspec @@ -0,0 +1,206 @@ +# NOTE: Large sections of this specification have been copied to +# JobExportArgs__GET_search_jobs_export.argspec, which should be +# updated (and regenerated) to reflect changes made to this file. +# +auto_cancel +AutoCancel +int +Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. +- +The number of seconds after which to cancel a job. +=== +auto_finalize_ec +AutoFinalizeEventCount +int +Sets the number of events to process after which to auto-finalize the search. A value of 0 means no limit. +- +The number of events. +=== +auto_pause +AutoPause +int +Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. +- +The number of seconds after which to pause. +=== +# TODO: Make Date version. +earliest_time +EarliestTime +String +Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +enable_lookups +EnableLookups +boolean +Indicates whether to enable lookups for this search. Enabling lookups might slow searches significantly depending on the nature of the lookups. +- +{@code true} to enable lookups, {@code false} if not. +=== +exec_mode +ExecutionMode +ExecutionMode +Sets the type of search to run ("blocking", "oneshot", or "normal"). +- +The search type. +=== +force_bundle_replication +ForceBundleReplication +boolean +Specifies whether this search should cause (and wait depending on the value of {@code setSynchronizeBundleReplication}) bundle synchronization with all search peers. +- +{@code true} if this search should cause bundle synchronization, +{@code false} if not. +=== +id +Id +String +Sets a search ID (SID). If unspecified, a random ID is generated. +- +The search ID. +=== +# TODO: Make Date version. +latest_time +LatestTime +String +Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +max_count +MaximumCount +int +Sets the number of events that can be accessible in any given status bucket. Also, in transforming mode, this sets the maximum number of results to store. Specifically, in all calls, {@code codeoffset + count <= max_count}. +- +The maximum count of events. +=== +max_time +MaximumTime +int +Sets the maximum number of seconds to run this search before finalizing. Specify 0 to never finalize. +- +The maximum time, in seconds. +=== +namespace +Namespace +String +Specifies the application namespace to which to restrict searches. +- +The namespace. +=== +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +now +Now +String +Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.

You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.

For information about relative time modifiers, see Time modifiers for search in the Search Reference. +- +The time string. +=== +reduce_freq +ReduceFrequency +int +Sets the time to wait between running the MapReduce phase on accumulated map values. +- +The time to wait, in seconds. +=== +reload_macros +ReloadMacros +boolean +Indicates whether to reload macro definitions from the macros.conf configuration file. +- +{@code true} to reload macro definitions, {@code false} if not. +=== +remote_server_list +RemoteServerList +String[]-CSV +Sets a list of (possibly wildcarded) servers from which to pull raw events. This same server list is used in subsearches. +- +The list of servers. +=== +rf +RequiredFieldList +String[]-MULTIPLE +Sets one or more required fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. +- +The list of fields. +=== +rt_blocking +RealtimeBlocking +boolean +Indicates whether the indexer blocks if the queue for this search is full. Only applies to real-time searches. +- +{@code true} to block the indexer for a full queue, {@code false} if not. +=== +rt_indexfilter +RealtimeIndexFilter +boolean +Indicates whether the indexer pre-filters events. Only applies to real-time searches. +- +{@code true} to pre-filter events, {@code false} if not. +=== +rt_maxblocksecs +RealtimeMaximumBlockSeconds +int +Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. +- +The maximum time to block, in seconds. +=== +rt_queue_size +RealtimeQueueSize +int +Sets the number indicating the queue size (in events) that the indexer should use for this search. Only applies to real-time searches. +- +The queue size, in events. +=== +search_listener +SearchListener +String +Sets a string that registers a search state listener with the search. Use the format: {@code search_state;results_condition;http_method;uri;}

For example:

{@code search_listener=onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;} +- +The search listener string. +=== +search_mode +SearchMode +SearchMode +Sets the search mode ("normal" or "realtime"). +- +The search mode. +=== +spawn_process +SpawnProcess +boolean +Indicates whether the search should run in a separate spawned process. Searches against indexes must run in a separate process. +- +{@code true} to run the search in a separate process, {@code false} if not. +=== +status_buckets +StatusBuckets +int +Sets the maximum number of status buckets to generate. A value of 0 means to not generate timeline information. +- +The maximum number of buckets. +=== +sync_bundle_replication +SynchronizeBundleReplication +boolean +Indicates whether this search should wait for bundle replication to complete. +- +{@code true} to wait for bundle replication, {@code false} if not. +=== +# TODO: Improve docs: There is no {start,end}_time. Perhaps {earliest,latest}_time was intended? +time_format +TimeFormat +String +Sets the format for converting a formatted time string from {start,end}_time into UTC seconds. The default value is ISO-8601. +- +The time format string. +=== +timeout +Timeout +int +Sets the number of seconds to keep this search after processing has stopped. +- +The timeout, in seconds. +=== \ No newline at end of file diff --git a/argsGenerator/specs/JobEventsArgs__GET_search_jobs_NAME_events.argspec b/argsGenerator/specs/JobEventsArgs__GET_search_jobs_NAME_events.argspec new file mode 100644 index 00000000..8f27af38 --- /dev/null +++ b/argsGenerator/specs/JobEventsArgs__GET_search_jobs_NAME_events.argspec @@ -0,0 +1,95 @@ +# NOTE: The entire contents of this specification have been copied to +# JobExportArgs__GET_search_jobs_export.argspec, which should be +# updated (and regenerated) to reflect changes made to this file. +# +count +Count +int +Sets the maximum number of results to return. To return all available results, specify 0. The default value is 100. +- +The maximum number of results. +=== +# TODO: Make Date version. +earliest_time +EarliestTime +String +Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +# TODO: Make Date version. +latest_time +LatestTime +String +Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +max_lines +MaximumLines +int +Sets the maximum number of lines that any single event's _raw field should contain. +- +The maximum number of lines. For no limit, specify 0. +=== +offset +Offset +int +Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.

In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. +- +The index of the first result to return. +=== +# TODO: Improve docs: The referenced document does not actually document the enum constants. +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +output_time_format +OutputTimeFormat +String +Sets a UTC time format. +- +A UTC time format. +=== +search +Search +String +Sets the post-processing search to apply to results. +- +The post-processing search query. +=== +# TODO: Improve docs: What are the valid values for this parameter? +segmentation +Segmentation +String +Sets the type of segmentation to perform on the data, including an option to perform k/v segmentation. +- +The segmentation type. +=== +# TODO: Are you sure this is the default? This time format lacks time zone and millisecond resolution. +# TODO: Improve docs: There is no {start,end}_time. Perhaps {earliest,latest}_time was intended? +time_format +TimeFormat +String +Specifies an expression to convert a formatted time string from {start,end}_time into UTC seconds. The default format is "%m/%d/%Y:%H:%M:%S". +- +The time format. +=== +# TODO: Improve docs: What effect does each value have? +truncation_mode +TruncationMode +TruncationMode +Specifies how to truncate lines to achieve the value in {@link #setMaximumLines}. +- +The truncation mode. +=== diff --git a/argsGenerator/specs/JobExportArgs__GET_search_jobs_export.argspec b/argsGenerator/specs/JobExportArgs__GET_search_jobs_export.argspec new file mode 100644 index 00000000..02fe3438 --- /dev/null +++ b/argsGenerator/specs/JobExportArgs__GET_search_jobs_export.argspec @@ -0,0 +1,372 @@ +# This endpoint is unusual in that most of its arguments are copied straight +# from other endpoints. In particular: +# * POST search/jobs +# * GET search/jobs/{search_id}/events +# * GET search/jobs/{search_id}/results +# +# Sections of arguments that have been copied from other files are clearly +# marked by comments. +# +# %%%%%%%%%%%%%%%%%% +# %%% DIRECTIVES %%% +# %%%%%%%%%%%%%%%%%% +# +# Some arguments are defined multiple times by different copied sections. +# Ignore errors related to this. The first version wins. +!SET ignore_duplicates 1 +# +# Some arguments from included endpoints do not apply. Ignore them. +!SUPPRESS id +!SUPPRESS count +!SUPPRESS f +!SUPPRESS offset +!SUPPRESS search +# +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%% Unique to this endpoint %%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +index_earliest +IndexEarliest +String +Specifies the earliest time in the time range to search, based on the index time. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +index_latest +IndexLatest +String +Specifies the latest time in the time range to search, based on the index time. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%% Subset of arguments from POST search/jobs %%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +auto_cancel +AutoCancel +int +Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. +- +The number of seconds after which to cancel a job. +=== +auto_finalize_ec +AutoFinalizeEventCount +int +Sets the number of events to process after which to auto-finalize the search. A value of 0 means no limit. +- +The number of events. +=== +auto_pause +AutoPause +int +Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. +- +The number of seconds after which to pause. +=== +# TODO: Make Date version. +earliest_time +EarliestTime +String +Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +enable_lookups +EnableLookups +boolean +Indicates whether to enable lookups for this search. Enabling lookups might slow searches significantly depending on the nature of the lookups. +- +{@code true} to enable lookups, {@code false} if not. +=== +force_bundle_replication +ForceBundleReplication +boolean +Specifies whether this search should cause (and wait depending on the value of {@code setSynchronizeBundleReplication}) bundle synchronization with all search peers. +- +{@code true} if this search should cause bundle synchronization, {@code false} if not. +=== +id +Id +String +Sets a search ID (SID). If unspecified, a random ID is generated. +- +The search ID. +=== +# TODO: Make Date version. +latest_time +LatestTime +String +Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +max_time +MaximumTime +int +Sets the number of seconds to run this search before finalizing. Specify 0 to never finalize. +- +The maximum time, in seconds. +=== +namespace +Namespace +String +Specifies the application namespace in which to restrict searches. +- +The namespace. +=== +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +now +Now +String +Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.

You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.

For information about relative time modifiers, see Time modifiers for search in the Search Reference. +- +A time string. +=== +reduce_freq +ReduceFrequency +int +Sets the time to wait between running the MapReduce phase on accumulated map values. +- +The time to wait, in seconds. +=== +reload_macros +ReloadMacros +boolean +Indicates whether to reload macro definitions from the macros.conf configuration file. +- +{@code true} to reload macro definitions, {@code false} if not. +=== +remote_server_list +RemoteServerList +String[]-CSV +Sets a list of (possibly wildcarded) servers from which to pull raw events. This same server list is used in subsearches. +- +A list of servers. +=== +rf +RequiredFieldList +String[]-MULTIPLE +Sets one or more required fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. +- +The list of fields. +=== +rt_blocking +RealtimeBlocking +boolean +Indicates whether the indexer blocks if the queue for this search is full. Only applies to real-time searches. +- +{@code true} to block the indexer for a full queue, {@code false} if not. +=== +rt_indexfilter +RealtimeIndexFilter +boolean +Indicates whether the indexer pre-filters events. Only applies to real-time searches. +- +{@code true} to pre-filter events, {@code false} if not. +=== +rt_maxblocksecs +RealtimeMaximumBlockSeconds +int +Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. +- +The maximum time to block, in seconds. +=== +rt_queue_size +RealtimeQueueSize +int +Sets the number indicating the queue size (in events) that the indexer should use for this search. Only applies to real-time searches. +- +The queue size, in events. +=== +search_listener +SearchListener +String +Sets a string that registers a search state listener with the search. Use the format: {@code search_state;results_condition;http_method;uri;}

For example:

{@code search_listener=onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;} +- +The search listener string. +=== +search_mode +SearchMode +SearchMode +Sets the search mode ("normal" or "realtime"). +- +The search mode. +=== +sync_bundle_replication +SynchronizeBundleReplication +boolean +Indicates whether this search should wait for bundle replication to complete. +- +{@code true} to wait for bundle replication, {@code false} if not. +=== +# TODO: Improve docs: There is no {start,end}_time. Perhaps {earliest,latest}_time was intended? +time_format +TimeFormat +String +Sets the format for converting a formatted time string from {start,end}_time into UTC seconds. The default value is ISO-8601. +- +The time format string. +=== +timeout +Timeout +int +Sets the number of seconds to keep this search after processing has stopped. +- +The timeout, in seconds. +=== +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%% GET search/jobs/{search_id}/events %%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# NOTE: The entire contents of this specification have been copied to +# JobExportArgs__GET_search_jobs_export.argspec, which should be +# updated (and regenerated) to reflect changes made to this file. +# +count +Count +int +Sets the maximum number of results to return. To return all available results, specify 0. The default value is 100. +- +The maximum number of results. +=== +# TODO: Make Date version. +earliest_time +EarliestTime +String +Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +# TODO: Make Date version. +latest_time +LatestTime +String +Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +max_lines +MaximumLines +int +Sets the maximum number of lines that any single event's _raw field should contain. +- +The maximum number of lines. For no limit, specify 0. +=== +offset +Offset +int +Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.

In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. +- +The index of the first result to return. +=== +# TODO: Improve docs: The referenced document does not actually document the enum constants. +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +output_time_format +OutputTimeFormat +String +Sets a UTC time format. +- +A UTC time format. +=== +search +Search +String +Sets the post-processing search to apply to results. +- +The post-processing search query. +=== +# TODO: Improve docs: What are the valid values for this parameter? +segmentation +Segmentation +String +Sets the type of segmentation to perform on the data, including an option to perform k/v segmentation. +- +The segmentation type. +=== +# TODO: Are you sure this is the default? This time format lacks time zone and millisecond resolution. +# TODO: Improve docs: There is no {start,end}_time. Perhaps {earliest,latest}_time was intended? +time_format +TimeFormat +String +Specifies an expression to convert a formatted time string from {start,end}_time into UTC seconds. The default format is "%m/%d/%Y:%H:%M:%S". +- +The time format. +=== +# TODO: Improve docs: What effect does each value have? +truncation_mode +TruncationMode +TruncationMode +Specifies how to truncate lines to achieve the value in {@link #setMaximumLines}. +- +The truncation mode. +=== +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# %%% GET search/jobs/{search_id}/results %%% +# %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +# NOTE: The entire contents of this specification have been copied to +# JobExportArgs__GET_search_jobs_export.argspec, which should be +# updated (and regenerated) to reflect changes made to this file. +# +# TODO: Improve docs: Formatting of the description differs from that of +# GET search/jobs/{search_id}/results. Otherwise all other parameters are identical. +count +Count +int +Sets the maximum number of results to return. +- +The maximum number of results. To return all available results, specify 0. +=== +# TODO: Improve docs: Why isn't "field_list" deprecated when there is "f" present? +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +offset +Offset +int +Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.

In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. +- +The index of the first result to return. +=== +# TODO: Improve docs: The referenced document does not actually document the enum constants. +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +search +Search +String +Sets the post-processing search to apply to results. +- +The post-processing search query. +=== diff --git a/argsGenerator/specs/JobResultsArgs__GET_search_jobs_NAME_results.argspec b/argsGenerator/specs/JobResultsArgs__GET_search_jobs_NAME_results.argspec new file mode 100644 index 00000000..5a13dfd5 --- /dev/null +++ b/argsGenerator/specs/JobResultsArgs__GET_search_jobs_NAME_results.argspec @@ -0,0 +1,43 @@ +# NOTE: The entire contents of this specification have been copied to +# JobExportArgs__GET_search_jobs_export.argspec, which should be +# updated (and regenerated) to reflect changes made to this file. +# +# TODO: Improve docs: Formatting of the description differs from that of +# GET search/jobs/{search_id}/results. Otherwise all other parameters are identical. +count +Count +int +Sets the maximum number of results to return. +- +The maximum number of results. To return all available results, specify 0. +=== +# TODO: Improve docs: Why isn't "field_list" deprecated when there is "f" present? +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +offset +Offset +int +Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.

In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. +- +The index of the first result to return. +=== +# TODO: Improve docs: The referenced document does not actually document the enum constants. +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +search +Search +String +Sets the post-processing search to apply to results. +- +The post-processing search query. +=== diff --git a/argsGenerator/specs/JobResultsPreviewArgs__GET_search_jobs_NAME_results_preview.argspec b/argsGenerator/specs/JobResultsPreviewArgs__GET_search_jobs_NAME_results_preview.argspec new file mode 100644 index 00000000..a37eb28a --- /dev/null +++ b/argsGenerator/specs/JobResultsPreviewArgs__GET_search_jobs_NAME_results_preview.argspec @@ -0,0 +1,39 @@ +# TODO: Improve docs: Formatting of the description differs from that of +# GET search/jobs/{search_id}/results_preview. Otherwise all other parameters are identical. +count +Count +int +Sets the maximum number of results to return. +- +The maximum number of results. To return all available results, specify 0. +=== +# TODO: Improve docs: Why isn't "field_list" deprecated when there is "f" present? +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +offset +Offset +int +Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.

In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. +- +The index of the first result to return. +=== +# TODO: Improve docs: The referenced document does not actually document the enum constants. +output_mode +OutputMode +OutputMode +Sets the format of the output. +- +The output format. +=== +search +Search +String +Sets the post-processing search to apply to results. +- +The post-processing search query. +=== diff --git a/argsGenerator/specs/JobSummaryArgs__GET_search_jobs_NAME_summary.argspec b/argsGenerator/specs/JobSummaryArgs__GET_search_jobs_NAME_summary.argspec new file mode 100644 index 00000000..ee99882a --- /dev/null +++ b/argsGenerator/specs/JobSummaryArgs__GET_search_jobs_NAME_summary.argspec @@ -0,0 +1,72 @@ +# TODO: Make Date version. +# TODO: Improve docs: "respectively"? +earliest_time +EarliestTime +String +Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The earliest time. +=== +f +FieldList +String[]-MULTIPLE +Sets a list of fields to return for the event set. +- +A list of fields. +=== +histogram +Histogram +boolean +Indicates whether to add histogram data to the summary output. +- +{@code true} to add histogram data, {@code false} if not. +=== +# TODO: Make Date version. +# TODO: Improve docs: "respectively"? +latest_time +LatestTime +String +Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. +- +The latest time. +=== +min_freq +MinimumFrequency +double +Sets the fraction of results for each key that this key must occur in to be displayed. +- +The frequency, as a fraction (a value between 0 and 1). +=== +# TODO: Improve docs: The description and default value contradict each other. +output_time_format +OutputTimeFormat +String +Sets a UTC time format. +- +A UTC time format. +=== +search +Search +String +Sets a search query to filter the response. The response matches field values against the search query. For example, "foo" matches any object that has "foo" as a substring in a field, and "field_name=field_value" restricts the match to a single field. +- +A search substring. +=== +# TODO: Improve docs: The default value specified does not match that of the description. +# (It is missing a trailing S). The description version is probably right. +# TODO: Improve docs: Are you sure this is the default? This time format lacks time zone and millisecond resolution. +# TODO: Improve docs: There is no {start,end}_time. Perhaps {earliest,latest}_time was intended? +time_format +TimeFormat +String +Specifies an expression to convert a formatted time string from {start,end}_time into UTC seconds. The default format is "%m/%d/%Y:%H:%M:%S". +- +The time format. +=== +top_count +TopCount +int +Sets for each key how many of the most frequent items to return. +- +The number of items to return. +=== diff --git a/argsGenerator/specs/SavedSearchCollectionArgs__GET_saved_searches.argspec b/argsGenerator/specs/SavedSearchCollectionArgs__GET_saved_searches.argspec new file mode 100644 index 00000000..489f6485 --- /dev/null +++ b/argsGenerator/specs/SavedSearchCollectionArgs__GET_saved_searches.argspec @@ -0,0 +1,18 @@ +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +earliest_time +EarliestTime +String +Sets the earliest time for which to display the scheduled times for scheduled searches (not just the next run time). +- +The earliest time. +=== +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +latest_time +LatestTime +String +Sets the latest time until which to display the scheduled times for scheduled searches (not just the next run time). +- +The latest time. +=== diff --git a/argsGenerator/specs/SavedSearchDispatchArgs__POST_saved_searches_NAME_dispatch.argspec b/argsGenerator/specs/SavedSearchDispatchArgs__POST_saved_searches_NAME_dispatch.argspec new file mode 100644 index 00000000..f4056f22 --- /dev/null +++ b/argsGenerator/specs/SavedSearchDispatchArgs__POST_saved_searches_NAME_dispatch.argspec @@ -0,0 +1,129 @@ +# TODO: Improve docs: What is the accepted time format? +# TODO: Make Date version. +dispatch.now +DispatchNow +String +Sets a time that dispatches the search as though the specified time were the current time. +- +A string with the specified time. +=== +dispatch.buckets +DispatchBuckets +int +Sets the maximum number of timeline buckets. +- +The maximum number of timeline buckets. +=== +dispatch.earliest_time +DispatchEarliestTime +String +Specifies the earliest time for this search. This value can be a relative or absolute time. If this value is an absolute time, use {@link #setDispatchTimeFormat} to format the value. +- +A time string that specifies the earliest time for this search. +=== +dispatch.earliest_time +DispatchEarliestTime +Date +Sets the earliest time for this search. +- +A date that specifies the earliest time for this search. +!CODE + // Documented format: "%FT%T.%Q%:z" + // strftime original format: "%FT%T.%Q%:z" + // strftime expanded format: "%Y-%m-%dT%H:%M:%S.%Q%:z" + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchEarliestTime); + this.put("dispatch.earliest_time", timeString); +=== +dispatch.latest_time +DispatchLatestTime +String +Specifies the latest time for this search. This value can be a relative or absolute time. If this value is an absolute time, use {@link #setDispatchTimeFormat} to format the value. +- +A time string that specifies the latest time for this search. +=== +dispatch.latest_time +DispatchLatestTime +Date +Sets the latest time for this search. +- +A date that specifies the latest time for this saved search. +!CODE + // Documented format: "%FT%T.%Q%:z" + // strftime original format: "%FT%T.%Q%:z" + // strftime expanded format: "%Y-%m-%dT%H:%M:%S.%Q%:z" + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchLatestTime); + this.put("dispatch.latest_time", timeString); +=== +dispatch.lookups +DispatchLookups +boolean +Indicates whether to enable lookups for this search. +- +{@code true} to enable lookups, {@code false} if not. +=== +dispatch.max_count +DispatchMaximumCount +int +Sets the maximum number of results before finalizing the search. +- +The maximum number of results. +=== +dispatch.max_time +DispatchMaximumTime +int +Sets the the maximum amount of time before finalizing the search. +- +The maximum amount of time, in seconds. +=== +dispatch.reduce_freq +DispatchReduceFrequency +int +Set the frequency for how often Splunk should run the MapReduce reduce phase on accumulated map values. +- +The frequency, in seconds. +=== +dispatch.rt_backfill +DispatchRealTimeBackfill +boolean +Indicates whether to back fill the real-time window for this search. This value only applies to real-time searches. +- +{@code true} to back fill the real-time window, {@code false} if not. +=== +dispatch.spawn_process +DispatchSpawnProcess +boolean +Indicates whether the search should run in a separate spawned process. Searches against indexes must run in a separate process. +- +{@code true} to run the search in a separate process, {@code false} if not. +=== +dispatch.time_format +DispatchTimeFormat +String +Sets a time format for Splunk to use to specify the earliest and latest times. +- +A time format string. +=== +dispatch.ttl +# The TTL acronym is not expanded here to be consistent with Job.getTtl +DispatchTtl +String +Indicates the time to live (TTL) for the artifacts of the scheduled search, if no actions are triggered. If an action is triggered, Splunk changes the TTL to that action's TTL. If multiple actions are triggered, Splunk applies the maximum TTL to the artifacts. To set the action's TTL, refer to alert_actions.conf.spec. +- +The time to live, in seconds. If the value is a number followed by "p", it is the number of scheduled search periods. +=== +trigger_actions +TriggerActions +boolean +Indicates whether to trigger alert actions. +- +{@code true} to trigger alert actions, {@code false} if not. +=== +force_dispatch +ForceDispatch +boolean +Indicates whether to start a new search, even if another instance of this search is already running. +- +{@code true} to start a new search, {@code false} if not. +=== diff --git a/build.properties b/build.properties deleted file mode 100644 index 457f19c1..00000000 --- a/build.properties +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 2011 Splunk, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"): you may -# not use this file except in compliance with the License. You may obtain -# a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT -# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the -# License for the specific language governing permissions and limitations -# under the License. - -version.number=0.1.0 - -dir.build=build -dir.build.examples=${dir.build}/examples -dir.build.splunk=${dir.build}/splunk -dir.build.splunk-sdk=${dir.build}/splunk-sdk -dir.build.tests=${dir.build}/tests -dir.dist=dist -dir.dist.docs=${dir.dist}/docs -dir.dist.examples=${dir.dist}/examples -dir.examples=examples -dir.lib=lib -dir.splunk=splunk -dir.splunk-sdk=splunk-sdk -dir.tests=tests - -lib.commons-cli=${dir.lib}/commons-cli-1.2.jar -lib.junit=${dir.lib}/junit-4.8.1.jar -lib.org-openide-explorer=${dir.lib}/org-openide-explorer.jar -lib.org-openide-nodes=${dir.lib}/org-openide-nodes.jar -lib.org-openide-util=${dir.lib}/org-openide-util.jar -lib.org-openide-util-lookup=${dir.lib}/org-openide-util-lookup.jar - -dist.splunk=${dir.dist}/splunk.jar -dist.splunk-sdk=${dir.dist}/splunk-sdk.jar -dist.tests=${dir.dist}/tests.jar diff --git a/build.xml b/build.xml deleted file mode 100644 index b19ce9ea..00000000 --- a/build.xml +++ /dev/null @@ -1,308 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/deploy b/deploy new file mode 100755 index 00000000..ab8acd24 --- /dev/null +++ b/deploy @@ -0,0 +1,34 @@ +#!/usr/bin/env bash + +declare -r scriptDirectory="$(dirname $(readlink -e $0))" +declare -r scriptName="$(basename $0)" +declare -r version="1.9.5" + +if [[ $# -ne 1 ]]; then + echo 1>&2 "Usage: ${scriptName} {local|staging||production}" +fi + +case $1 in +local) + declare -r url="file:///${HOME}/.m2/repository/" + declare -r repositoryId="" + ;; +staging) + declare -r url="http://stg-artifactory:8081/artifactory/devplat-staging/" + declare -r repositoryId="splunk-staging-artifactory" + ;; +production) + declare -r url="https://splunk.artifactoryonline.com/splunk/ext-releases-local/" + declare -r repositoryId="splunk-production-artifactory" + ;; +esac + +cd "${scriptDirectory}" + +mvn deploy:deploy-file -Ddescription="The Splunk SDK for Java" -Dfile=dist/splunk-${version}.jar \ + -DgroupId=com.splunk -DartifactId=splunk -Dversion=${version}.0 -Dpackaging=jar \ + -Djavadoc=dist/splunk-${version}-javadoc.jar \ + -Dsources=dist/splunk-${version}-sources.jar \ + -DrepositoryId="${repositoryId}" \ + -DupdateReleaseInfo=true \ + -Durl="${url}" diff --git a/deploy.md b/deploy.md new file mode 100644 index 00000000..aed545f5 --- /dev/null +++ b/deploy.md @@ -0,0 +1,38 @@ +##NAME + +deploy - Transmit splunk-sdk-java artifacts to the local, staging or production +maven artifact repository + +##SYNOPSIS + +deploy \ + +##DESCRIPTION + +Deploy transmits **target/splunk-1.9.5.jar**, **target/splunk-1.9.5-javadoc.jar**, and +**target/splunk-1.9.5-sources.jar** to the **local**, **staging**, or **production** +maven repository. Repository names are mapped to locations as follows. + +| repository-name | location | +|-----------------|----------------------------------------------------------------| +| local | file:///${HOME}/.m2/repository/ | +| staging | http://stg-artifactory:8081/artifactory/devplat-staging/ | | +| production | https://splunk.jfrog.io/artifactory/ext-releases-local/ | + +After deployment you should find this tree structure at the location of your repository + + com/splunk/splunk/1.9.5/ + ├── splunk-1.9.5-javadoc.jar + ├── splunk-1.9.5-javadoc.jar.md5 + ├── splunk-1.9.5-javadoc.jar.sha1 + ├── splunk-1.9.5-sources.jar + ├── splunk-1.9.5-sources.jar.md5 + ├── splunk-1.9.5-sources.jar.sha1 + ├── splunk-1.9.5.jar + ├── splunk-1.9.5.jar.md5 + ├── splunk-1.9.5.jar.sha1 + ├── splunk-1.9.5.pom + ├── splunk-1.9.5.pom.md5 + └── splunk-1.9.5.pom.sha1 + +Verify this structure prior to release. diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 00000000..4584c6d3 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,23 @@ +version: '3.6' + +services: + splunk: + image: "splunk/splunk:latest" + container_name: splunk + environment: + - SPLUNK_START_ARGS=--accept-license + - SPLUNK_HEC_TOKEN=11111111-1111-1111-1111-1111111111113 + - SPLUNK_PASSWORD=changed! + - SPLUNK_APPS_URL=https://github.com/splunk/sdk-app-collection/releases/download/v1.1.0/sdkappcollection.tgz + - JAVA_VERSION=openjdk:8 + ports: + - 8000:8000 + - 8088:8088 + - 8089:8089 + - 10667:10667 + - 10668:10668/udp + healthcheck: + test: ['CMD', 'curl', '-f', 'http://localhost:8000'] + interval: 5s + timeout: 5s + retries: 20 diff --git a/examples/explorer/explorer.iml b/examples/examples.iml similarity index 68% rename from examples/explorer/explorer.iml rename to examples/examples.iml index f878340c..a8093d19 100644 --- a/examples/explorer/explorer.iml +++ b/examples/examples.iml @@ -8,8 +8,11 @@ - + + + + diff --git a/examples/export/export.iml b/examples/export/export.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/export/export.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/index/index.iml b/examples/index/index.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/index/index.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/pom.xml b/examples/pom.xml new file mode 100644 index 00000000..18bbb711 --- /dev/null +++ b/examples/pom.xml @@ -0,0 +1,120 @@ + + + 4.0.0 + + examples + + splunk-sdk-java + com.splunk + 1.0.1 + + + + + + org.apache.maven.plugins + maven-surefire-plugin + 3.0.0-M5 + + true + + + + + org.apache.maven.plugins + maven-deploy-plugin + 3.0.0-M1 + + true + + + + + + + + com.splunk + splunk + 1.9.5 + provided + + + org.netbeans.api + org-openide-util-lookup + RELEASE124 + + + org.netbeans.api + org-openide-util + RELEASE124 + + + org.netbeans.api + org-openide-filesystems + RELEASE124 + + + org.netbeans.api + org-openide-awt + RELEASE124 + + + org.netbeans.api + org-openide-dialogs + RELEASE124 + + + org.netbeans.api + org-openide-nodes + RELEASE124 + + + org.netbeans.api + org-openide-explorer + RELEASE124 + + + org.netbeans.api + org-openide-execution + RELEASE124 + + + org.netbeans.api + org-openide-modules + RELEASE124 + + + org.netbeans.api + org-openide-windows + RELEASE124 + + + org.netbeans.api + org-openide-text + RELEASE124 + + + org.netbeans.api + org-openide-options + RELEASE124 + + + org.netbeans.api + org-openide-loaders + RELEASE124 + + + org.netbeans.api + org-openide-io + RELEASE124 + + + org.netbeans.api + org-openide-actions + RELEASE124 + + + + diff --git a/examples/search_blocking/search_blocking.iml b/examples/search_blocking/search_blocking.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/search_blocking/search_blocking.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/search_oneshot/search_oneshot.iml b/examples/search_oneshot/search_oneshot.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/search_oneshot/search_oneshot.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/search_realtime/search_realtime.iml b/examples/search_realtime/search_realtime.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/search_realtime/search_realtime.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/spurl/spurl.iml b/examples/spurl/spurl.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/spurl/spurl.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/examples/src/main/java/com/splunk/examples/endpoint_instantiation/Program.java b/examples/src/main/java/com/splunk/examples/endpoint_instantiation/Program.java new file mode 100644 index 00000000..8cb24f5e --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/endpoint_instantiation/Program.java @@ -0,0 +1,61 @@ +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.endpoint_instantiation; + +import com.splunk.*; + +/** + * This example shows how to access any Splunk REST API endpoint. + * Here, we are just getting an EntityCollection of Entity objects representing + * apps on the Splunk server. + * + * You can also write a class which inherits from the Entity class. + * A minimal example of this is: + * + * public class MyEntity extends Entity { + * MyEntity(Service service, String path) { + * super(service, path); + * } + * } + * + * Then, you can write a class which inherits from the EntityCollection class. + * A minimal example of this is: + * + * public class MyEntityCollection extends EntityCollection { + * MyEntityCollection(Service service) { + * super(service, "path/hardcoded", MyEntity.class, new Args()); + * } + * } + */ + +public class Program { + public static void main(String[] args) { + Command command = Command.splunk("info").parse(args); + Service service = Service.connect(command.opts); + + String mySplunkRESTPath = "apps/local"; + + EntityCollection myCollection = new EntityCollection(service, mySplunkRESTPath, Entity.class, new Args()); + + System.out.println("Found " + myCollection.size() + " Splunk apps:"); + + for (Object myEntity : myCollection.values()) { + Entity entity = (Entity) myEntity; + System.out.println("\t" + entity.getName()); + } + } +} \ No newline at end of file diff --git a/examples/explorer/com/splunk/sdk/explorer/AppNode.java b/examples/src/main/java/com/splunk/examples/explorer/AppNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/AppNode.java rename to examples/src/main/java/com/splunk/examples/explorer/AppNode.java index 87d886de..50caaffc 100644 --- a/examples/explorer/com/splunk/sdk/explorer/AppNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/AppNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Application; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/ConfCollectionKids.java b/examples/src/main/java/com/splunk/examples/explorer/ConfCollectionKids.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/ConfCollectionKids.java rename to examples/src/main/java/com/splunk/examples/explorer/ConfCollectionKids.java index 6a406bd8..c7549f47 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ConfCollectionKids.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ConfCollectionKids.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.ConfCollection; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/ConfCollectionNode.java b/examples/src/main/java/com/splunk/examples/explorer/ConfCollectionNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/ConfCollectionNode.java rename to examples/src/main/java/com/splunk/examples/explorer/ConfCollectionNode.java index c8b0172d..1f1b9e44 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ConfCollectionNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ConfCollectionNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.ConfCollection; diff --git a/examples/explorer/com/splunk/sdk/explorer/DatePropertyEditor.java b/examples/src/main/java/com/splunk/examples/explorer/DatePropertyEditor.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/DatePropertyEditor.java rename to examples/src/main/java/com/splunk/examples/explorer/DatePropertyEditor.java index 118db164..d73dbaca 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DatePropertyEditor.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DatePropertyEditor.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import java.beans.PropertyEditorSupport; import java.text.ParseException; diff --git a/examples/explorer/com/splunk/sdk/explorer/DeploymentClientNode.java b/examples/src/main/java/com/splunk/examples/explorer/DeploymentClientNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/DeploymentClientNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DeploymentClientNode.java index 5b39f117..b0255ecd 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DeploymentClientNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DeploymentClientNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/DeploymentServerClassNode.java b/examples/src/main/java/com/splunk/examples/explorer/DeploymentServerClassNode.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/DeploymentServerClassNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DeploymentServerClassNode.java index ea402e4f..8c5733df 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DeploymentServerClassNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DeploymentServerClassNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/DeploymentServerNode.java b/examples/src/main/java/com/splunk/examples/explorer/DeploymentServerNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/DeploymentServerNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DeploymentServerNode.java index e5aff20e..79e33e78 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DeploymentServerNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DeploymentServerNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/DeploymentTenantNode.java b/examples/src/main/java/com/splunk/examples/explorer/DeploymentTenantNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/DeploymentTenantNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DeploymentTenantNode.java index 338c2401..48c14259 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DeploymentTenantNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DeploymentTenantNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/DistributedConfigurationNode.java b/examples/src/main/java/com/splunk/examples/explorer/DistributedConfigurationNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/DistributedConfigurationNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DistributedConfigurationNode.java index 5ad76aa4..73c2cec8 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DistributedConfigurationNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DistributedConfigurationNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/DistributedPeerNode.java b/examples/src/main/java/com/splunk/examples/explorer/DistributedPeerNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/DistributedPeerNode.java rename to examples/src/main/java/com/splunk/examples/explorer/DistributedPeerNode.java index af1c6dbf..9139d601 100644 --- a/examples/explorer/com/splunk/sdk/explorer/DistributedPeerNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/DistributedPeerNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/EntityCollectionNode.java b/examples/src/main/java/com/splunk/examples/explorer/EntityCollectionNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/EntityCollectionNode.java rename to examples/src/main/java/com/splunk/examples/explorer/EntityCollectionNode.java index e8c251ba..92819273 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EntityCollectionNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EntityCollectionNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; import com.splunk.EntityCollection; @@ -49,7 +49,7 @@ Node createKid(Entity entity) { return (Node)itemCtor.newInstance(entity); } catch (Exception e) { - throw new RuntimeException(e.getMessage()); + throw new RuntimeException(e.getMessage(), e); } } diff --git a/examples/explorer/com/splunk/sdk/explorer/EntityComparator.java b/examples/src/main/java/com/splunk/examples/explorer/EntityComparator.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/EntityComparator.java rename to examples/src/main/java/com/splunk/examples/explorer/EntityComparator.java index ff0ab7c7..8547fa9f 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EntityComparator.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EntityComparator.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/EntityKids.java b/examples/src/main/java/com/splunk/examples/explorer/EntityKids.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/EntityKids.java rename to examples/src/main/java/com/splunk/examples/explorer/EntityKids.java index fe8d2db6..a1776980 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EntityKids.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EntityKids.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; import com.splunk.EntityMetadata; diff --git a/examples/explorer/com/splunk/sdk/explorer/EntityMetadataNode.java b/examples/src/main/java/com/splunk/examples/explorer/EntityMetadataNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/EntityMetadataNode.java rename to examples/src/main/java/com/splunk/examples/explorer/EntityMetadataNode.java index 28340187..9e07beb2 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EntityMetadataNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EntityMetadataNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.EntityMetadata; diff --git a/examples/explorer/com/splunk/sdk/explorer/EntityNode.java b/examples/src/main/java/com/splunk/examples/explorer/EntityNode.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/EntityNode.java rename to examples/src/main/java/com/splunk/examples/explorer/EntityNode.java index ec7e2dfc..1d6262d9 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EntityNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EntityNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/EventTypeNode.java b/examples/src/main/java/com/splunk/examples/explorer/EventTypeNode.java similarity index 91% rename from examples/explorer/com/splunk/sdk/explorer/EventTypeNode.java rename to examples/src/main/java/com/splunk/examples/explorer/EventTypeNode.java index 840ef833..943b179c 100644 --- a/examples/explorer/com/splunk/sdk/explorer/EventTypeNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/EventTypeNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; @@ -25,7 +25,7 @@ class EventTypeNode extends EntityNode { @Override protected PropertyList getMetadata() { PropertyList list = super.getMetadata(); - list.add(String.class, "getDescription"); + list.add(String.class, "getDescriptionLabel"); list.add(int.class, "getPriority"); list.add(String.class, "getSearch"); return list; diff --git a/examples/explorer/com/splunk/sdk/explorer/Explorer.java b/examples/src/main/java/com/splunk/examples/explorer/Explorer.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/Explorer.java rename to examples/src/main/java/com/splunk/examples/explorer/Explorer.java index e249bc7d..82a4ccef 100644 --- a/examples/explorer/com/splunk/sdk/explorer/Explorer.java +++ b/examples/src/main/java/com/splunk/examples/explorer/Explorer.java @@ -20,7 +20,7 @@ // http://blogs.oracle.com/geertjan/entry/netbeans_apis_outside_of_the // -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.InputKind; import com.splunk.Service; diff --git a/examples/explorer/com/splunk/sdk/explorer/ExplorerNode.java b/examples/src/main/java/com/splunk/examples/explorer/ExplorerNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/ExplorerNode.java rename to examples/src/main/java/com/splunk/examples/explorer/ExplorerNode.java index ca3c76c9..27478991 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ExplorerNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ExplorerNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import org.openide.nodes.AbstractNode; import org.openide.nodes.Children; diff --git a/examples/explorer/com/splunk/sdk/explorer/GroupNode.java b/examples/src/main/java/com/splunk/examples/explorer/GroupNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/GroupNode.java rename to examples/src/main/java/com/splunk/examples/explorer/GroupNode.java index fd38c510..bd143ea2 100644 --- a/examples/explorer/com/splunk/sdk/explorer/GroupNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/GroupNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import org.openide.nodes.AbstractNode; import org.openide.nodes.Children; diff --git a/examples/explorer/com/splunk/sdk/explorer/IndexNode.java b/examples/src/main/java/com/splunk/examples/explorer/IndexNode.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/IndexNode.java rename to examples/src/main/java/com/splunk/examples/explorer/IndexNode.java index 156aa084..b9a73a2a 100644 --- a/examples/explorer/com/splunk/sdk/explorer/IndexNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/IndexNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/InputKindPropertyEditor.java b/examples/src/main/java/com/splunk/examples/explorer/InputKindPropertyEditor.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/InputKindPropertyEditor.java rename to examples/src/main/java/com/splunk/examples/explorer/InputKindPropertyEditor.java index 43bc6905..599cf351 100644 --- a/examples/explorer/com/splunk/sdk/explorer/InputKindPropertyEditor.java +++ b/examples/src/main/java/com/splunk/examples/explorer/InputKindPropertyEditor.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.InputKind; diff --git a/examples/explorer/com/splunk/sdk/explorer/InputNode.java b/examples/src/main/java/com/splunk/examples/explorer/InputNode.java similarity index 84% rename from examples/explorer/com/splunk/sdk/explorer/InputNode.java rename to examples/src/main/java/com/splunk/examples/explorer/InputNode.java index e5be924c..d440e815 100644 --- a/examples/explorer/com/splunk/sdk/explorer/InputNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/InputNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; import com.splunk.Input; @@ -29,60 +29,51 @@ class InputNode extends EntityNode { PropertyList list = super.getMetadata(); list.add(InputKind.class, "getKind"); Input input = (Input)value; - switch (input.getKind()) { - case Monitor: + InputKind kind = input.getKind(); + if (kind == InputKind.Monitor) { list.add(int.class, "getFileCount"); list.add(String.class, "getHost"); list.add(String.class, "getIndex"); list.add(int.class, "getRcvBuf"); - break; - case Script: + } else if (kind == InputKind.Script) { list.add(String.class, "getGroup"); list.add(String.class, "getHost"); list.add(String.class, "getIndex"); list.add(int.class, "getInterval"); list.add(int.class, "getRcvBuf"); - break; - case Tcp: + } else if (kind == InputKind.Tcp) { list.add(String.class, "getGroup"); list.add(String.class, "getHost"); list.add(String.class, "getIndex"); list.add(int.class, "getRcvBuf"); list.add(String.class, "getRestrictToHost"); - break; - case TcpSplunk: - case Udp: + } else if (kind == InputKind.TcpSplunk || kind == InputKind.Udp) { list.add(String.class, "getGroup"); list.add(String.class, "getHost"); list.add(String.class, "getIndex"); list.add(int.class, "getRcvBuf"); - break; - case WindowsActiveDirectory: + } else if (kind == InputKind.WindowsActiveDirectory) { list.add(String.class, "getIndex"); list.add(boolean.class, "getMonitorSubtree"); - break; - case WindowsEventLog: + } else if (kind == InputKind.WindowsEventLog) { list.add(String.class, "getHosts"); list.add(String.class, "getIndex"); list.add(String[].class, "getLogs"); list.add(String.class, "getLocalName"); list.add(String.class, "getLookupHost"); - break; - case WindowsPerfmon: + } else if (kind == InputKind.WindowsPerfmon) { list.add(String.class, "getIndex"); list.add(String[].class, "getInstances"); list.add(int.class, "getInterval"); list.add(String.class, "getObject"); - break; - case WindowsRegistry: + } else if (kind == InputKind.WindowsRegistry) { list.add(boolean.class, "getBaseline"); list.add(String.class, "getProc"); list.add(String.class, "getHive"); list.add(String.class, "getIndex"); list.add(boolean.class, "getMonitorSubnoes"); list.add(String.class, "getType"); - break; - case WindowsWmi: + } else if (kind == InputKind.WindowsWmi) { list.add(String.class, "getClasses"); list.add(String[].class, "getFields"); list.add(String.class, "getIndex"); @@ -92,7 +83,6 @@ class InputNode extends EntityNode { list.add(String.class, "getLocalName"); list.add(String.class, "getServer"); list.add(String.class, "getWq1"); - break; } return list; } diff --git a/examples/explorer/com/splunk/sdk/explorer/JobNode.java b/examples/src/main/java/com/splunk/examples/explorer/JobNode.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/JobNode.java rename to examples/src/main/java/com/splunk/examples/explorer/JobNode.java index 1ec732fe..0e56742a 100644 --- a/examples/explorer/com/splunk/sdk/explorer/JobNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/JobNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; import com.splunk.Job; diff --git a/examples/explorer/com/splunk/sdk/explorer/LicenseGroupNode.java b/examples/src/main/java/com/splunk/examples/explorer/LicenseGroupNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/LicenseGroupNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LicenseGroupNode.java index 65f77d1b..06421e98 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LicenseGroupNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LicenseGroupNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/LicenseNode.java b/examples/src/main/java/com/splunk/examples/explorer/LicenseNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/LicenseNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LicenseNode.java index 54668b95..aadf356c 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LicenseNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LicenseNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; import com.splunk.License; diff --git a/examples/explorer/com/splunk/sdk/explorer/LicensePoolNode.java b/examples/src/main/java/com/splunk/examples/explorer/LicensePoolNode.java similarity index 92% rename from examples/explorer/com/splunk/sdk/explorer/LicensePoolNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LicensePoolNode.java index 644cfb9b..1849d269 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LicensePoolNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LicensePoolNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; @@ -25,7 +25,7 @@ class LicensePoolNode extends EntityNode { @Override protected PropertyList getMetadata() { PropertyList list = super.getMetadata(); - list.add(String.class, "getDescription"); + list.add(String.class, "getDescriptionLabel"); list.add(long.class, "getQuota"); list.add(String[].class, "getSlaves"); list.add(long.class, "getSlavesUsageBytes"); diff --git a/examples/explorer/com/splunk/sdk/explorer/LicenseSlaveNode.java b/examples/src/main/java/com/splunk/examples/explorer/LicenseSlaveNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/LicenseSlaveNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LicenseSlaveNode.java index 407ceae4..3340b2c7 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LicenseSlaveNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LicenseSlaveNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/LicenseStackNode.java b/examples/src/main/java/com/splunk/examples/explorer/LicenseStackNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/LicenseStackNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LicenseStackNode.java index 3db592d5..743b84dd 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LicenseStackNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LicenseStackNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/LoggerNode.java b/examples/src/main/java/com/splunk/examples/explorer/LoggerNode.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/LoggerNode.java rename to examples/src/main/java/com/splunk/examples/explorer/LoggerNode.java index bac41e0f..4c563ddd 100644 --- a/examples/explorer/com/splunk/sdk/explorer/LoggerNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/LoggerNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/MapPropertyEditor.java b/examples/src/main/java/com/splunk/examples/explorer/MapPropertyEditor.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/MapPropertyEditor.java rename to examples/src/main/java/com/splunk/examples/explorer/MapPropertyEditor.java index a2a5d7b9..30f81036 100644 --- a/examples/explorer/com/splunk/sdk/explorer/MapPropertyEditor.java +++ b/examples/src/main/java/com/splunk/examples/explorer/MapPropertyEditor.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import java.beans.PropertyEditorSupport; import java.util.Map; diff --git a/examples/explorer/com/splunk/sdk/explorer/MessageNode.java b/examples/src/main/java/com/splunk/examples/explorer/MessageNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/MessageNode.java rename to examples/src/main/java/com/splunk/examples/explorer/MessageNode.java index 5555a05a..be756267 100644 --- a/examples/explorer/com/splunk/sdk/explorer/MessageNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/MessageNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/NamespaceKids.java b/examples/src/main/java/com/splunk/examples/explorer/NamespaceKids.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/NamespaceKids.java rename to examples/src/main/java/com/splunk/examples/explorer/NamespaceKids.java index 21122ef6..f9c76609 100644 --- a/examples/explorer/com/splunk/sdk/explorer/NamespaceKids.java +++ b/examples/src/main/java/com/splunk/examples/explorer/NamespaceKids.java @@ -14,11 +14,10 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Service; -import org.openide.nodes.AbstractNode; import org.openide.nodes.Children; import org.openide.nodes.Node; diff --git a/examples/explorer/com/splunk/sdk/explorer/NamespacesKids.java b/examples/src/main/java/com/splunk/examples/explorer/NamespacesKids.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/NamespacesKids.java rename to examples/src/main/java/com/splunk/examples/explorer/NamespacesKids.java index ad34ca9e..5fba807d 100644 --- a/examples/explorer/com/splunk/sdk/explorer/NamespacesKids.java +++ b/examples/src/main/java/com/splunk/examples/explorer/NamespacesKids.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Args; import com.splunk.Service; @@ -47,8 +47,6 @@ class NamespacesKids extends Children.Keys { } private Node createNode(String name) { - String app; - String owner; if (name.equals("")) return createNode("", "-"); diff --git a/examples/explorer/com/splunk/sdk/explorer/NamespacesNode.java b/examples/src/main/java/com/splunk/examples/explorer/NamespacesNode.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/NamespacesNode.java rename to examples/src/main/java/com/splunk/examples/explorer/NamespacesNode.java index 0507de2d..5a240f7a 100644 --- a/examples/explorer/com/splunk/sdk/explorer/NamespacesNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/NamespacesNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Service; diff --git a/examples/explorer/com/splunk/sdk/explorer/OutputDefaultNode.java b/examples/src/main/java/com/splunk/examples/explorer/OutputDefaultNode.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/OutputDefaultNode.java rename to examples/src/main/java/com/splunk/examples/explorer/OutputDefaultNode.java index e517969c..8cd65130 100644 --- a/examples/explorer/com/splunk/sdk/explorer/OutputDefaultNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/OutputDefaultNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/OutputGroupNode.java b/examples/src/main/java/com/splunk/examples/explorer/OutputGroupNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/OutputGroupNode.java rename to examples/src/main/java/com/splunk/examples/explorer/OutputGroupNode.java index 9b1cce2f..657aa7ba 100644 --- a/examples/explorer/com/splunk/sdk/explorer/OutputGroupNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/OutputGroupNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/OutputServerNode.java b/examples/src/main/java/com/splunk/examples/explorer/OutputServerNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/OutputServerNode.java rename to examples/src/main/java/com/splunk/examples/explorer/OutputServerNode.java index a015f53c..94c86388 100644 --- a/examples/explorer/com/splunk/sdk/explorer/OutputServerNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/OutputServerNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/OutputSyslogNode.java b/examples/src/main/java/com/splunk/examples/explorer/OutputSyslogNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/OutputSyslogNode.java rename to examples/src/main/java/com/splunk/examples/explorer/OutputSyslogNode.java index 98b2ee27..c5b05b92 100644 --- a/examples/explorer/com/splunk/sdk/explorer/OutputSyslogNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/OutputSyslogNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/PasswordNode.java b/examples/src/main/java/com/splunk/examples/explorer/PasswordNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/PasswordNode.java rename to examples/src/main/java/com/splunk/examples/explorer/PasswordNode.java index 5ded6612..4b03f427 100644 --- a/examples/explorer/com/splunk/sdk/explorer/PasswordNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/PasswordNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/Program.java b/examples/src/main/java/com/splunk/examples/explorer/Program.java similarity index 94% rename from examples/explorer/com/splunk/sdk/explorer/Program.java rename to examples/src/main/java/com/splunk/examples/explorer/Program.java index 72807e84..025b8194 100644 --- a/examples/explorer/com/splunk/sdk/explorer/Program.java +++ b/examples/src/main/java/com/splunk/examples/explorer/Program.java @@ -14,10 +14,10 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Service; -import com.splunk.sdk.Command; +import com.splunk.Command; import javax.swing.SwingUtilities; diff --git a/examples/explorer/com/splunk/sdk/explorer/PropertyInfo.java b/examples/src/main/java/com/splunk/examples/explorer/PropertyInfo.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/PropertyInfo.java rename to examples/src/main/java/com/splunk/examples/explorer/PropertyInfo.java index b710b266..1989ae93 100644 --- a/examples/explorer/com/splunk/sdk/explorer/PropertyInfo.java +++ b/examples/src/main/java/com/splunk/examples/explorer/PropertyInfo.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; public class PropertyInfo { public Class datatype; diff --git a/examples/explorer/com/splunk/sdk/explorer/PropertyList.java b/examples/src/main/java/com/splunk/examples/explorer/PropertyList.java similarity index 93% rename from examples/explorer/com/splunk/sdk/explorer/PropertyList.java rename to examples/src/main/java/com/splunk/examples/explorer/PropertyList.java index 9da04ffa..1981ed03 100644 --- a/examples/explorer/com/splunk/sdk/explorer/PropertyList.java +++ b/examples/src/main/java/com/splunk/examples/explorer/PropertyList.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import java.util.ArrayList; import org.openide.nodes.PropertySupport; @@ -39,7 +39,7 @@ public Sheet createSheet(Object object) { } } catch (NoSuchMethodException e) { - throw new RuntimeException(e.getMessage()); + throw new RuntimeException(e.getMessage(), e); } sheet.put(props); return sheet; diff --git a/examples/explorer/com/splunk/sdk/explorer/ResourceNode.java b/examples/src/main/java/com/splunk/examples/explorer/ResourceNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/ResourceNode.java rename to examples/src/main/java/com/splunk/examples/explorer/ResourceNode.java index 38f2f8d2..2f579df9 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ResourceNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ResourceNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Resource; diff --git a/examples/explorer/com/splunk/sdk/explorer/RoleNode.java b/examples/src/main/java/com/splunk/examples/explorer/RoleNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/RoleNode.java rename to examples/src/main/java/com/splunk/examples/explorer/RoleNode.java index d5ee2d59..f810c3a3 100644 --- a/examples/explorer/com/splunk/sdk/explorer/RoleNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/RoleNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/SavedSearchNode.java b/examples/src/main/java/com/splunk/examples/explorer/SavedSearchNode.java similarity index 95% rename from examples/explorer/com/splunk/sdk/explorer/SavedSearchNode.java rename to examples/src/main/java/com/splunk/examples/explorer/SavedSearchNode.java index 4c754dd1..a042bc62 100644 --- a/examples/explorer/com/splunk/sdk/explorer/SavedSearchNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/SavedSearchNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; @@ -37,7 +37,7 @@ class SavedSearchNode extends EntityNode { list.add(String.class, "getAlertThreshold"); list.add(String.class, "getAlertType"); list.add(String.class, "getCronSchedule"); - list.add(String.class, "getDescription"); + list.add(String.class, "getDescriptionLabel"); list.add(int.class, "getDispatchBuckets"); list.add(String.class, "getDispatchEarliestTime"); list.add(String.class, "getDispatchLatestTime"); @@ -62,7 +62,7 @@ class SavedSearchNode extends EntityNode { list.add(boolean.class, "isActionEmail"); list.add(boolean.class, "isActionPopulateLookup"); list.add(boolean.class, "isActionRss"); - list.add(boolean.class, "isActioncScript"); + list.add(boolean.class, "isActionScript"); list.add(boolean.class, "isActionSummaryIndex"); list.add(boolean.class, "isDigestMode"); list.add(boolean.class, "isDisabled"); diff --git a/examples/explorer/com/splunk/sdk/explorer/ServiceKids.java b/examples/src/main/java/com/splunk/examples/explorer/ServiceKids.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/ServiceKids.java rename to examples/src/main/java/com/splunk/examples/explorer/ServiceKids.java index 1902e09b..216dd6bc 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ServiceKids.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ServiceKids.java @@ -14,11 +14,10 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Service; -import org.openide.nodes.AbstractNode; import org.openide.nodes.Children; import org.openide.nodes.Node; diff --git a/examples/explorer/com/splunk/sdk/explorer/ServiceNode.java b/examples/src/main/java/com/splunk/examples/explorer/ServiceNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/ServiceNode.java rename to examples/src/main/java/com/splunk/examples/explorer/ServiceNode.java index 4189e51b..2c80c86b 100644 --- a/examples/explorer/com/splunk/sdk/explorer/ServiceNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/ServiceNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Service; diff --git a/examples/explorer/com/splunk/sdk/explorer/SettingsNode.java b/examples/src/main/java/com/splunk/examples/explorer/SettingsNode.java similarity index 97% rename from examples/explorer/com/splunk/sdk/explorer/SettingsNode.java rename to examples/src/main/java/com/splunk/examples/explorer/SettingsNode.java index 6aa16159..f6cfc105 100644 --- a/examples/explorer/com/splunk/sdk/explorer/SettingsNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/SettingsNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/StanzaNode.java b/examples/src/main/java/com/splunk/examples/explorer/StanzaNode.java similarity index 98% rename from examples/explorer/com/splunk/sdk/explorer/StanzaNode.java rename to examples/src/main/java/com/splunk/examples/explorer/StanzaNode.java index 3c05b6ab..c5dc0753 100644 --- a/examples/explorer/com/splunk/sdk/explorer/StanzaNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/StanzaNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/explorer/com/splunk/sdk/explorer/StringArrayPropertyEditor.java b/examples/src/main/java/com/splunk/examples/explorer/StringArrayPropertyEditor.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/StringArrayPropertyEditor.java rename to examples/src/main/java/com/splunk/examples/explorer/StringArrayPropertyEditor.java index 0bfc4c14..82c642d4 100644 --- a/examples/explorer/com/splunk/sdk/explorer/StringArrayPropertyEditor.java +++ b/examples/src/main/java/com/splunk/examples/explorer/StringArrayPropertyEditor.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import java.beans.PropertyEditorSupport; import java.util.Arrays; diff --git a/examples/explorer/com/splunk/sdk/explorer/UserNode.java b/examples/src/main/java/com/splunk/examples/explorer/UserNode.java similarity index 96% rename from examples/explorer/com/splunk/sdk/explorer/UserNode.java rename to examples/src/main/java/com/splunk/examples/explorer/UserNode.java index b409fb57..a9f807f4 100644 --- a/examples/explorer/com/splunk/sdk/explorer/UserNode.java +++ b/examples/src/main/java/com/splunk/examples/explorer/UserNode.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk.explorer; +package com.splunk.examples.explorer; import com.splunk.Entity; diff --git a/examples/export/com/splunk/sdk/export/Program.java b/examples/src/main/java/com/splunk/examples/export/Program.java similarity index 83% rename from examples/export/com/splunk/sdk/export/Program.java rename to examples/src/main/java/com/splunk/examples/export/Program.java index e7a22bd0..55b298f1 100644 --- a/examples/export/com/splunk/sdk/export/Program.java +++ b/examples/src/main/java/com/splunk/examples/export/Program.java @@ -14,10 +14,9 @@ * under the License. */ -package com.splunk.sdk.export; +package com.splunk.examples.export; import com.splunk.*; -import com.splunk.sdk.Command; import java.nio.channels.FileChannel; import java.io.File; @@ -30,13 +29,12 @@ import java.util.HashMap; import java.util.Map; - /** * Export.java: export an splunk entire index in XML, CSV or JSON (4.3+). The * return data is in strict descending time order. */ -// in recover mode, we will duplicate messages and meta data; however, +// In recover mode, we will duplicate messages and meta data; however, // this is not necessarily incorrect, just redundant information. public class Program { @@ -66,7 +64,7 @@ static Map getStartNextCSVEvent(int location, String str) { while (eventEnd > 0) { String substring = str.substring(eventStart, eventEnd); String [] parts = substring.split(","); - // test parts 0 and 1 of the CSV, for and time.qqq stamp + // Test parts 0 and 1 of the CSV, for and time.qqq stamp try { Integer.parseInt(parts[0]); String timestamp = parts[1].replace("\"",""); @@ -78,7 +76,7 @@ static Map getStartNextCSVEvent(int location, String str) { return pair; } catch (Exception e) { - // if any of the fields accessed caused an exception, then + // If any of the fields accessed caused an exception, then // we didn't have a valid start of event, so try again. eventStart = str.indexOf("\n", eventEnd + 2); eventEnd = str.indexOf("\"\n", eventStart + 1); @@ -94,11 +92,11 @@ static int getCsvEventStart(String str) { return -1; lastTime = str.substring(pair.get("start")) - .split(",")[1] - .replace("\"",""); + .split(",")[1] + .replace("\"",""); nextEventOffset = pair.get("end"); - // walk through events until time changes + // Walk through events until time changes. while (pair.get("end") > 0) { pair = getStartNextCSVEvent(pair.get("start"), str); if (pair.get("end") < 0) @@ -116,30 +114,31 @@ static int getCsvEventStart(String str) { } static int getXmlEventStart(String str) { + String resultPattern = ""; String timeStartPattern = ""; String timeEndPattern = "<"; String eventEndPattern = ""; - // get first event in this buffer. If no event end kick back - int eventStart = str.indexOf("", eventStart) + eventStart = str.indexOf(resultPattern, eventStart+1); + eventEnd = str.indexOf(eventEndPattern, eventStart) + eventEndPattern.length(); if (eventEnd < 0) return -1; @@ -162,9 +161,9 @@ static int getJsonEventStart(String str) { String timeKeyPattern = "\"_time\":\""; String timeEndPattern = "\""; String eventEndPattern = "\"},\n"; - String eventEndPattern2 = "\"}[]"; + String eventEndPattern2 = "\"}[]"; // Old json output format bug - // get first event in this buffer. If no event end kick back + // Get first event in this buffer. If no event end kick back. int eventStart = str.indexOf("{\"_cd\":\""); int eventEnd = str.indexOf(eventEndPattern, eventStart) + eventEndPattern.length(); @@ -180,7 +179,7 @@ static int getJsonEventStart(String str) { lastTime = str.substring(timeStart, timeEnd); nextEventOffset = eventEnd; - // walk through events until time changes + // Walk through events until time changes. eventStart = eventEnd; while (eventEnd > 0) { eventStart = str.indexOf("{\"_cd\":\"", eventStart+1); @@ -224,7 +223,7 @@ static void cleanupTail(Writer out, String format) throws Exception { else if (format.equals("xml")) out.write("\n\n"); else - out.write("[]\n"); + out.write("\n]\n"); } static void run(String[] argv) throws Exception { @@ -246,8 +245,12 @@ static void run(String[] argv) throws Exception { // // N.B. json output only valid with 4.3+ - if (command.args.length == 0) - throw new Error("Index-name required"); + String indexName = null; + if (command.args.length == 0) { + System.out.println("Exporting main index"); + indexName = "main"; + } else + indexName = command.args[0]; if (command.args.length > 1) { for (int index=1; index < command.args.length; index++) { @@ -269,7 +272,7 @@ else if (command.args[index].equals("json")) throw new Error("Export file exists, and no recover option"); if (recover && file.exists() && file.isFile()) { - // chunk backwards through the file until we find valid + // Chunk backwards through the file until we find valid // start time. If we can't find one just start over. final int bufferSize = (64*1024); RandomAccessFile raf = new RandomAccessFile(file, "rw"); @@ -289,7 +292,7 @@ else if (command.args[index].equals("json")) } if (fptr < 0) - fptrEof = 0; // didn't find a valid event, so start over. + fptrEof = 0; // We didn't find a valid event, so start over. else args.put("latest_time", lastTime); addEndOfLine = true; @@ -300,33 +303,32 @@ else if (command.args[index].equals("json")) if (!file.createNewFile()) throw new Error("Failed to create output file"); - // search args - args.put("timeout", "60"); // don't keep search around - args.put("output_mode", format); // output in specific format - args.put("earliest_time", "0.000"); // always to beginning of index - args.put("time_format", "%s.%Q"); // epoch time plus fraction + // Search args + args.put("timeout", "60"); // Don't keep search around + args.put("output_mode", format); // Output in specific format + args.put("earliest_time", "0.000"); // Always to beginning of index + args.put("time_format", "%s.%Q"); // Epoch time plus fraction String search = null; if (command.opts.containsKey("search")) { search = (String)command.opts.get("search"); } else { - search = String.format("search index=%s *", command.args[0]); + search = String.format("search index=%s *", indexName); } - //System.out.println("search: " + search + ", args: " + args); InputStream is = service.export(search, args); - // use UTF8 sensitive reader/writers - InputStreamReader isr = new InputStreamReader(is, "UTF8"); + // Use UTF8 sensitive reader/writers + InputStreamReader isr = new InputStreamReader(is, "UTF-8"); FileOutputStream os = new FileOutputStream(file, true); - Writer out = new OutputStreamWriter(os, "UTF8"); + Writer out = new OutputStreamWriter(os, "UTF-8"); - // read/write 8k at a time if possible + // Read/write 8k at a time if possible char [] xferBuffer = new char[8192]; boolean once = true; - // if superfluous meta-data is not needed, or specifically + // If superfluous meta-data is not needed, or specifically // wants to be removed, one would clean up the first read // buffer on a format by format basis, while (true) { diff --git a/examples/src/main/java/com/splunk/examples/fluent_pivot/Program.java b/examples/src/main/java/com/splunk/examples/fluent_pivot/Program.java new file mode 100644 index 00000000..79b70bf0 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/fluent_pivot/Program.java @@ -0,0 +1,84 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk.examples.fluent_pivot; + +import com.splunk.*; + +public class Program { + public static void main(String[] argv) { + try { + run(argv); + } + catch (Exception e) { + e.printStackTrace(); + System.exit(1); + } + } + + static void run(String[] argsIn) throws Exception { + Command command; + Service service; + + command = Command.splunk("input"); + service = Service.connect(command.opts); + + DataModel dataModel = service.getDataModels().get("internal_audit_logs"); + DataModelObject searches = dataModel.getObject("searches"); + + System.out.print("Working with object " + searches.getDisplayName()); + System.out.println(" in model " + dataModel.getDisplayName()); + System.out.print(" Lineage: "); + for (String name : searches.getLineage()) { + System.out.print(" -> " + name); + } + System.out.println(); + System.out.println(" Internal name: " + searches.getName()); + + Job firstFiveEntries = searches.runQuery("| head 5"); + while (!firstFiveEntries.isDone()) { + Thread.sleep(100); + } + + ResultsReaderXml results = new ResultsReaderXml(firstFiveEntries.getResults()); + for (Event event : results) { + System.out.println(event.toString()); + } + + System.out.println("~~~~~~~~~~~~~~~~~~~~"); + System.out.println("Pivoting on searches"); + + Pivot pivot = searches.createPivotSpecification(). + addRowSplit("user", "Executing user"). + addColumnSplit("exec_time", null, null, null, 4). + addCellValue("search", "Search Query", StatsFunction.DISTINCT_VALUES). + pivot(); + + System.out.println("Query for binning search queries by execution time and executing user:"); + System.out.println(" " + pivot.getPrettyQuery()); + + Job pivotJob = pivot.run(); + while (!pivotJob.isDone()) { + Thread.sleep(100); + } + + results = new ResultsReaderXml(pivotJob.getResults()); + for (Event event : results) { + System.out.println(event.toString()); + } + } +} + + diff --git a/examples/src/main/java/com/splunk/examples/genevents/Program.java b/examples/src/main/java/com/splunk/examples/genevents/Program.java new file mode 100644 index 00000000..247e1a30 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/genevents/Program.java @@ -0,0 +1,165 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.genevents; + +import com.splunk.*; + +import java.io.*; +import java.net.Socket; +import java.text.SimpleDateFormat; +import java.util.Arrays; +import java.util.Date; +import java.util.List; + +/** + * Generate events into an index using either stream, submit or raw tcp + * methods. + */ + +public class Program { + + static String indexName = + "Name of index to send events to. If unspecified, 'default' is used"; + static int ingestPort = 9002; + static String ingestMethod = + "Ingest events via method {stream, submit, tcp} (default: stream)"; + static String tcpPort = + String.format("Input port for tcp ingest (default: %d)", ingestPort); + static SimpleDateFormat dateFormat = + new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ"); + + public static void main(String[] args) { + try { + run(args); + } + catch (Exception e) { + e.printStackTrace(); + System.exit(1); + } + } + + static String makeEvent(String stamp, int i, int j) { + return String.format("%s: event bunch %d, number %d\n", stamp, i, j); + } + + static void buildRules(Command command, String[] argsIn) { + command.addRule("index", String.class, indexName); + command.addRule("itype", String.class, ingestMethod); + command.addRule("iport", String.class, tcpPort); + command.parse(argsIn); + } + + static void run(String[] argsIn) throws Exception { + + Command command; + int count; + Index index = null; + String ingest; + String iname; + List ingestTypes = Arrays.asList("submit", "stream", "tcp"); + OutputStream ostream; + Receiver receiver = null; + Service service; + Socket stream = null; + Writer writerOut = null; + + command = Command.splunk("genevents"); + buildRules(command, argsIn); + service = Service.connect(command.opts); + + // Determine ingest method and other input arguments. + iname = null; + ingest = "stream"; + if (command.opts.containsKey("index")) { + iname = (String)command.opts.get("index"); + } + if (command.opts.containsKey("itype")) + ingest = (String)command.opts.get("itype"); + if (command.opts.containsKey("iport")) { + ingestPort = Integer.parseInt((String)command.opts.get("iport")); + } + + // Validate + if (!ingestTypes.contains(ingest)) { + Command.error("Method '"+ingest+"' must be in set: "+ingestTypes); + } + + if (iname != null) { + index = service.getIndexes().get(iname); + if (index == null) { + Command.error("Index '" + iname + "' was not found."); + } + } else { + receiver = service.getReceiver(); + } + + + // For stream and tcp, they both require a socket, though setup + // slightly differently. + if (ingest.equals("stream") || ingest.equals("tcp")) { + if (ingest.equals("stream")) + try { + // A specific index or not? + if (iname != null) + stream = index.attach(); + else + stream = receiver.attach(); + } + catch (NullPointerException e) { + System.out.println("Failed to attach to index."); + System.exit(3); + } + else { + // Create a tcp input if one does not already exist. + String inputName = String.valueOf(ingestPort); + TcpInput tcpInput = (TcpInput)service.getInputs().get(inputName); + if (tcpInput == null) { + tcpInput = (TcpInput)service.getInputs().create( + inputName, InputKind.Tcp); + } + stream = tcpInput.attach(); + } + ostream = stream.getOutputStream(); + writerOut = new OutputStreamWriter(ostream, "UTF-8"); + } + + // Generate 10 batches of 5000 events each. + count = 0; + for (int i=0; i<10; i++) { + for (int j=0; j<5000; j++) { + Date date = new Date(); + String lastEvent = makeEvent(dateFormat.format(date), i, j); + if (ingest.equals("stream") || ingest.equals("tcp")) + writerOut.write(lastEvent); + else + if (iname != null) + index.submit(lastEvent); + else + receiver.submit(lastEvent); + count++; + } + System.out.println("Submitted "+count+" events, using "+ingest); + } + + // Flush and close stream on completion + if (ingest.equals("stream") || ingest.equals("tcp")) { + writerOut.flush(); + writerOut.close(); + stream.close(); + } + } +} diff --git a/examples/src/main/java/com/splunk/examples/get_job/Program.java b/examples/src/main/java/com/splunk/examples/get_job/Program.java new file mode 100644 index 00000000..3656ed1d --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/get_job/Program.java @@ -0,0 +1,53 @@ +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.get_job; + +import com.splunk.*; + +/** + * This example shows a better way to retrieve a Job by its sid + * using the new getJob() method. + * + * Previously, the only way to do this would be the following: + * + * Job job = service.getJobs().get(sid); + * + * The above has a significant overhead of getting all search jobs from + * the Splunk REST API in order to get a single Job. + * + */ + +public class Program { + public static void main(String[] args) { + Command command = Command.splunk("info").parse(args); + Service service = Service.connect(command.opts); + + String sid = service.search("search index=_internal | head 5").getSid(); + Job job = service.getJob(sid); + + while (!job.isDone()) { + job.refresh(); + try { + Thread.sleep(1000); + } catch (Exception e) { + System.out.println(e.getMessage()); + } + } + + System.out.println("Number of events found: " + job.getEventCount()); + } +} \ No newline at end of file diff --git a/examples/index/com/splunk/sdk/index/Program.java b/examples/src/main/java/com/splunk/examples/index/Program.java similarity index 80% rename from examples/index/com/splunk/sdk/index/Program.java rename to examples/src/main/java/com/splunk/examples/index/Program.java index 4f3b03ab..d3761d54 100644 --- a/examples/index/com/splunk/sdk/index/Program.java +++ b/examples/src/main/java/com/splunk/examples/index/Program.java @@ -14,12 +14,13 @@ * under the License. */ -package com.splunk.sdk.index; +package com.splunk.examples.index; import com.splunk.EntityCollection; import com.splunk.Index; import com.splunk.Service; -import com.splunk.sdk.Command; +import com.splunk.Command; +import com.splunk.SplunkException; public class Program { private static void list(Service service) { @@ -60,12 +61,22 @@ public static void main(String[] args) { return; } - Index index = (Index)indexes.get(name); + Index index = indexes.get(name); if (index == null) Command.error("Index '" + name + "' does not exists"); - if (action.equals("clean")) - index.clean(); + if (action.equals("clean")) { + try { + index.clean(180); // Timeout after 3 minutes. + } catch (SplunkException e) { + if (e.getCode() == SplunkException.INTERRUPTED) { + // User pressed Ctrl-C + return; + } else { + throw e; + } + } + } else if (action.equals("disable")) index.disable(); else if (action.equals("enable")) diff --git a/examples/info/com/splunk/sdk/info/Program.java b/examples/src/main/java/com/splunk/examples/info/Program.java similarity index 95% rename from examples/info/com/splunk/sdk/info/Program.java rename to examples/src/main/java/com/splunk/examples/info/Program.java index a1546629..d249238b 100644 --- a/examples/info/com/splunk/sdk/info/Program.java +++ b/examples/src/main/java/com/splunk/examples/info/Program.java @@ -14,10 +14,9 @@ * under the License. */ -package com.splunk.sdk.info; +package com.splunk.examples.info; import com.splunk.*; -import com.splunk.sdk.Command; public class Program { public static void main(String[] args) { diff --git a/examples/src/main/java/com/splunk/examples/input/Program.java b/examples/src/main/java/com/splunk/examples/input/Program.java new file mode 100644 index 00000000..9b6d2c66 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/input/Program.java @@ -0,0 +1,262 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.input; + +import com.splunk.*; + +/** + * Generate events into an index using either stream, submit or raw tcp + * methods. + */ + +public class Program { + + public static void main(String[] args) { + try { + run(args); + } + catch (Exception e) { + e.printStackTrace(); + System.exit(1); + } + } + + static void DisplaySpecificInput(Input input) { + InputKind inputKind = input.getKind(); + + System.out.println(" **type specific settings"); + + if (inputKind == InputKind.Monitor) { + MonitorInput monitorInput = (MonitorInput) input; + System.out.println( + " file count: " + monitorInput.getFileCount()); + System.out.println( + " host: " + monitorInput.getHost()); + System.out.println( + " index: " + monitorInput.getIndex()); + System.out.println( + " receive buffer: " + monitorInput.getRcvBuf()); + } else if (inputKind == InputKind.Script) { + ScriptInput scriptInput = (ScriptInput) input; + System.out.println( + " group: " + scriptInput.getGroup()); + System.out.println( + " host: " + scriptInput.getHost()); + System.out.println( + " index: " + scriptInput.getIndex()); + System.out.println( + " interval: " + scriptInput.getInterval()); + System.out.println( + " receive buffer: " + scriptInput.getRcvBuf()); + } else if (inputKind == InputKind.Tcp) { + TcpInput tcpInput = (TcpInput) input; + System.out.println( + " connection host: " + tcpInput.getConnectionHost()); + System.out.println( + " group: " + tcpInput.getGroup()); + System.out.println( + " host: " + tcpInput.getHost()); + System.out.println( + " index: " + tcpInput.getIndex()); + System.out.println( + " queue: " + tcpInput.getQueue()); + System.out.println( + " receive buffer: " + tcpInput.getRcvBuf()); + System.out.println( + " restrict to host:" + tcpInput.getRestrictToHost()); + System.out.println( + " source: " + tcpInput.getSource()); + System.out.println( + " source type: " + tcpInput.getSourceType()); + System.out.println( + " SSL: " + tcpInput.getSSL()); + } else if (inputKind == InputKind.TcpSplunk) { + TcpSplunkInput tcpSplunkInput = (TcpSplunkInput) input; + System.out.println( + " connection host: " + tcpSplunkInput.getConnectionHost()); + System.out.println( + " group: " + tcpSplunkInput.getGroup()); + System.out.println( + " host: " + tcpSplunkInput.getHost()); + System.out.println( + " index: " + tcpSplunkInput.getIndex()); + System.out.println( + " queue: " + tcpSplunkInput.getQueue()); + System.out.println( + " receive buffer: " + tcpSplunkInput.getRcvBuf()); + System.out.println( + " source: " + tcpSplunkInput.getSource()); + System.out.println( + " source type: " + tcpSplunkInput.getSourceType()); + System.out.println( + " SSL: " + tcpSplunkInput.getSSL()); + } else if (inputKind == InputKind.Udp) { + UdpInput udpInput = (UdpInput) input; + System.out.println( + " connection host: " + udpInput.getConnectionHost()); + System.out.println( + " group: " + udpInput.getGroup()); + System.out.println( + " host: " + udpInput.getHost()); + System.out.println( + " index: " + udpInput.getIndex()); + System.out.println( + " queue: " + udpInput.getQueue()); + System.out.println( + " receive buffer: " + udpInput.getRcvBuf()); + System.out.println( + " source: " + udpInput.getSource()); + System.out.println( + " source type: " + udpInput.getSourceType()); + System.out.println( + " no timestamp append:" + + udpInput.getNoAppendingTimeStamp()); + System.out.println( + " no priority stripping:" + + udpInput.getNoPriorityStripping()); + } else if (inputKind == InputKind.WindowsActiveDirectory) { + WindowsActiveDirectoryInput windowsActiveDirectoryInput = + (WindowsActiveDirectoryInput) input; + System.out.println( + " index: " + + windowsActiveDirectoryInput.getIndex()); + System.out.println( + " monitor subtree: " + + windowsActiveDirectoryInput.getMonitorSubtree()); + System.out.println( + " starting node: " + + windowsActiveDirectoryInput.getStartingNode()); + System.out.println( + " target DC: " + + windowsActiveDirectoryInput.getTargetDc()); + } else if (inputKind == InputKind.WindowsEventLog) { + WindowsEventLogInput windowsEventLogInput = + (WindowsEventLogInput) input; + System.out.println( + " hosts: " + + windowsEventLogInput.getHosts()); + System.out.println( + " index: " + + windowsEventLogInput.getIndex()); + System.out.println( + " local name: " + + windowsEventLogInput.getLocalName()); + String[] logs = windowsEventLogInput.getLogs(); + System.out.println(" logs:"); + if (logs != null) + for (String log: logs) { + System.out.println(" " + log); + } + System.out.println( + " lookup host: " + + windowsEventLogInput.getLookupHost()); + } else if (inputKind == InputKind.WindowsPerfmon) { + WindowsPerfmonInput windowsPerfmonInput = + (WindowsPerfmonInput) input; + System.out.println( + " counters: " + + windowsPerfmonInput.getCounters()); + System.out.println( + " index: " + + windowsPerfmonInput.getIndex()); + System.out.println( + " instances: " + + windowsPerfmonInput.getInstances()); + System.out.println( + " interval: " + + windowsPerfmonInput.getInterval()); + System.out.println( + " object: " + + windowsPerfmonInput.getObject()); + } else if (inputKind == InputKind.WindowsRegistry) { + WindowsRegistryInput windowsRegistryInput = + (WindowsRegistryInput) input; + System.out.println( + " baseline: " + + windowsRegistryInput.getBaseline()); + System.out.println( + " hive: " + + windowsRegistryInput.getHive()); + System.out.println( + " index: " + + windowsRegistryInput.getIndex()); + System.out.println( + " monitor subnodes:" + + windowsRegistryInput.getMonitorSubnodes()); + System.out.println( + " process: " + + windowsRegistryInput.getProc()); + System.out.println( + " type: " + + windowsRegistryInput.getType()); + } else if (inputKind == InputKind.WindowsWmi) { + WindowsWmiInput windowsWmiInput = (WindowsWmiInput) input; + System.out.println( + " WMI input: " + + windowsWmiInput.getClasses()); + String[] fields = windowsWmiInput.getFields(); + System.out.println(" fields:"); + for (String field: fields) { + System.out.println(" " + field); + } + System.out.println( + " index: " + + windowsWmiInput.getIndex()); + + String[] instances = windowsWmiInput.getInstances(); + System.out.println(" instances:"); + for (String instance: instances) { + System.out.println(" " + instance); + } + System.out.println( + " interval: " + + windowsWmiInput.getInterval()); + System.out.println( + " local name: " + + windowsWmiInput.getLocalName()); + System.out.println( + " lookup host: " + + windowsWmiInput.getLookupHost()); + System.out.println( + " server: " + + windowsWmiInput.getServers()); + System.out.println( + " WQL: " + windowsWmiInput.getWql()); + } + } + + static void run(String[] argsIn) throws Exception { + + Command command; + Service service; + + command = Command.splunk("input"); + service = Service.connect(command.opts); + + InputCollection inputs = service.getInputs(); + + // Iterate inputs and make sure we can read them. + for (Input input : inputs.values()) { + System.out.println("Input name: " + input.getName()); + System.out.println(" title: " + input.getTitle()); + System.out.println(" path: " + input.getPath()); + System.out.println(" type: " + input.getKind()); + DisplaySpecificInput(input); + System.out.println("\n\n"); + } + } +} diff --git a/examples/src/main/java/com/splunk/examples/pivot/Program.java b/examples/src/main/java/com/splunk/examples/pivot/Program.java new file mode 100644 index 00000000..bcb55dec --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/pivot/Program.java @@ -0,0 +1,86 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk.examples.pivot; + +import com.splunk.*; + +public class Program { + public static void main(String[] argv) { + try { + run(argv); + } + catch (Exception e) { + e.printStackTrace(); + System.exit(1); + } + } + + static void run(String[] argsIn) throws Exception { + Command command; + Service service; + + command = Command.splunk("input"); + service = Service.connect(command.opts); + + DataModel dataModel = service.getDataModels().get("internal_audit_logs"); + DataModelObject searches = dataModel.getObject("searches"); + + System.out.print("Working with object " + searches.getDisplayName()); + System.out.println(" in model " + dataModel.getDisplayName()); + System.out.print(" Lineage: "); + for (String name : searches.getLineage()) { + System.out.print(" -> " + name); + } + System.out.println(); + System.out.println(" Internal name: " + searches.getName()); + + Job firstFiveEntries = searches.runQuery("| head 5"); + while (!firstFiveEntries.isDone()) { + Thread.sleep(100); + } + + ResultsReaderXml results = new ResultsReaderXml(firstFiveEntries.getResults()); + for (Event event : results) { + System.out.println(event.toString()); + } + + System.out.println("~~~~~~~~~~~~~~~~~~~~"); + System.out.println("Pivoting on searches"); + + PivotSpecification pivotSpecification = searches.createPivotSpecification(); + + pivotSpecification.addRowSplit("user", "Executing user"); + pivotSpecification.addColumnSplit("exec_time", null, null, null, 4); + pivotSpecification.addCellValue("search", "Search Query", StatsFunction.DISTINCT_VALUES); + + Pivot pivot = pivotSpecification.pivot(); + System.out.println("Query for binning search queries by execution time and executing user:"); + System.out.println(" " + pivot.getPrettyQuery()); + + Job pivotJob = pivot.run(); + while (!pivotJob.isDone()) { + Thread.sleep(100); + } + + results = new ResultsReaderXml(pivotJob.getResults()); + for (Event event : results) { + System.out.println(event.toString()); + } + + } +} + + diff --git a/examples/src/main/java/com/splunk/examples/random_numbers/Program.java b/examples/src/main/java/com/splunk/examples/random_numbers/Program.java new file mode 100644 index 00000000..f21e02c0 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/random_numbers/Program.java @@ -0,0 +1,173 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.random_numbers; + +import com.splunk.modularinput.*; + +import javax.xml.stream.XMLStreamException; +import java.io.IOException; +import java.util.Random; + +// All modular inputs should inherit from the abstract base class com.splunk.modularinput.Script. They must override +// the getScheme and streamEvents methods, and, if the scheme returned by getScheme had +// Scheme.setUseExternalValidation(true) called on it, the validateInput method. The user must provide a main +// method since static methods can't be inherited in Java. However, the main is very simple. +public class Program extends Script { + + // All main methods for modular inputs need only be one line. They can't be inherited because they must create + // an instance of this class, and the abstract base class has no way to do so. So if the class were called MyInput, + // the one line would be + // + // new MyInput().run(args); + // + public static void main(String[] args) { + new Program().run(args); + } + + // When Splunk starts, it looks for all the modular inputs defined by its configuration, and tries to run them + // with the argument --scheme. Splunkd expects the modular inputs to print a description of the input in XML + // on stdout. The modular input framework takes care of all the details of formatting XML and printing it. The + // user need only override getScheme and return a new Scheme object. + @Override + public Scheme getScheme() { + // "random_numbers" is the name Splunk will display to users for this input. + Scheme scheme = new Scheme("random_numbers"); + + scheme.setDescription("Generates events containing a random number."); + // If you set external validation, without overriding validateInput, the script will accept anything as valid. + // Generally you only need external validation if there are relationships you must maintain among the + // parameters, such as requiring min to be less than max in this example, or you need to check that some + // resource is reachable or valid. Otherwise, Splunk lets you specify a validation string for each argument + // and will run validation internally using that string. + scheme.setUseExternalValidation(true); + scheme.setUseSingleInstance(true); + + Argument minArgument = new Argument("min"); + minArgument.setDataType(Argument.DataType.NUMBER); + minArgument.setDescription("Minimum value to be produced by this input."); + minArgument.setRequiredOnCreate(true); + // If you are not using external validation, you would add something like: + // + // setValidation("min > 0"); + scheme.addArgument(minArgument); + + Argument maxArgument = new Argument("max"); + maxArgument.setDataType(Argument.DataType.NUMBER); + maxArgument.setDescription("Maximum value to be produced by this input."); + maxArgument.setRequiredOnCreate(true); + scheme.addArgument(maxArgument); + + return scheme; // ...and don't forget to return the scheme. + } + + // In this example we are using external validation, since we want max to always be greater than min. + // If validateInput does not throw an Exception, the input is assumed to be valid. Otherwise it prints the + // exception as an error message when telling splunkd that the configuration is not valid. + // + // When using external validation, after splunkd calls the modular input with --scheme to get a scheme, it calls it + // again with --validate-arguments for each instance of the modular input in its configuration files, feeding XML + // on stdin to the modular input to get it to do validation. It calls it the same way again whenever a modular + // input's configuration is changed. + @Override + public void validateInput(ValidationDefinition definition) throws Exception { + // Get the values of the two parameters. There are also methods getFloat, getInt, getBoolean, etc., + // and getValue to get the string representation. + double min = ((SingleValueParameter)definition.getParameters().get("min")).getDouble(); + double max = ((SingleValueParameter)definition.getParameters().get("max")).getDouble(); + + if (min >= max) { + throw new Exception("min must be less than max; found min=" + Double.toString(min) + + ", max=" + Double.toString(max)); + } + } + + // Finally, the real action: splunk calls the modular input with no arguments, streams a bunch of XML describing + // the inputs to stdin, and waits for XML on stdout describing events. + // + // If you set setUseSingleInstance(true) on the scheme in getScheme, it will pass all the instances of this input + // to a single instance of this script and it's your job to handle them all. Otherwise, it starts a JVM for each + // instance of the input. + // + // We are using a single instance, and starting a thread for each instance of the modular input. For scripts that + // are not single instance, it is simpler to do the work directly in the streamEvents method. + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws MalformedDataException, + XMLStreamException, IOException { + for (String inputName : inputs.getInputs().keySet()) { + // We get the parameters for each input and start a new thread for each one. All the real work + // happens in the Generator class below. + double min = ((SingleValueParameter)inputs.getInputs().get(inputName).get("min")).getDouble(); + double max = ((SingleValueParameter)inputs.getInputs().get(inputName).get("max")).getDouble(); + + Thread t = new Thread(new Generator(ew, inputName, min, max)); + t.run(); + } + } + + // A Runnable that generates events with a random number in the proper range every half second. All the important + // stuff to look at is in the run method. + class Generator implements Runnable { + private double min, max; + EventWriter ew; + String inputName; + + public Generator(EventWriter ew, String inputName, double min, double max) { + super(); + this.min = min; + this.max = max; + this.ew = ew; + this.inputName = inputName; + } + + public void run() { + // First we log an INFO message that this thread has started. This will show up in splunkd.log and in + // Splunk's _internal index. + + // EventWriter provides both log and synchronizedLog (one a synchronized version of the other). In + // this case, synchronizing at the level of each log message and event is exactly what we want. In + // more complicated cases, you may want to use the unsynchronized version and do your own + // synchronization. + ew.synchronizedLog(EventWriter.INFO, "Random number generator " + inputName + + " started, generating numbers between " + + Double.toString(min) + " and " + Double.toString(max)); + + final Random randomGenerator = new Random(); + + while (true) { + // Write a new event. The minimum that you must set on an event is the stanza it is supposed to + // go to (which you can skip if your modular input is not single instance, and the data of the + // event. + Event event = new Event(); + event.setStanza(inputName); + event.setData("number=" + (randomGenerator.nextDouble() * (max - min) + min)); + + try { + ew.writeEvent(event); + } catch (MalformedDataException e) { + ew.synchronizedLog(EventWriter.ERROR, "MalformedDataException in writing event to input" + + inputName + ": " + e.toString()); + } + + try { + Thread.sleep(500); + } catch (InterruptedException e) { + return; + } + } + } + } +} diff --git a/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/README/inputs.conf.spec b/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/README/inputs.conf.spec new file mode 100644 index 00000000..2b507cea --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/README/inputs.conf.spec @@ -0,0 +1,5 @@ +[random_numbers://default] +*Generates events containing a random floating point number. + +min = +max = diff --git a/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/default/app.conf b/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/default/app.conf new file mode 100644 index 00000000..057bd137 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/random_numbers/random_numbers/default/app.conf @@ -0,0 +1,12 @@ +[install] +is_configured = 0 + +[ui] +is_visible = 1 +label = random-numbers + +[launcher] +author = Fred Ross +description = +version = 1.0 + diff --git a/examples/search/com/splunk/sdk/search/Program.java b/examples/src/main/java/com/splunk/examples/search/Program.java similarity index 65% rename from examples/search/com/splunk/sdk/search/Program.java rename to examples/src/main/java/com/splunk/examples/search/Program.java index fea08cef..f2fbd25a 100644 --- a/examples/search/com/splunk/sdk/search/Program.java +++ b/examples/src/main/java/com/splunk/examples/search/Program.java @@ -14,19 +14,15 @@ * under the License. */ -package com.splunk.sdk.search; +package com.splunk.examples.search; -import com.splunk.Args; -import com.splunk.HttpException; -import com.splunk.Job; -import com.splunk.sdk.Command; -import com.splunk.Service; +import com.splunk.*; import java.io.InputStream; import java.io.InputStreamReader; -import java.io.IOException; import java.io.OutputStreamWriter; import java.util.Arrays; +import java.util.HashMap; // Note: not all search parameters are exposed to the CLI for this example. public class Program { @@ -34,20 +30,24 @@ public class Program { "events", "results", "preview", "searchlog", "summary", "timeline" }; - static String earliestTime = "Search earliest time"; + static String earliestTimeText = "Search earliest time"; static String fieldListText = "A comma-separated list of the fields to return"; - static String latestTime = "Search latest time"; + static String latestTimeText = "Search latest time"; static String offset = - "The first result (inclusive) from which to begin returning data. (default: 0)"; + "The first result (inclusive) from which to begin returning data. " + + "(default: 0)"; static String outputText = - "Which search results to output {events, results, preview, searchlog, summary, timeline} (default: results)"; + "Which search results to output {events, results, preview, searchlog," + + " summary, timeline} (default: results)"; static String outputModeText = "Search output format {csv, raw, json, xml} (default: xml)"; static String resultsCount = "The maximum number of results to return (default: 100)"; + static String readerText = "Use ResultsReader"; static String statusBucketsText = "Number of status buckets to use for search (default: 0)"; + static String verboseString = "Display search progress"; public static void main(String[] args) { try { @@ -59,17 +59,18 @@ public static void main(String[] args) { } } - static void run(String[] args) throws IOException { + static void run(String[] args) throws Exception { Command command = Command.splunk("search"); command.addRule("count", Integer.class, resultsCount); - command.addRule("earliest_time", String.class, earliestTime); + command.addRule("earliest_time", String.class, earliestTimeText); command.addRule("field_list", String.class, fieldListText); - command.addRule("latest_time", String.class, latestTime); + command.addRule("latest_time", String.class, latestTimeText); command.addRule("offset", Integer.class, offset); command.addRule("output", String.class, outputText); command.addRule("output_mode", String.class, outputModeText); + command.addRule("reader", readerText); command.addRule("status_buckets", Integer.class, statusBucketsText); - command.addRule("verbose", "Display search progress"); + command.addRule("verbose", verboseString); command.parse(args); if (command.args.length != 1) @@ -90,7 +91,7 @@ static void run(String[] args) throws IOException { String latestTime = null; if (command.opts.containsKey("latest_time")) - earliestTime = (String)command.opts.get("latest_time"); + latestTime = (String)command.opts.get("latest_time"); int offset = 0; if (command.opts.containsKey("offset")) @@ -117,12 +118,10 @@ static void run(String[] args) throws IOException { // Check the syntax of the query. try { - Args parseArgs = new Args("parse_only", true); - service.parse(query, parseArgs); + service.parse(query, new Args("parse_only", true)); } catch (HttpException e) { - String detail = e.getDetail(); - Command.error("query '%s' is invalid: %s", query, detail); + Command.error("query '%s' is invalid: %s", query, e.getDetail()); } // Create a search job for the given query & query arguments. @@ -135,16 +134,14 @@ static void run(String[] args) throws IOException { queryArgs.put("latest_time", latestTime); if (statusBuckets > 0) queryArgs.put("status_buckets", statusBuckets); + Job job = service.getJobs().create(query, queryArgs); // Wait until results are available. - boolean status = false; - while (true) { - if (job.isDone()) - break; - - // If no outputs are available, optionally print status and wait. - if (verbose) { + boolean didPrintAStatusLine = false; + while (!job.isDone()) { + // If no outputs are available, optionally print status + if (verbose && job.isReady()) { float progress = job.getDoneProgress() * 100.0f; int scanned = job.getScanCount(); int matched = job.getEventCount(); @@ -152,23 +149,20 @@ static void run(String[] args) throws IOException { System.out.format( "\r%03.1f%% done -- %d scanned -- %d matched -- %d results", progress, scanned, matched, results); - status = true; + didPrintAStatusLine = true; } - try { Thread.sleep(2000); } - catch (InterruptedException e) {} - - job.refresh(); + Thread.sleep(1000); } - if (status) System.out.println(""); - - InputStream stream = null; + if (didPrintAStatusLine) + System.out.println(""); Args outputArgs = new Args(); outputArgs.put("count", resultsCount); outputArgs.put("offset", offset); outputArgs.put("output_mode", outputMode); + InputStream stream; if (output.equals("results")) stream = job.getResults(outputArgs); else if (output.equals("events")) @@ -181,23 +175,59 @@ else if (output.equals("summary")) stream = job.getSummary(outputArgs); else if (output.equals("timeline")) stream = job.getTimeline(outputArgs); - else assert(false); - - InputStreamReader reader = new InputStreamReader(stream); - OutputStreamWriter writer = new OutputStreamWriter(System.out); - - int size = 1024; - char[] buffer = new char[size]; - while (true) { - int count = reader.read(buffer); - if (count == -1) break; - writer.write(buffer, 0, count); + else + throw new IllegalArgumentException( + "Unrecognized output type: " + output); + + boolean useReader = command.opts.containsKey("reader"); + if (useReader) { + ResultsReader resultsReader; + if (outputMode.equals("xml")) + resultsReader = new ResultsReaderXml(stream); + else if (outputMode.equals("json")) + resultsReader = new ResultsReaderJson(stream); + else if (outputMode.equals("csv")) + resultsReader = new ResultsReaderCsv(stream); + else + throw new IllegalArgumentException( + "Unrecognized output mode: " + outputMode); + + try { + HashMap event; + while ((event = resultsReader.getNextEvent()) != null) { + System.out.println("EVENT:********"); + for (String key : event.keySet()) + System.out.println(" " + key + " --> " + event.get(key)); + } + } + finally { + resultsReader.close(); + } + } + else { + InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); + try { + OutputStreamWriter writer = new OutputStreamWriter(System.out); + try { + int size = 1024; + char[] buffer = new char[size]; + while (true) { + int count = reader.read(buffer); + if (count == -1) break; + writer.write(buffer, 0, count); + } + + writer.write("\n"); + } + finally { + writer.close(); + } + } + finally { + reader.close(); + } } - - writer.write("\n"); - writer.close(); - reader.close(); job.cancel(); } -} +} \ No newline at end of file diff --git a/examples/search_blocking/com/splunk/sdk/search_blocking/Program.java b/examples/src/main/java/com/splunk/examples/search_blocking/Program.java similarity index 74% rename from examples/search_blocking/com/splunk/sdk/search_blocking/Program.java rename to examples/src/main/java/com/splunk/examples/search_blocking/Program.java index bcce8a7e..b01e946f 100644 --- a/examples/search_blocking/com/splunk/sdk/search_blocking/Program.java +++ b/examples/src/main/java/com/splunk/examples/search_blocking/Program.java @@ -14,19 +14,16 @@ * under the License. */ -package com.splunk.sdk.search_blocking; +package com.splunk.examples.search_blocking; -import com.splunk.Args; -import com.splunk.HttpException; -import com.splunk.Job; -import com.splunk.sdk.Command; -import com.splunk.Service; +import com.splunk.*; import java.io.InputStream; import java.io.InputStreamReader; import java.io.IOException; import java.io.OutputStreamWriter; import java.util.Arrays; +import java.util.HashMap; // Note: not all search parameters are exposed to the CLI for this example. public class Program { @@ -34,18 +31,21 @@ public class Program { "events", "results", "preview", "searchlog", "summary", "timeline" }; - static String earliestTime = "Search earliest time"; + static String earliestTimeText = "Search earliest time"; static String fieldListText = "A comma-separated list of the fields to return"; - static String latestTime = "Search latest time"; + static String latestTimeText = "Search latest time"; static String offset = - "The first result (inclusive) from which to begin returning data. (default: 0)"; + "The first result (inclusive) from which to begin returning data. " + + "(default: 0)"; static String outputText = - "Which search results to output {events, results, preview, searchlog, summary, timeline} (default: results)"; + "Which search results to output {events, results, preview, searchlog," + + " summary, timeline} (default: results)"; static String outputModeText = "Search output format {csv, raw, json, xml} (default: xml)"; static String resultsCount = "The maximum number of results to return (default: 100)"; + static String rawText = "Set to 1 if raw events are displayed (default 1)"; static String statusBucketsText = "Number of status buckets to use for search (default: 0)"; @@ -62,12 +62,13 @@ public static void main(String[] args) { static void run(String[] args) throws IOException { Command command = Command.splunk("search"); command.addRule("count", Integer.class, resultsCount); - command.addRule("earliest_time", String.class, earliestTime); + command.addRule("earliest_time", String.class, earliestTimeText); command.addRule("field_list", String.class, fieldListText); - command.addRule("latest_time", String.class, latestTime); + command.addRule("latest_time", String.class, latestTimeText); command.addRule("offset", Integer.class, offset); command.addRule("output", String.class, outputText); command.addRule("output_mode", String.class, outputModeText); + command.addRule("raw", Integer.class, rawText); command.addRule("status_buckets", Integer.class, statusBucketsText); command.parse(args); @@ -89,7 +90,7 @@ static void run(String[] args) throws IOException { String latestTime = null; if (command.opts.containsKey("latest_time")) - earliestTime = (String)command.opts.get("latest_time"); + latestTime = (String)command.opts.get("latest_time"); int offset = 0; if (command.opts.containsKey("offset")) @@ -133,7 +134,7 @@ static void run(String[] args) throws IOException { if (statusBuckets > 0) queryArgs.put("status_buckets", statusBuckets); - // always block until results are ready. + // Always block until results are ready. queryArgs.put("exec_mode", "blocking"); Job job = service.getJobs().create(query, queryArgs); @@ -158,21 +159,41 @@ else if (output.equals("timeline")) stream = job.getTimeline(outputArgs); else assert(false); - InputStreamReader reader = new InputStreamReader(stream); - OutputStreamWriter writer = new OutputStreamWriter(System.out); - - int size = 1024; - char[] buffer = new char[size]; - while (true) { - int count = reader.read(buffer); - if (count == -1) break; - writer.write(buffer, 0, count); + boolean rawData = true; + if (command.opts.containsKey("raw")) { + int tmp = (Integer)command.opts.get("raw"); + if (tmp == 0 ) rawData = false; } - writer.write("\n"); - writer.close(); - reader.close(); - + if (!rawData) { + HashMap map; + try { + ResultsReaderXml resultsReader = new ResultsReaderXml(stream); + while ((map = resultsReader.getNextEvent()) != null) { + System.out.println("EVENT:********"); + System.out.println(" " + map); + } + resultsReader.close(); + } catch (IOException e) { + System.out.println("I/O exception: " + e); + } + } + else { + InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); + OutputStreamWriter writer = new OutputStreamWriter(System.out); + + int size = 1024; + char[] buffer = new char[size]; + while (true) { + int count = reader.read(buffer); + if (count == -1) break; + writer.write(buffer, 0, count); + } + + writer.write("\n"); + writer.close(); + reader.close(); + } job.cancel(); } } diff --git a/examples/search_oneshot/com/splunk/sdk/search_oneshot/Program.java b/examples/src/main/java/com/splunk/examples/search_oneshot/Program.java similarity index 59% rename from examples/search_oneshot/com/splunk/sdk/search_oneshot/Program.java rename to examples/src/main/java/com/splunk/examples/search_oneshot/Program.java index 3cb5278c..1042ba07 100644 --- a/examples/search_oneshot/com/splunk/sdk/search_oneshot/Program.java +++ b/examples/src/main/java/com/splunk/examples/search_oneshot/Program.java @@ -14,25 +14,30 @@ * under the License. */ -package com.splunk.sdk.search_oneshot; +package com.splunk.examples.search_oneshot; import com.splunk.Args; import com.splunk.HttpException; -import com.splunk.sdk.Command; +import com.splunk.ResultsReaderXml; import com.splunk.Service; +import com.splunk.Command; import java.io.InputStream; import java.io.InputStreamReader; import java.io.IOException; import java.io.OutputStreamWriter; +import java.util.HashMap; // Note: not all search parameters are exposed to the CLI for this example. public class Program { - static String earliestTime = "Search earliest time"; + static String earliestTimeText = "Search earliest time"; static String fieldListText = "A comma-separated list of the fields to return"; - static String latestTime = "Search latest time"; + static String latestTimeText = "Search latest time"; + static String outputModeText = + "Search output format {csv, raw, json, xml} (default: xml)"; + static String rawText = "Set to 1 if raw events are displayed"; static String statusBucketsText = "Number of status buckets to use for search (default: 0)"; @@ -48,9 +53,11 @@ public static void main(String[] args) { static void run(String[] args) throws IOException { Command command = Command.splunk("search"); - command.addRule("earliest_time", String.class, earliestTime); + command.addRule("earliest_time", String.class, earliestTimeText); command.addRule("field_list", String.class, fieldListText); - command.addRule("latest_time", String.class, latestTime); + command.addRule("latest_time", String.class, latestTimeText); + command.addRule("output_mode", String.class, outputModeText); + command.addRule("raw", Integer.class, rawText); command.addRule("status_buckets", Integer.class, statusBucketsText); command.parse(args); @@ -68,12 +75,16 @@ static void run(String[] args) throws IOException { String latestTime = null; if (command.opts.containsKey("latest_time")) - earliestTime = (String)command.opts.get("latest_time"); + latestTime = (String)command.opts.get("latest_time"); int statusBuckets = 0; if (command.opts.containsKey("status_buckets")) statusBuckets = (Integer)command.opts.get("status_buckets"); + String outputMode = "xml"; + if (command.opts.containsKey("output_mode")) + outputMode = (String)command.opts.get("output_mode"); + Service service = Service.connect(command.opts); // Check the syntax of the query. @@ -96,24 +107,46 @@ static void run(String[] args) throws IOException { queryArgs.put("latest_time", latestTime); if (statusBuckets > 0) queryArgs.put("status_buckets", statusBuckets); + queryArgs.put("output_mode", outputMode); - // execute the oneshot query, which returns the stream (i.e. there is + // Execute the oneshot query, which returns the stream (i.e. there is // no search job created, just a one time search) - InputStream stream = service.oneshot(query, queryArgs); - - InputStreamReader reader = new InputStreamReader(stream); - OutputStreamWriter writer = new OutputStreamWriter(System.out); + InputStream stream = service.oneshotSearch(query, queryArgs); - int size = 1024; - char[] buffer = new char[size]; - while (true) { - int count = reader.read(buffer); - if (count == -1) break; - writer.write(buffer, 0, count); + boolean rawData = true; + if (command.opts.containsKey("raw")) { + int tmp = (Integer)command.opts.get("raw"); + if (tmp == 0 ) rawData = false; } - writer.write("\n"); - writer.close(); - reader.close(); + if (!rawData) { + HashMap map; + try { + ResultsReaderXml resultsReader = new ResultsReaderXml(stream); + while ((map = resultsReader.getNextEvent()) != null) { + System.out.println("EVENT:********"); + System.out.println(" " + map); + } + resultsReader.close(); + } catch (IOException e) { + System.out.println("I/O exception: " + e); + } + } + else { + InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); + OutputStreamWriter writer = new OutputStreamWriter(System.out); + + int size = 1024; + char[] buffer = new char[size]; + while (true) { + int count = reader.read(buffer); + if (count == -1) break; + writer.write(buffer, 0, count); + } + + writer.write("\n"); + writer.close(); + reader.close(); + } } } diff --git a/examples/search_realtime/com/splunk/sdk/search_realtime/Program.java b/examples/src/main/java/com/splunk/examples/search_realtime/Program.java similarity index 73% rename from examples/search_realtime/com/splunk/sdk/search_realtime/Program.java rename to examples/src/main/java/com/splunk/examples/search_realtime/Program.java index d2107fab..f2372b53 100644 --- a/examples/search_realtime/com/splunk/sdk/search_realtime/Program.java +++ b/examples/src/main/java/com/splunk/examples/search_realtime/Program.java @@ -14,19 +14,16 @@ * under the License. */ -package com.splunk.sdk.search_realtime; +package com.splunk.examples.search_realtime; -import com.splunk.Args; -import com.splunk.HttpException; -import com.splunk.Job; -import com.splunk.sdk.Command; -import com.splunk.Service; +import com.splunk.*; import java.io.InputStream; import java.io.InputStreamReader; import java.io.IOException; import java.io.OutputStreamWriter; import java.util.Arrays; +import java.util.HashMap; // Note: not all search parameters are exposed to the CLI for this example. public class Program { @@ -34,18 +31,21 @@ public class Program { "events", "results", "preview", "searchlog", "summary", "timeline" }; - static String earliestTime = + static String earliestTimeText = "Search earliest time (default: 'rt-5m')"; static String fieldListText = "A comma-separated list of the fields to return"; - static String latestTime = + static String latestTimeText = "Search latest time (default: 'rt' (i.e. now))"; static String offset = - "The first result (inclusive) from which to begin returning data. (default: 0)"; + "The first result (inclusive) from which to begin returning data. " + + "(default: 0)"; static String outputText = - "Which search results to output {events, results, preview, searchlog, summary, timeline} (default: preview)"; + "Which search results to output {events, results, preview, searchlog," + + " summary, timeline} (default: preview)"; static String outputModeText = "Search output format {csv, raw, json, xml} (default: xml)"; + static String rawText = "Set to 1 if raw events are displayed"; static String resultsCount = "The maximum number of results to return (default: 100)"; static String statusBucketsText = @@ -64,12 +64,13 @@ public static void main(String[] args) { static void run(String[] args) throws IOException { Command command = Command.splunk("search"); command.addRule("count", Integer.class, resultsCount); - command.addRule("earliest_time", String.class, earliestTime); + command.addRule("earliest_time", String.class, earliestTimeText); command.addRule("field_list", String.class, fieldListText); - command.addRule("latest_time", String.class, latestTime); + command.addRule("latest_time", String.class, latestTimeText); command.addRule("offset", Integer.class, offset); command.addRule("output", String.class, outputText); command.addRule("output_mode", String.class, outputModeText); + command.addRule("raw", Integer.class, rawText); command.addRule("status_buckets", Integer.class, statusBucketsText); command.parse(args); @@ -91,7 +92,7 @@ static void run(String[] args) throws IOException { String latestTime = "rt"; if (command.opts.containsKey("latest_time")) - earliestTime = (String)command.opts.get("latest_time"); + latestTime = (String)command.opts.get("latest_time"); int offset = 0; if (command.opts.containsKey("offset")) @@ -131,13 +132,21 @@ static void run(String[] args) throws IOException { if (statusBuckets > 0) queryArgs.put("status_buckets", statusBuckets); - // always set real time search mode + // Always set real time search mode queryArgs.put("search_mode", "realtime"); queryArgs.put("earliest_time", earliestTime); queryArgs.put("latest_time", latestTime); Job job = service.getJobs().create(query, queryArgs); + while (!job.isReady()) { + try { + Thread.sleep(100); + } catch (InterruptedException e) { + // You shouldn't ever get here. + } + } + InputStream stream = null; Args outputArgs = new Args(); @@ -159,21 +168,41 @@ else if (output.equals("timeline")) stream = job.getTimeline(outputArgs); else assert(false); - InputStreamReader reader = new InputStreamReader(stream); - OutputStreamWriter writer = new OutputStreamWriter(System.out); - - int size = 1024; - char[] buffer = new char[size]; - while (true) { - int count = reader.read(buffer); - if (count == -1) break; - writer.write(buffer, 0, count); + boolean rawData = false; + if (command.opts.containsKey("raw")) { + int tmp = (Integer)command.opts.get("raw"); + if (tmp == 0 ) rawData = false; } - writer.write("\n"); - writer.close(); - reader.close(); - + if (!rawData) { + HashMap map; + try { + ResultsReaderXml resultsReader = new ResultsReaderXml(stream); + while ((map = resultsReader.getNextEvent()) != null) { + System.out.println("EVENT:********"); + System.out.println(" " + map); + } + resultsReader.close(); + } catch (IOException e) { + System.out.println("I/O exception: " + e); + } + } + else { + InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); + OutputStreamWriter writer = new OutputStreamWriter(System.out); + + int size = 1024; + char[] buffer = new char[size]; + while (true) { + int count = reader.read(buffer); + if (count == -1) break; + writer.write(buffer, 0, count); + } + + writer.write("\n"); + writer.close(); + reader.close(); + } job.cancel(); } } diff --git a/examples/src/main/java/com/splunk/examples/search_saved/Program.java b/examples/src/main/java/com/splunk/examples/search_saved/Program.java new file mode 100644 index 00000000..be48ba02 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/search_saved/Program.java @@ -0,0 +1,67 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.search_saved; + +import com.splunk.*; + +public class Program { + + static String countString = "How many saved searches to return"; + static String offsetString = "The offset into the collection"; + + private static void list(Service service, Args window) { + + EntityCollection searches; + + if (window == null) + searches = service.getSavedSearches(); + else + searches = service.getSavedSearches(window); + + for (SavedSearch entity: searches.values()) { + System.out.println( + entity.getTitle() + "\n" + + " (" + entity.getSearch()+ ")"); + } + } + + public static void main(String[] args) { + Command command = Command.splunk("search saved").parse(args); + command.addRule("count", String.class, countString); + command.addRule("offset", String.class, offsetString); + Service service = Service.connect(command.opts); + + if (command.args.length == 0) { + list(service, null); + return; + } + + Args window = new Args(); + for (String value: args) { + String [] parts = value.split("="); + if (parts.length != 2) { + Command.error("Arguments are of the form: name=value"); + } + if (!parts[0].equals("count") && !parts[0].equals("offset")) { + Command.error("Unknown key: " + parts[0]); + } + window.put(parts[0], parts[1]); + } + + list(service, window); + } +} diff --git a/examples/src/main/java/com/splunk/examples/search_simple/Program.java b/examples/src/main/java/com/splunk/examples/search_simple/Program.java new file mode 100644 index 00000000..9f279ddc --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/search_simple/Program.java @@ -0,0 +1,88 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.examples.search_simple; + +import com.splunk.Args; +import com.splunk.HttpException; +import com.splunk.Service; +import com.splunk.Command; + +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.IOException; +import java.io.OutputStreamWriter; + +// Note: not all search parameters are exposed to the CLI for this example. +public class Program { + + public static void main(String[] args) { + try { + run(args); + } + catch (Exception e) { + e.printStackTrace(); + System.exit(1); + } + } + + static void run(String[] args) throws IOException { + Command command = Command.splunk("search"); + command.parse(args); + + if (command.args.length != 1) + Command.error("Search expression required"); + String query = command.args[0]; + + Service service = Service.connect(command.opts); + + // Check the syntax of the query. + try { + Args parseArgs = new Args("parse_only", true); + service.parse(query, parseArgs); + } + catch (HttpException e) { + String detail = e.getDetail(); + Command.error("query '%s' is invalid: %s", query, detail); + } + + // This is the simplest form of searching splunk. Note that additional + // arguments are allowed, but they are not shown in this example. + InputStream stream = service.oneshotSearch(query); + + InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); + try { + OutputStreamWriter writer = new OutputStreamWriter(System.out); + try { + int size = 1024; + char[] buffer = new char[size]; + while (true) { + int count = reader.read(buffer); + if (count == -1) break; + writer.write(buffer, 0, count); + } + + writer.write("\n"); + } + finally { + writer.close(); + } + } + finally { + reader.close(); + } + } +} diff --git a/examples/spurl/com/splunk/sdk/spurl/Program.java b/examples/src/main/java/com/splunk/examples/spurl/Program.java similarity index 92% rename from examples/spurl/com/splunk/sdk/spurl/Program.java rename to examples/src/main/java/com/splunk/examples/spurl/Program.java index c00f6845..8c1707b3 100644 --- a/examples/spurl/com/splunk/sdk/spurl/Program.java +++ b/examples/src/main/java/com/splunk/examples/spurl/Program.java @@ -14,11 +14,11 @@ * under the License. */ -package com.splunk.sdk.spurl; +package com.splunk.examples.spurl; import com.splunk.Service; import com.splunk.ResponseMessage; -import com.splunk.sdk.Command; +import com.splunk.Command; import java.io.BufferedReader; import java.io.InputStreamReader; @@ -47,7 +47,7 @@ static void run(String[] args) throws IOException { if (status != 200) return; BufferedReader reader = new BufferedReader( - new InputStreamReader(response.getContent())); + new InputStreamReader(response.getContent(), "UTF-8")); while (true) { String line = reader.readLine(); if (line == null) break; diff --git a/examples/src/main/java/com/splunk/examples/ssl_protocols/Program.java b/examples/src/main/java/com/splunk/examples/ssl_protocols/Program.java new file mode 100644 index 00000000..a6352054 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/ssl_protocols/Program.java @@ -0,0 +1,157 @@ +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +/** + * This example will demonstrate how to use a specific SSL/TLS + * protocol to connect to Splunk. + * Additionally, there's a small code sample showing how to + * use a custom SSLSocketFactory to connect to Splunk. + */ + +package com.splunk.examples.ssl_protocols; + +import com.splunk.Command; +import com.splunk.SSLSecurityProtocol; +import com.splunk.Service; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLSocketFactory; +import javax.net.ssl.TrustManager; +import javax.net.ssl.X509TrustManager; +import java.security.SecureRandom; +import java.security.cert.X509Certificate; + + +public class Program { + + public static Integer getJavaVersion() { + String ver = System.getProperty("java.version"); + return Integer.parseInt(ver.substring(2, 3)); + } + + public static void main(String[] args) { + Command command = Command.splunk("info").parse(args); + + int version = getJavaVersion(); + System.out.println("Your Java version is: " + version); + + // At this point, the default protocol is SSLv3. + // Possible values are TLSv1.2, TLSv1.1, TLSv1 & SSLv3 + // These are defined by the SSLSecurityProtocol enum + // Java 8 disables SSLv3 by default + System.out.println("Now trying to connect to Splunk using SSLv3"); + try { + Service.setSslSecurityProtocol(SSLSecurityProtocol.SSLv3); + Service serviceSSLv3 = Service.connect(command.opts); + serviceSSLv3.login(); + System.out.println("\t Success!"); + } catch (RuntimeException e) { + System.out.println("\t Failure! "); + } + + // TLSv1 is available by default in every modern version of Java + System.out.println("Now trying to connect to Splunk using TLSv1"); + try { + Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1); + Service serviceTLSv1 = Service.connect(command.opts); + serviceTLSv1.login(); + System.out.println("\t Success!"); + } catch (RuntimeException e) { + System.out.println("\t Failure! "); + } + + + // TLSv1.1 is available by default in Java 7 and up + System.out.println("Now trying to connect to Splunk using TLSv1.1"); + try { + Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_1); + Service serviceTLSv1_1 = Service.connect(command.opts); + serviceTLSv1_1.login(); + System.out.println("\t Success!"); + } catch (RuntimeException e) { + System.out.println("\t Failure! "); + } + + // TLSv1.2 is available by default in Java 7 and up + System.out.println("Now trying to connect to Splunk using TLSv1.2"); + try { + Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2); + Service serviceTLSv1_2 = Service.connect(command.opts); + serviceTLSv1_2.login(); + System.out.println("\t Success!"); + } catch (RuntimeException e) { + System.out.println("\t Failure! "); + } + + // You can also specify your own SSLSocketFactory, in this case any version of SSL + System.out.println("Now trying to connect to Splunk using a custom SSL only SSLSocketFactory"); + try { + // Create an SSLSocketFactory configured to use SSL only + SSLContext sslContext = SSLContext.getInstance("SSL"); + TrustManager[] byPassTrustManagers = new TrustManager[]{ + new X509TrustManager() { + public X509Certificate[] getAcceptedIssuers() { + return null; + } + + public void checkClientTrusted(X509Certificate[] chain, String authType) { + } + + public void checkServerTrusted(X509Certificate[] chain, String authType) { + } + } + }; + sslContext.init(null, byPassTrustManagers, new SecureRandom()); + SSLSocketFactory SSLOnlySSLFactory = sslContext.getSocketFactory(); + Service.setSSLSocketFactory(SSLOnlySSLFactory); + + Service serviceCustomSSLFactory = Service.connect(command.opts); + serviceCustomSSLFactory.login(); + System.out.println("\t Success!"); + } catch (Exception e) { + System.out.println("\t Failure!"); + } + + // You can also specify your own SSLSocketFactory, in this case any version of TLS + System.out.println("Now trying to connect to Splunk using a custom TLS only SSLSocketFactory"); + try { + // Create an SSLSocketFactory configured to use TLS only + SSLContext sslContext = SSLContext.getInstance("TLS"); + TrustManager[] byPassTrustManagers = new TrustManager[]{ + new X509TrustManager() { + public X509Certificate[] getAcceptedIssuers() { + return null; + } + + public void checkClientTrusted(X509Certificate[] chain, String authType) { + } + + public void checkServerTrusted(X509Certificate[] chain, String authType) { + } + } + }; + sslContext.init(null, byPassTrustManagers, new SecureRandom()); + SSLSocketFactory TLSOnlySSLFactory = sslContext.getSocketFactory(); + Service.setSSLSocketFactory(TLSOnlySSLFactory); + + Service serviceCustomSSLFactory = Service.connect(command.opts); + serviceCustomSSLFactory.login(); + System.out.println("\t Success!"); + } catch (Exception e) { + System.out.println("\t Failure!"); + } + } +} \ No newline at end of file diff --git a/examples/tail/com/splunk/sdk/tail/Program.java b/examples/src/main/java/com/splunk/examples/tail/Program.java similarity index 76% rename from examples/tail/com/splunk/sdk/tail/Program.java rename to examples/src/main/java/com/splunk/examples/tail/Program.java index f69252d7..6f2b7543 100644 --- a/examples/tail/com/splunk/sdk/tail/Program.java +++ b/examples/src/main/java/com/splunk/examples/tail/Program.java @@ -14,10 +14,9 @@ * under the License. */ -package com.splunk.sdk.tail; +package com.splunk.examples.tail; import com.splunk.*; -import com.splunk.sdk.Command; import java.io.InputStream; import java.io.InputStreamReader; @@ -45,7 +44,7 @@ public static void main(String[] args) { static void run(String[] argsIn) throws Exception { Command command = Command.splunk("tail"); - command.addRule("format", Integer.class, outputModeText); + command.addRule("format", String.class, outputModeText); command.parse(argsIn); if (command.args.length != 1) @@ -55,21 +54,21 @@ static void run(String[] argsIn) throws Exception { Service service = Service.connect(command.opts); String outputMode = "csv"; - if (command.opts.containsKey("output_mode")) - outputMode = (String)command.opts.get("output_mode"); + if (command.opts.containsKey("format")) + outputMode = (String)command.opts.get("format"); Args args = new Args(); // search args - args.put("timeout", "60"); // don't keep search around - args.put("output_mode", outputMode); // output in specific format - args.put("earliest_time", "rt"); // realtime - args.put("latest_time", "rt"); // realtime - args.put("search_mode", "realtime"); // realtime + args.put("timeout", "60"); // Don't keep search around + args.put("output_mode", outputMode); // Output in specific format + args.put("earliest_time", "rt"); // Realtime + args.put("latest_time", "rt"); // Realtime + args.put("search_mode", "realtime"); // Realtime InputStream is = service.export(query, args); - // use UTF8 sensitive reader/writers - InputStreamReader reader = new InputStreamReader(is, "UTF8"); + // Use UTF8 sensitive reader/writers + InputStreamReader reader = new InputStreamReader(is, "UTF-8"); OutputStreamWriter writer = new OutputStreamWriter(System.out); int size = 1024; diff --git a/examples/src/main/java/com/splunk/examples/testupdate/Program.java b/examples/src/main/java/com/splunk/examples/testupdate/Program.java new file mode 100644 index 00000000..127b3746 --- /dev/null +++ b/examples/src/main/java/com/splunk/examples/testupdate/Program.java @@ -0,0 +1,11 @@ +package com.splunk.examples.testupdate; + +/** + * Created with IntelliJ IDEA. + * User: fross + * Date: 11/4/13 + * Time: 1:56 PM + * To change this template use File | Settings | File Templates. + */ +public class Program { +} diff --git a/examples/tail/tail.iml b/examples/tail/tail.iml deleted file mode 100644 index be81447e..00000000 --- a/examples/tail/tail.iml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - - - diff --git a/launchers/README.md b/launchers/README.md new file mode 100644 index 00000000..a13675d6 --- /dev/null +++ b/launchers/README.md @@ -0,0 +1,85 @@ +# Modular input launchers for the Splunk Enterprise SDK for Java + +Splunk Enterprise cannot launch Java programs as modular inputs directly. Instead, we need to provide a few small programs to launch a JVM and run a program. Since modular inputs written in Java need to work across all Splunk variants, including the universal forwarder, the launchers cannot rely on Python or anything else in the underlying system. Instead, we provide a set of C programs compiled for each of Linux, MacOS X, and Windows. + +The programs assume the following layout in an app: a jars/ directory containing a launchable jar containing the modular input, and a configuration file with a .ini suffix of the same base name that contains options for what JVM to launch and what options to pass to it. Then platform specific bin directories contain the launcher programs, named the base name of the target jar. For for a jar named myinput.jar, the layout would be + +myapp/ + jars/ + myinput.jar + myinput.ini + linux_x86/ + myinput + linux_x86_64/ + myinput + darwin_x86_64/ + myinput + windows_x86/ + myinput.exe + windows_x86_64/ + myinput.exe + +The configuration file should have the form + +JAVA_HOME=/path/to/jre +JAVA_OPTS=options to pass to JVM + +The keys are case insensitive, and leading whitespace and whitespace around the equals sign is ignored. + +The POSIX launchers use the exec system call to replace the launcher with a JVM with the proper arguments. The Windows launcher starts the JVM with a call to CreateProcess, forwards exit events, and monitors the JVM it launches for termination. + +Testing story: + +http://stackoverflow.com/questions/65820/unit-testing-c-code + +There are a lot of options. + + + +Windows: + +Use GetModuleFileName(NULL) to get current name and path of this executable. + +For Linux, + + char *resolved_path = realpath("/proc/self/exe", NULL); + printf("%s\n", resolved_path); + free(resolved_path); + +/proc/pid/exe on Linux and /proc/pid/file on BSD are symlinks to the executable. Call readlink to resolve the symlink to get the path. + +On OS X, there are two ways: +http://stackoverflow.com/questions/799679/programatically-retrieving-the-absolute-path-of-an-os-x-command-line-app/1024933#1024933 +libproc.h has proc_pidpath +_NSGetExecutablePath in dyld + +#include +#include +#include +#include +#include + +int main (int argc, char* argv[]) +{ + int ret; + pid_t pid; + char pathbuf[PROC_PIDPATHINFO_MAXSIZE]; + + pid = getpid(); + ret = proc_pidpath (pid, pathbuf, sizeof(pathbuf)); + if ( ret <= 0 ) { + fprintf(stderr, "PID %d: proc_pidpath ();\n", pid); + fprintf(stderr, " %s\n", strerror(errno)); + } else { + printf("proc %d: %s\n", pid, pathbuf); + } + + return 0; +} + +proc_pidpath looks like the way to go. I'll test it. + +To exec the program: + + char* args[] = {"java", "-jar", "braindead.jar", NULL}; + execvp("java", args); diff --git a/launchers/shim-darwin.sh b/launchers/shim-darwin.sh new file mode 100755 index 00000000..145f1e46 --- /dev/null +++ b/launchers/shim-darwin.sh @@ -0,0 +1,42 @@ +# Shim to run a modular input written in Java. The modular input +# is assumed to be in the form of an executable jar. This shim +# is in ${PLATFORM}/bin/${INPUTNAME}.sh of the app the modular +# input is contained in, and the jar is assumed to be in +# jars/${INPUTNAME}.jar in the app. +# +# If ${PLATFORM}/bin/customized.java.path exists, this script will +# use java cmd defined in this file to start jvm, else default java +# will be used. +# +# Extra arguments to the JVM (i.e., -Xms512M) can be put in +# a file jars/${INPUTNAME}.vmopts and will be interpolated +# into the command to run the JVM. +SCRIPT="$0" + +cd `dirname "$SCRIPT"` +SCRIPT=`basename "$SCRIPT"` + +while [ -L "$SCRIPT" ]; do + SCRIPT=`readlink "$SCRIPT"` + cd `dirname "$SCRIPT"` + SCRIPT=`basename "$SCRIPT"` +done + +BASENAME=$(basename "$SCRIPT" .sh) +JAR_DIR=`pwd -P`/../../jars +CUSTOMIZED_JAVA_PATH_FILE=`pwd -P`/customized.java.path + +if [ -f $CUSTOMIZED_JAVA_PATH_FILE ]; then + JAVA_CMD=`cat $CUSTOMIZED_JAVA_PATH_FILE` +else + JAVA_CMD="java" +fi + +if [ -f $JAR_DIR/$BASENAME.vmopts ]; then + VMOPTS=`cat $JAR_DIR/$BASENAME.vmopts` +else + VMOPTS="" +fi + +exec $JAVA_CMD $VMOPTS -jar $JAR_DIR/$BASENAME.jar $@ + diff --git a/launchers/shim-linux.sh b/launchers/shim-linux.sh new file mode 100755 index 00000000..e0676451 --- /dev/null +++ b/launchers/shim-linux.sh @@ -0,0 +1,31 @@ +# Shim to run a modular input written in Java. The modular input +# is assumed to be in the form of an executable jar. This shim +# is in ${PLATFORM}/bin/${INPUTNAME}.sh of the app the modular +# input is contained in, and the jar is assumed to be in +# jars/${INPUTNAME}.jar in the app. +# +# If ${PLATFORM}/bin/customized.java.path exists, this script will +# use java cmd defined in this file to start jvm, else default java +# will be used. +# +# Extra arguments to the JVM (i.e., -Xms512M) can be put in +# a file jars/${INPUTNAME}.vmopts and will be interpolated +# into the command to run the JVM. +SCRIPT=$(readlink -f "$0") +BASENAME=$(basename "$SCRIPT" .sh) +JAR_DIR=$(dirname "$SCRIPT")/../../jars +CUSTOMIZED_JAVA_PATH_FILE=$(dirname "$SCRIPT")/customized.java.path + +if [ -f $CUSTOMIZED_JAVA_PATH_FILE ]; then + JAVA_CMD=`cat $CUSTOMIZED_JAVA_PATH_FILE` +else + JAVA_CMD="java" +fi + +if [ -f $JAR_DIR/$BASENAME.vmopts ]; then + VMOPTS=`cat $JAR_DIR/$BASENAME.vmopts` +else + VMOPTS="" +fi + +exec $JAVA_CMD $VMOPTS -jar $JAR_DIR/$BASENAME.jar $@ \ No newline at end of file diff --git a/launchers/shim-windows_x86.exe b/launchers/shim-windows_x86.exe new file mode 100755 index 00000000..3ec87105 Binary files /dev/null and b/launchers/shim-windows_x86.exe differ diff --git a/launchers/shim-windows_x86_64.exe b/launchers/shim-windows_x86_64.exe new file mode 100755 index 00000000..ffb1f4fc Binary files /dev/null and b/launchers/shim-windows_x86_64.exe differ diff --git a/launchers/shim/jars/shim.jar b/launchers/shim/jars/shim.jar new file mode 100755 index 00000000..cc5440c1 Binary files /dev/null and b/launchers/shim/jars/shim.jar differ diff --git a/launchers/shim/jars/shim.vmopts b/launchers/shim/jars/shim.vmopts new file mode 100755 index 00000000..2b72e100 --- /dev/null +++ b/launchers/shim/jars/shim.vmopts @@ -0,0 +1 @@ +-Xms512M \ No newline at end of file diff --git a/launchers/shim/shim.sln b/launchers/shim/shim.sln new file mode 100755 index 00000000..67987d0b --- /dev/null +++ b/launchers/shim/shim.sln @@ -0,0 +1,26 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2012 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "shim", "shim\shim.vcxproj", "{830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Debug|Win32.ActiveCfg = Debug|x64 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Debug|Win32.Build.0 = Debug|x64 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Debug|x64.ActiveCfg = Debug|x64 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Debug|x64.Build.0 = Debug|x64 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Release|Win32.ActiveCfg = Release|Win32 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Release|Win32.Build.0 = Release|Win32 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Release|x64.ActiveCfg = Release|x64 + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/launchers/shim/shim.v11.suo b/launchers/shim/shim.v11.suo new file mode 100755 index 00000000..d173cadb Binary files /dev/null and b/launchers/shim/shim.v11.suo differ diff --git a/launchers/shim/shim/ReadMe.txt b/launchers/shim/shim/ReadMe.txt new file mode 100755 index 00000000..8672406b --- /dev/null +++ b/launchers/shim/shim/ReadMe.txt @@ -0,0 +1,40 @@ +======================================================================== + CONSOLE APPLICATION : shim Project Overview +======================================================================== + +AppWizard has created this shim application for you. + +This file contains a summary of what you will find in each of the files that +make up your shim application. + + +shim.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +shim.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +shim.cpp + This is the main application source file. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named shim.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/launchers/shim/shim/shim.cpp b/launchers/shim/shim/shim.cpp new file mode 100755 index 00000000..cbbf0778 --- /dev/null +++ b/launchers/shim/shim/shim.cpp @@ -0,0 +1,403 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +#include "stdafx.h" +#include "shim.h" + +// Global variable used to let the Ctrl+C handler propogate Ctrl+C to the JVM. +DWORD jvmPid = NULL; + +int _tmain(int argc, _TCHAR* argv[]) +{ + HANDLE processHandles[2] = {NULL, NULL}; + HANDLE &splunkdHandle = processHandles[0]; + HANDLE &jvmHandle = processHandles[1]; + HANDLE ghJob = NULL; + PTSTR customizedJavaCmd = NULL, jarPath = NULL, jvmOptions = NULL, jvmCommandLine = NULL; + DWORD waitOutcome; + DWORD returnCode = 0; + + STARTUPINFO si; + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + + PROCESS_INFORMATION pi; + ZeroMemory(&pi, sizeof(pi)); + + SetConsoleCtrlHandler((PHANDLER_ROUTINE)killJvm, TRUE); + splunkdHandle = getSplunkdHandle(); + + if (NULL == splunkdHandle) { + // Couldn't get a handle to splunkd. + printErrorMessage(GetLastError()); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + } + + // create a job + ghJob = CreateJobObject(NULL, NULL); + if(ghJob == NULL) { + printErrorMessage(GetLastError()); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + }else { + JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli = { 0 }; + + // Configure all child processes associated with the job to terminate when the main process terminated + jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE; + if(0 == SetInformationJobObject(ghJob, JobObjectExtendedLimitInformation, &jeli, sizeof(jeli))) { + printErrorMessage(GetLastError()); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + } + } + + customizedJavaCmd = getCustomizedJavaCmd(); + jarPath = getPathToJar(); + jvmOptions = readJvmOptions(jarPath); + jvmCommandLine = assembleJvmCommand(customizedJavaCmd, jarPath, jvmOptions, argc, argv); + + if (!CreateProcess(NULL, jvmCommandLine, NULL, NULL, FALSE, CREATE_NEW_PROCESS_GROUP, NULL, NULL, &si, &pi)) { + // Process creation failed. + printErrorMessage(GetLastError(), jvmCommandLine); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + } + + // bind java process to this job + if(0 == AssignProcessToJobObject(ghJob, pi.hProcess)) { + printErrorMessage(GetLastError()); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + } + + CloseHandle(pi.hThread); // CreateProcess gives us a handle to the initial thread of the new process, which we don't need. + jvmHandle = pi.hProcess; + jvmPid = pi.dwProcessId; + waitOutcome = WaitForMultipleObjects(2, processHandles, FALSE, INFINITE); + + if (waitOutcome == WAIT_OBJECT_0) { + // Splunkd has died + GenerateConsoleCtrlEvent(CTRL_C_EVENT, 0); + + goto CLEAN_UP_AND_EXIT; + } else if (waitOutcome == WAIT_OBJECT_0 + 1) { + // JVM has died + if (!GetExitCodeProcess(jvmHandle, &returnCode)) { + printErrorMessage(GetLastError()); + returnCode = 1; + } + goto CLEAN_UP_AND_EXIT; + } else { + // There was some other error + printErrorMessage(GetLastError()); + + returnCode = 1; + goto CLEAN_UP_AND_EXIT; + } + +CLEAN_UP_AND_EXIT: + if (NULL != jvmCommandLine) LocalFree(jvmCommandLine); + if (NULL != jvmOptions) LocalFree(jvmOptions); + if (NULL != jarPath) LocalFree(jarPath); + if (NULL != customizedJavaCmd) LocalFree(customizedJavaCmd); + + if (NULL != splunkdHandle) CloseHandle(splunkdHandle); + if (NULL != jvmHandle) CloseHandle(jvmHandle); + if (NULL != ghJob) CloseHandle(ghJob); + + return returnCode; +} + + +BOOL killJvm(DWORD interruptCode) { + if (jvmPid != NULL) { + GenerateConsoleCtrlEvent(interruptCode, jvmPid); + return TRUE; + } else { + return FALSE; + } +} + + +void printErrorMessage(DWORD errorCode, ...) { + LPTSTR buffer; + + va_list args = NULL; + va_start(args, errorCode); + + FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER, + NULL, errorCode, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&buffer, 0, &args); + + fwprintf(stderr, TEXT("ERROR %s\r\n"), buffer); + + LocalFree(buffer); +} + + +PTSTR readJvmOptions(PTSTR jarPath) { + size_t jarPathLen = _tcslen(jarPath); + // vmoptsPath is the same as jarPath, but ending with .vmopts instead of .jar. We allocate + // 3 additional TCHARs for the additional length of .vmopts, and 1 more TCHAR for a NULL + // terminator, so jarPathLen+4. + PTSTR vmoptsPath = (PTSTR)malloc(sizeof(TCHAR) * (jarPathLen + 4)); + PTSTR suffixPtr = vmoptsPath; + + _tcscpy_s(vmoptsPath, jarPathLen+1, jarPath); + + suffixPtr = _tcsrchr(vmoptsPath, CHAR('.')); + if (suffixPtr == 0) { + SetLastError(ERROR_INVALID_DATA); + return NULL; + } + + _tcscpy_s(suffixPtr, 8, TEXT(".vmopts")); + + HANDLE vmoptsHandle = CreateFile(vmoptsPath, GENERIC_READ, FILE_SHARE_READ, + NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + + if (INVALID_HANDLE_VALUE == vmoptsHandle) { + if (ERROR_FILE_NOT_FOUND == GetLastError() || ERROR_PATH_NOT_FOUND == GetLastError()) { + // We can't return a literal because we will try to deallocate it later. + free(vmoptsPath); + vmoptsPath = (PTSTR)malloc(sizeof(TCHAR)); + _tcscpy_s(vmoptsPath, 1, TEXT("")); + return vmoptsPath; + } else { + return NULL; + } + } + + DWORD fileSize = GetFileSize(vmoptsHandle, NULL); + if (INVALID_FILE_SIZE == fileSize) { + return NULL; + } + + DWORD nRead; + char* buffer = (char*)malloc((fileSize+1) * sizeof(char)); // +1 to give space for a NULL character. + if (!ReadFile(vmoptsHandle, buffer, fileSize, &nRead, NULL)) { + return NULL; + } + buffer[nRead] = NULL; // Ensure options are null terminated. + + if (NULL != vmoptsHandle) CloseHandle(vmoptsHandle); + +#ifdef _UNICODE + // Calculate how much space is needed. + DWORD nWchars = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, buffer, nRead, NULL, 0); + wchar_t *vmopts = (wchar_t*)malloc(sizeof(wchar_t) * (nWchars+1)); + if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, buffer, nRead, vmopts, nWchars)) { + return NULL; + } + vmopts[nWchars] = NULL; + return vmopts; +#else + return buffer; +#endif +} + + +PTSTR assembleJvmCommand(PTSTR customizedJavaCmd, PTSTR jarPath, PTSTR jvmOptions, int argc, _TCHAR* argv[]) { + PTSTR buffer, index; + size_t len; + int i; + + len = 0; + for (i = 1; i < argc; i++) { + len += _tcslen(argv[i]) + 1; // The +1 accounts for a space to separate the arguments + } + + // 9 + max(command) = number of characters for java cmd and -jar sections; +1 at the end is for the null terminator. + buffer = (PTSTR)malloc((9 + max(_tcslen(customizedJavaCmd), 4) + _tcslen(jarPath) + _tcslen(jvmOptions) + len + 1) * sizeof(TCHAR)); + index = buffer; + +#define APPEND_TCS(literal) { \ + _tcscpy_s(index, _tcslen(literal)+1, literal); \ + index += _tcslen(literal); \ +} + if (NULL != customizedJavaCmd && 0 != _tcslen(customizedJavaCmd)) { + APPEND_TCS(customizedJavaCmd); + APPEND_TCS(TEXT(" ")); + } else { + APPEND_TCS(TEXT("java ")); + } + APPEND_TCS(jvmOptions); + APPEND_TCS(TEXT(" -jar \"")); + APPEND_TCS(jarPath); + APPEND_TCS(TEXT("\"")); + + for (i = 1; i < argc; i++) { + APPEND_TCS(TEXT(" ")); + APPEND_TCS(argv[i]); + } + +#undef APPEND_TCS + + return buffer; +} + + +HANDLE getSplunkdHandle() { + const TCHAR* SPLUNKD_HANDLE_ENVVAR = TEXT("SPLUNKD_PROCESSID"); + + size_t bufferSize; + TCHAR* pidBuffer; + TCHAR* stopString; + + DWORD splunkdPid; + + // Find how large a buffer we need. + _tgetenv_s(&bufferSize, NULL, 0, SPLUNKD_HANDLE_ENVVAR); + if (bufferSize == 0) { + SetLastError(ERROR_ENVVAR_NOT_FOUND); + return NULL; + } + + pidBuffer = (PTSTR)malloc(bufferSize * sizeof(TCHAR)); + if (_tgetenv_s(&bufferSize, pidBuffer, bufferSize, SPLUNKD_HANDLE_ENVVAR)) { + return NULL; // There was an error in getting the environment variable. + } + splunkdPid = _tcstoul(pidBuffer, &stopString, 10); + + if (*stopString != NULL || splunkdPid == 0) { + // We haven't parsed the whole environment variable as a number. + SetLastError(ERROR_BAD_ENVIRONMENT); + return NULL; + } + + free(pidBuffer); + + return OpenProcess(SYNCHRONIZE, FALSE, splunkdPid); +} + + +PTSTR getPathToJar() { + PTSTR thisPath, endPtr, baseName; + PCTSTR jarPathFragment = TEXT("\\jars\\"); + const DWORD jarPathFragmentLen = 7; + PCTSTR jarSuffix = TEXT(".jar"); + const DWORD jarSuffixLen = 5; + const size_t N = 1024; + size_t baseNameLen; + + thisPath = (PTSTR)malloc(N*sizeof(TCHAR)); + if (N == GetModuleFileName(NULL, thisPath, N) && ERROR_INSUFFICIENT_BUFFER == GetLastError()) { + return NULL; + } + + // The following code removes the last two path segments before the executable name in the buffer, + // puts a \jars\ on the path, then shifts the base name of the executable over and adds .jar to it. + // Graphically, with 0 representing null terminators, the steps are: + // + // 1. $SPLUNK_HOME$\etc\apps\myapp\windows_x86_64\bin\myinput.exe0 + // 2. $SPLUNK_HOME$\etc\apps\myapp\jars\0 myinput.exe0 + // 3. $SPLUNK_HOME$\etc\apps\myapp\jars\myinput0 + // 4. $SPLUNK_HOME$\etc\apps\myapp\jars\myinput.jar0 + + // Find 'myinput.exe', just after the last \. + endPtr = _tcsrchr(thisPath, '\\'); + baseName = endPtr+1; // This is 'myinput.exe' + *endPtr = NULL; // NULL terminate the string before this point so we can strrchar to get the next \. + endPtr = _tcsrchr(baseName, '.'); // Find .exe, and NULL terminate the base name. + *endPtr = NULL; + + // Take two directory levels off this path. + endPtr = _tcsrchr(thisPath, '\\'); + *endPtr = NULL; + endPtr = _tcsrchr(thisPath, '\\'); + + if ((size_t)(baseName-endPtr) < _tcslen(TEXT("\\jars\\"))) { + return NULL; // Not enough space to copy the path fragment in without clobbering the jar name. + } + + // Instead of NULL terminating, we copy \jars\ over top and advance to the end of it. + _tcscpy_s(endPtr, jarPathFragmentLen, jarPathFragment); + endPtr += jarPathFragmentLen - 1; + // Now shift the base name over. + baseNameLen = _tcslen(baseName) + 1; + // Advance endPtr and add .jar to it. + memmove_s(endPtr, baseNameLen*sizeof(TCHAR), baseName, baseNameLen*sizeof(TCHAR)); + endPtr += baseNameLen - 1; + _tcscpy_s(endPtr, jarSuffixLen, jarSuffix); + + return thisPath; +} + +PTSTR getCustomizedJavaCmd() { + PTSTR javaHomePath, endPtr; + PCTSTR javaHomeFragment = TEXT("\\customized.java.path"); + const DWORD javaHomeFragmentLen = 22; + const size_t N = 1024; + + javaHomePath = (PTSTR)malloc(N*sizeof(TCHAR)); + if (N == GetModuleFileName(NULL, javaHomePath, N) && ERROR_INSUFFICIENT_BUFFER == GetLastError()) { + return NULL; + } + + // thisPath is: $SPLUNK_HOME$\etc\apps\myapp\windows_x86_64\bin\myinput.exe0 + // Take three directory levels off this path. + endPtr = _tcsrchr(javaHomePath, '\\'); + _tcscpy_s(endPtr, javaHomeFragmentLen, javaHomeFragment); + endPtr += javaHomeFragmentLen; + *endPtr = NULL; + + HANDLE javaHomeHandle = CreateFile(javaHomePath, GENERIC_READ, FILE_SHARE_READ, + NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + + if (INVALID_HANDLE_VALUE == javaHomeHandle) { + if (ERROR_FILE_NOT_FOUND == GetLastError() || ERROR_PATH_NOT_FOUND == GetLastError()) { + // We can't return a literal because we will try to deallocate it later. + free(javaHomePath); + javaHomePath = (PTSTR)malloc(sizeof(TCHAR)); + _tcscpy_s(javaHomePath, 1, TEXT("")); + return javaHomePath; + } else { + return NULL; + } + } + + DWORD fileSize = GetFileSize(javaHomeHandle, NULL); + if (INVALID_FILE_SIZE == fileSize) { + return NULL; + } + + DWORD nRead; + char* buffer = (char*)malloc((fileSize+1) * sizeof(char)); // +1 to give space for a NULL character. + if (!ReadFile(javaHomeHandle, buffer, fileSize, &nRead, NULL)) { + return NULL; + } + buffer[nRead] = NULL; // Ensure options are null terminated. + + if (NULL != javaHomeHandle) CloseHandle(javaHomeHandle); + +#ifdef _UNICODE + // Calculate how much space is needed. + DWORD nWchars = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, buffer, nRead, NULL, 0); + wchar_t *javaHome = (wchar_t*)malloc(sizeof(wchar_t) * (nWchars+1)); + if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, buffer, nRead, javaHome, nWchars)) { + return NULL; + } + javaHome[nWchars] = NULL; + return javaHome; +#else + return buffer; +#endif +} diff --git a/launchers/shim/shim/shim.h b/launchers/shim/shim/shim.h new file mode 100755 index 00000000..7c86df56 --- /dev/null +++ b/launchers/shim/shim/shim.h @@ -0,0 +1,107 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +/** + * shim - Windows launcher for Splunk modular inputs written in Java. + * + * shim is provided as both 32-bit and 64-bit binaries. If you are setting up a + * modular input written in Java in your app, you should make it into an executable + * jar, and put it in a jars/ directory in your app. The jar should be named the + * with the same name as the modular input kind defined in Splunk. That is, if your + * stanza in README/inputs.conf.spec that defines the modular input kind is called + * 'myinput', then the jar should be in jars/myinput.jar. You can create a UTF-8 encoded + * text file in jars/myinput.vmopts that contains options to pass to java when creating + * the virtual machine (i.e., -Xms512M -agent something.jar). + * + * Then place the 32-bit binary of shim in windows_x86/bin/myinput.exe and the 64-bit + * binary in windows_x86_64/bin/myinput.exe (changing 'myinput' to the name of your modular + * input kind). Splunk will launch them and they in turn will look for the jar, + * launch it, and handle all the control signals from Splunk. + * + * Once shim starts and executes the JVM, it waits for Ctrl+C from Splunk or for splunkd + * to die. If either of these events occurs, it sends Ctrl+C to the JVM, waits for it + * to exit, and exits itself. If the JVM exits, the shim exits immediately thereafter. + */ + + +#ifndef __SHIM_H__ +#define __SHIM_H__ + +#include + +/** + * Returns a HANDLE referring to splunkd's process, or NULL if it could + * not find such a handle. Use GetLastError to find the error in that case. + * + * When splunkd starts a modular input script, it sets its pid as the value of + * an environment variable SPLUNKD_PROCESSID. + */ +HANDLE getSplunkdHandle(); + + +/** + * Return a PTSTR with the path to the Java jar, or NULL if no path could be constructed. + * + * The jar is taken to be at ../../jars/{name}.jar from the location of the current executable, + * if the name of the current executable is {name}.exe. + */ +PTSTR getPathToJar(); + + +/** + * Returns the contents of a file with the same base name as the Jar referred to in jarPath, + * but with the suffix .vmopts (so for path\to\myinput.jar, reads path\to\myinputs.vmptops). + * + * This function is meant to read the options for the JVM (i.e., -Xms512M) so they can be + * added to the command line. If there is an error that prevents reading the file (the jar path + * does not end in .jar, or it cannot be read), readJvmOptions returns NULL and sets an error + * code retrievable with GetLastError. If the file does not exist, readJvmOptions returns an + * empty string. + */ +PTSTR readJvmOptions(PTSTR pathToJar); + +/** + * get the customized java command + */ +PTSTR getCustomizedJavaCmd(); + +/** + * Construct the full command to run the jar. This will return a new buffer containing + * + * java [jvmOptions] -jar "[jarPath]" [argv[0]] [argv[1]] ... + */ +PTSTR assembleJvmCommand(PTSTR customizedJavaCmd, PTSTR pathToJar, PTSTR jvmOptions, int argc, _TCHAR* argv[]); + + +/** + * Print an error message to stderr containing the human readable error message + * corresponding to the GetLastError's return value. + */ +void printErrorMessage(DWORD errorCode, ...); + + +/** + * A PHANDLER_ROUTINE to handle receiving console control events such as + * Ctrl+C. Upon receiving a console control event, it sends the same event + * to the JVM (which it finds via the PID stored in the global jvmPid + * variable). + * + * The handler does not further shutdown, since as soon as the JVM dies, + * the standard logic in _tmain will handle exiting this program as well. + */ +BOOL killJvm(DWORD interruptCode); + +#endif \ No newline at end of file diff --git a/launchers/shim/shim/shim.vcxproj b/launchers/shim/shim/shim.vcxproj new file mode 100755 index 00000000..d72fed90 --- /dev/null +++ b/launchers/shim/shim/shim.vcxproj @@ -0,0 +1,167 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {830BB6EA-1A0C-4BFB-BD9B-E36F39ABF21C} + Win32Proj + shim + + + + Application + true + v110 + Unicode + + + Application + true + v110 + Unicode + + + Application + false + v110_xp + true + Unicode + + + Application + false + v110_xp + true + Unicode + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + RequireAdministrator + + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + RequireAdministrator + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + + + + + + + + + + Create + Create + Create + Create + + + + + + \ No newline at end of file diff --git a/launchers/shim/shim/shim.vcxproj.filters b/launchers/shim/shim/shim.vcxproj.filters new file mode 100755 index 00000000..e2e7ae36 --- /dev/null +++ b/launchers/shim/shim/shim.vcxproj.filters @@ -0,0 +1,39 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/launchers/shim/shim/shim.vcxproj.user b/launchers/shim/shim/shim.vcxproj.user new file mode 100755 index 00000000..6fcdb2ce --- /dev/null +++ b/launchers/shim/shim/shim.vcxproj.user @@ -0,0 +1,23 @@ + + + + SPLUNKD_PROCESSID=1416 +$(LocalDebuggerEnvironment) + WindowsLocalDebugger + + + SPLUNKD_PROCESSID=1416$(LocalDebuggerEnvironment) + WindowsLocalDebugger + + + + + --scheme + SPLUNKD_PROCESSID=1416 + WindowsLocalDebugger + + + SPLUNKD_PROCESSID=1416 + WindowsLocalDebugger + + \ No newline at end of file diff --git a/launchers/shim/shim/stdafx.cpp b/launchers/shim/shim/stdafx.cpp new file mode 100755 index 00000000..ccd66401 --- /dev/null +++ b/launchers/shim/shim/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// shim.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/launchers/shim/shim/stdafx.h b/launchers/shim/shim/stdafx.h new file mode 100755 index 00000000..47a0d025 --- /dev/null +++ b/launchers/shim/shim/stdafx.h @@ -0,0 +1,15 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#include +#include + + + +// TODO: reference additional headers your program requires here diff --git a/launchers/shim/shim/targetver.h b/launchers/shim/shim/targetver.h new file mode 100755 index 00000000..90e767bf --- /dev/null +++ b/launchers/shim/shim/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include diff --git a/lib/commons-cli-1.2.jar b/lib/commons-cli-1.2.jar deleted file mode 100644 index ce4b9fff..00000000 Binary files a/lib/commons-cli-1.2.jar and /dev/null differ diff --git a/lib/junit-4.8.1.jar b/lib/junit-4.8.1.jar deleted file mode 100644 index 524cd65c..00000000 Binary files a/lib/junit-4.8.1.jar and /dev/null differ diff --git a/lib/org-openide-actions.jar b/lib/org-openide-actions.jar deleted file mode 100644 index ca83aa26..00000000 Binary files a/lib/org-openide-actions.jar and /dev/null differ diff --git a/lib/org-openide-awt.jar b/lib/org-openide-awt.jar deleted file mode 100644 index 22972b7c..00000000 Binary files a/lib/org-openide-awt.jar and /dev/null differ diff --git a/lib/org-openide-compat.jar b/lib/org-openide-compat.jar deleted file mode 100644 index af1b2740..00000000 Binary files a/lib/org-openide-compat.jar and /dev/null differ diff --git a/lib/org-openide-dialogs.jar b/lib/org-openide-dialogs.jar deleted file mode 100644 index 06dcceb9..00000000 Binary files a/lib/org-openide-dialogs.jar and /dev/null differ diff --git a/lib/org-openide-execution.jar b/lib/org-openide-execution.jar deleted file mode 100644 index 47e7cf92..00000000 Binary files a/lib/org-openide-execution.jar and /dev/null differ diff --git a/lib/org-openide-explorer.jar b/lib/org-openide-explorer.jar deleted file mode 100644 index e15ac8af..00000000 Binary files a/lib/org-openide-explorer.jar and /dev/null differ diff --git a/lib/org-openide-filesystems.jar b/lib/org-openide-filesystems.jar deleted file mode 100644 index 1b1c581e..00000000 Binary files a/lib/org-openide-filesystems.jar and /dev/null differ diff --git a/lib/org-openide-io.jar b/lib/org-openide-io.jar deleted file mode 100644 index 49522467..00000000 Binary files a/lib/org-openide-io.jar and /dev/null differ diff --git a/lib/org-openide-loaders.jar b/lib/org-openide-loaders.jar deleted file mode 100644 index 0b36eb66..00000000 Binary files a/lib/org-openide-loaders.jar and /dev/null differ diff --git a/lib/org-openide-modules.jar b/lib/org-openide-modules.jar deleted file mode 100644 index 6008a329..00000000 Binary files a/lib/org-openide-modules.jar and /dev/null differ diff --git a/lib/org-openide-nodes.jar b/lib/org-openide-nodes.jar deleted file mode 100644 index ec1c9722..00000000 Binary files a/lib/org-openide-nodes.jar and /dev/null differ diff --git a/lib/org-openide-options.jar b/lib/org-openide-options.jar deleted file mode 100644 index 88b2fb30..00000000 Binary files a/lib/org-openide-options.jar and /dev/null differ diff --git a/lib/org-openide-text.jar b/lib/org-openide-text.jar deleted file mode 100644 index 819a9e20..00000000 Binary files a/lib/org-openide-text.jar and /dev/null differ diff --git a/lib/org-openide-util-enumerations.jar b/lib/org-openide-util-enumerations.jar deleted file mode 100644 index 1bd943a3..00000000 Binary files a/lib/org-openide-util-enumerations.jar and /dev/null differ diff --git a/lib/org-openide-util-lookup.jar b/lib/org-openide-util-lookup.jar deleted file mode 100644 index c9a082b2..00000000 Binary files a/lib/org-openide-util-lookup.jar and /dev/null differ diff --git a/lib/org-openide-util.jar b/lib/org-openide-util.jar deleted file mode 100644 index feb7c432..00000000 Binary files a/lib/org-openide-util.jar and /dev/null differ diff --git a/lib/org-openide-windows.jar b/lib/org-openide-windows.jar deleted file mode 100644 index 57c7cf76..00000000 Binary files a/lib/org-openide-windows.jar and /dev/null differ diff --git a/licenses/LICENSE-COMMONS b/licenses/LICENSE-COMMONS new file mode 100644 index 00000000..7a4a3ea2 --- /dev/null +++ b/licenses/LICENSE-COMMONS @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/licenses/LICENSE-GSON b/licenses/LICENSE-GSON new file mode 100644 index 00000000..7a4a3ea2 --- /dev/null +++ b/licenses/LICENSE-GSON @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/licenses/LICENSE-JACOCO b/licenses/LICENSE-JACOCO new file mode 100644 index 00000000..e19f0de1 --- /dev/null +++ b/licenses/LICENSE-JACOCO @@ -0,0 +1,74 @@ +Eclipse Public License - v 2.0 +THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC LICENSE (“AGREEMENT”). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. + +1. DEFINITIONS +“Contribution” means: + +a) in the case of the initial Contributor, the initial content Distributed under this Agreement, and +b) in the case of each subsequent Contributor: +i) changes to the Program, and +ii) additions to the Program; +where such changes and/or additions to the Program originate from and are Distributed by that particular Contributor. A Contribution “originates” from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include changes or additions to the Program that are not Modified Works. +“Contributor” means any person or entity that Distributes the Program. + +“Licensed Patents” mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program. + +“Program” means the Contributions Distributed in accordance with this Agreement. + +“Recipient” means anyone who receives the Program under this Agreement or any Secondary License (as applicable), including Contributors. + +“Derivative Works” shall mean any work, whether in Source Code or other form, that is based on (or derived from) the Program and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. + +“Modified Works” shall mean any work in Source Code or other form that results from an addition to, deletion from, or modification of the contents of the Program, including, for purposes of clarity any new file in Source Code form that contains any contents of the Program. Modified Works shall not include works that contain only declarations, interfaces, types, classes, structures, or files of the Program solely in each case in order to link to, bind by name, or subclass the Program or Modified Works thereof. + +“Distribute” means the acts of a) distributing or b) making available in any manner that enables the transfer of a copy. + +“Source Code” means the form of a Program preferred for making modifications, including but not limited to software source code, documentation source, and configuration files. + +“Secondary License” means either the GNU General Public License, Version 2.0, or any later versions of that license, including any exceptions or additional permissions as identified by the initial Contributor. + +2. GRANT OF RIGHTS +a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, Distribute and sublicense the Contribution of such Contributor, if any, and such Derivative Works. +b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in Source Code or other form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder. +c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to Distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program. +d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement. +e) Notwithstanding the terms of any Secondary License, no Contributor makes additional grants to any Recipient (other than those set forth in this Agreement) as a result of such Recipient's receipt of the Program under the terms of a Secondary License (if permitted under the terms of Section 3). +3. REQUIREMENTS +3.1 If a Contributor Distributes the Program in any form, then: + +a) the Program must also be made available as Source Code, in accordance with section 3.2, and the Contributor must accompany the Program with a statement that the Source Code for the Program is available under this Agreement, and informs Recipients how to obtain it in a reasonable manner on or through a medium customarily used for software exchange; and +b) the Contributor may Distribute the Program under a license different than this Agreement, provided that such license: +i) effectively disclaims on behalf of all other Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose; +ii) effectively excludes on behalf of all other Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits; +iii) does not attempt to limit or alter the recipients' rights in the Source Code under section 3.2; and +iv) requires any subsequent distribution of the Program by any party to be under a license that satisfies the requirements of this section 3. +3.2 When the Program is Distributed as Source Code: + +a) it must be made available under this Agreement, or if the Program (i) is combined with other material in a separate file or files made available under a Secondary License, and (ii) the initial Contributor attached to the Source Code the notice described in Exhibit A of this Agreement, then the Program may be made available under the terms of such Secondary Licenses, and +b) a copy of this Agreement must be included with each copy of the Program. +3.3 Contributors may not remove or alter any copyright, patent, trademark, attribution notices, disclaimers of warranty, or limitations of liability (‘notices’) contained within the Program from any copy of the Program which they Distribute, provided that Contributors may add their own appropriate notices. + +4. COMMERCIAL DISTRIBUTION +Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor (“Commercial Contributor”) hereby agrees to defend and indemnify every other Contributor (“Indemnified Contributor”) against any losses, damages and costs (collectively “Losses”) arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense. + +For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages. + +5. NO WARRANTY +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations. + +6. DISCLAIMER OF LIABILITY +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +7. GENERAL +If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable. + +If Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed. + +All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive. + +Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse Foundation may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be Distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to Distribute the Program (including its Contributions) under the new version. + +Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved. Nothing in this Agreement is intended to be enforceable by any entity that is not a Contributor or Recipient. No third-party beneficiary rights are created under this Agreement. + +Exhibit A – Form of Secondary Licenses Notice +“This Source Code may also be made available under the following Secondary Licenses when the conditions for such availability set forth in the Eclipse Public License, v. 2.0 are satisfied: {name license(s), version(s), and exceptions or additional permissions here}.” \ No newline at end of file diff --git a/licenses/LICENSE-JUNIT b/licenses/LICENSE-JUNIT new file mode 100644 index 00000000..3fa00836 --- /dev/null +++ b/licenses/LICENSE-JUNIT @@ -0,0 +1,86 @@ +Eclipse Public License - v 1.0 +THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. + +1. DEFINITIONS + +"Contribution" means: + +a) in the case of the initial Contributor, the initial code and documentation distributed under this Agreement, and + +b) in the case of each subsequent Contributor: + +i) changes to the Program, and + +ii) additions to the Program; + +where such changes and/or additions to the Program originate from and are distributed by that particular Contributor. A Contribution 'originates' from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include additions to the Program which: (i) are separate modules of software distributed in conjunction with the Program under their own license agreement, and (ii) are not derivative works of the Program. + +"Contributor" means any person or entity that distributes the Program. + +"Licensed Patents" mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program. + +"Program" means the Contributions distributed in accordance with this Agreement. + +"Recipient" means anyone who receives the Program under this Agreement, including all Contributors. + +2. GRANT OF RIGHTS + +a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, distribute and sublicense the Contribution of such Contributor, if any, and such derivative works, in source code and object code form. + +b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in source code and object code form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder. + +c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program. + +d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement. + +3. REQUIREMENTS + +A Contributor may choose to distribute the Program in object code form under its own license agreement, provided that: + +a) it complies with the terms and conditions of this Agreement; and + +b) its license agreement: + +i) effectively disclaims on behalf of all Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose; + +ii) effectively excludes on behalf of all Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits; + +iii) states that any provisions which differ from this Agreement are offered by that Contributor alone and not by any other party; and + +iv) states that source code for the Program is available from such Contributor, and informs licensees how to obtain it in a reasonable manner on or through a medium customarily used for software exchange. + +When the Program is made available in source code form: + +a) it must be made available under this Agreement; and + +b) a copy of this Agreement must be included with each copy of the Program. + +Contributors may not remove or alter any copyright notices contained within the Program. + +Each Contributor must identify itself as the originator of its Contribution, if any, in a manner that reasonably allows subsequent Recipients to identify the originator of the Contribution. + +4. COMMERCIAL DISTRIBUTION + +Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense. + +For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages. + +5. NO WARRANTY + +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement , including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations. + +6. DISCLAIMER OF LIABILITY + +EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +7. GENERAL + +If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable. + +If Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed. + +All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive. + +Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse Foundation may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to distribute the Program (including its Contributions) under the new version. Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved. + +This Agreement is governed by the laws of the State of New York and the intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation. \ No newline at end of file diff --git a/licenses/LICENSE-NETBEANS b/licenses/LICENSE-NETBEANS new file mode 100644 index 00000000..4c9ad980 --- /dev/null +++ b/licenses/LICENSE-NETBEANS @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/licenses/LICENSE-OPENCSV b/licenses/LICENSE-OPENCSV new file mode 100644 index 00000000..8ca90d00 --- /dev/null +++ b/licenses/LICENSE-OPENCSV @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/pom.xml b/pom.xml new file mode 100644 index 00000000..37ef9e19 --- /dev/null +++ b/pom.xml @@ -0,0 +1,91 @@ + + + 4.0.0 + + + 1.9.5 + true + UTF-8 + 8 + 8 + + + com.splunk + splunk-sdk-java + 1.0.1 + pom + Splunk SDK for Java + https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java + + + + com.google.code.gson + gson + 2.8.9 + + + net.sf.opencsv + opencsv + 2.3 + + + + splunk + examples + + + + package + + + org.apache.maven.plugins + maven-compiler-plugin + 3.8.1 + + ${maven.compiler.source} + ${maven.compiler.target} + + + + org.apache.maven.plugins + maven-deploy-plugin + 3.0.0-M1 + + false + + + + + + + + splunk-artifactory + Splunk Releases + https://splunk.jfrog.io/splunk/ext-releases-local + + + + + + splunk-artifactory + Splunk Releases + https://splunk.jfrog.io/splunk/ext-releases-local + + + + + + The Apache Software License, Version 2.0 + http://www.apache.org/licenses/LICENSE-2.0.txt + repo + + + + + Splunk, Inc. + http://dev.splunk.com + + diff --git a/results.json b/results.json new file mode 100644 index 00000000..bae99b06 --- /dev/null +++ b/results.json @@ -0,0 +1,2 @@ + +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0/etc\""}],"fields":["_bkt","_cd","_indextime","_raw","_serial","_si","_sourcetype","_subsecond","_time","host","index","linecount","source","sourcetype","splunk_server"],"rows":[["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25618","1351880441","127.0.0.1 - - [02/Nov/2012:11:20:40.353 -0700] \"POST /services/search/jobs HTTP/1.1\" 400 191 - - - 1ms","0",["fross-mbp15.local","_internal"],"splunkd_access",".353","2012-11-02T11:20:40.353-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/splunkd_access.log","splunkd_access","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25610","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00","1",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25605","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=tpool, name=indexertpool, qsize=0, workers=6, qwork_units=0","2",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25600","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=tpool, name=bundlereplthreadpool, qsize=0, workers=0, qwork_units=0","3",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25595","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=tpool, name=batchreadertpool, qsize=0, workers=1, qwork_units=0","4",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25578","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=subtask_seconds, task=indexer_service, replicate_semislice=0.000000, sync_hotBkt=0.000000, throttle_optimize=0.000765, flushBlockSig=0.000000, retryMove_1hotBkt=0.000000, size_hotBkt=0.000000, roll_hotBkt=0.000000, chillOrFreeze=0.000000, update_checksums=0.000000, fork_recovermetadata=0.000000, rebuild_metadata=0.000000, update_bktManifest=0.000000, service_volumes=0.000030, service_maxSizes=0.000015, service_externProc=0.000015","5",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25572","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0","6",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25567","1351880437","11-02-2012 11:20:37.093 -0700 INFO Metrics - group=realtime_search_data, system total, drop_count=0","7",["fross-mbp15.local","_internal"],"splunkd",".093","2012-11-02T11:20:37.093-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25560","1351880437","11-02-2012 11:20:37.092 -0700 INFO Metrics - group=queue, name=udpin, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0","8",["fross-mbp15.local","_internal"],"splunkd",".092","2012-11-02T11:20:37.092-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"],["_internal~31~02DF1FF2-4F8D-4766-BCCD-4859C4AB3380","31:25553","1351880437","11-02-2012 11:20:37.092 -0700 INFO Metrics - group=queue, name=typingqueue, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=48, smallest_size=0","9",["fross-mbp15.local","_internal"],"splunkd",".092","2012-11-02T11:20:37.092-07:00","fross-mbp15.local","_internal","1","/Users/fross/splunks/splunk-5.0/var/log/splunk/metrics.log","splunkd","fross-mbp15.local"]]} \ No newline at end of file diff --git a/run b/run index 1cd6c370..8d30444d 100755 --- a/run +++ b/run @@ -1,29 +1,28 @@ -#!/usr/bin/env python -# -# Copyright 2011 Splunk, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"): you may -# not use this file except in compliance with the License. You may obtain -# a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT -# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the -# License for the specific language governing permissions and limitations -# under the License. - -"""Helper script for running Java SDK examples.""" - -from subprocess import Popen -import sys - -if len(sys.argv) == 1: sys.exit(0) -cmdline = "java -jar dist/examples/%s.jar" % sys.argv[1] -cmdline = cmdline.split() -cmdline.extend(sys.argv[2:]) -process = Popen(cmdline, env={}) -process.communicate() -process.wait() - +#!/usr/bin/env python +# +# Copyright 2011 Splunk, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"): you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +"""Helper script for running Java SDK examples.""" + +from subprocess import Popen +import sys + +if len(sys.argv) == 1: sys.exit(0) +cmdline = "java -jar dist/examples/%s.jar" % sys.argv[1] +cmdline = cmdline.split() +cmdline.extend(sys.argv[2:]) +process = Popen(cmdline, env={}) +process.communicate() +sys.exit(process.wait()) diff --git a/scripts/test_specific.sh b/scripts/test_specific.sh new file mode 100644 index 00000000..34aac979 --- /dev/null +++ b/scripts/test_specific.sh @@ -0,0 +1,2 @@ +echo "To run a specific test:" +echo " mvn test -Dtest=[testclass]" diff --git a/splunk-sdk/.classpath b/splunk-sdk/.classpath deleted file mode 100644 index ae7c037d..00000000 --- a/splunk-sdk/.classpath +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - diff --git a/splunk-sdk/.project b/splunk-sdk/.project deleted file mode 100644 index 50a50ef4..00000000 --- a/splunk-sdk/.project +++ /dev/null @@ -1,17 +0,0 @@ - - - Splunk SDK Internal - - - - - - org.eclipse.jdt.core.javabuilder - - - - - - org.eclipse.jdt.core.javanature - - diff --git a/splunk-sdk/splunk-sdk.iml b/splunk-sdk/splunk-sdk.iml deleted file mode 100644 index ed5b37d9..00000000 --- a/splunk-sdk/splunk-sdk.iml +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - diff --git a/splunk/com/splunk/Application.java b/splunk/com/splunk/Application.java deleted file mode 100644 index 92d318d0..00000000 --- a/splunk/com/splunk/Application.java +++ /dev/null @@ -1,152 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk application, commonly referred to as an 'app'. - */ -public class Application extends Entity { - - /** - * Class constructor. - * - * @param service The connected service instance. - * @param path The application endpoint. - */ - Application(Service service, String path) { - super(service, path); - } - - /** - * Returns the app's author name, or null if not specified. If a splunkbase - * app, this should be the username of the splunk.com account. For internal - * apps, this should be full contact info. - * - * @return Splunk author's name string. - */ - public String getAuthor() { - return getString("author", null); - } - - /** - * Returns whether or not Splunk checks splunkbase for updates. - * - * @return Whether or not Splunk checks splunkbase for updates. - */ - public boolean getCheckForUpdates() { - return getBoolean("check_for_updates", false); - } - - /** - * Returns the description string which is a short explanatory note that - * is displayed underneath the app's title in Launcher, or null if not - * specified. - * - * @return The description string. - */ - public String getDescription() { - return getString("description", null); - } - - /** - * Returns the label string of the app which shows in the Splunk GUI or - * Launcher, or null if not specified. - * - * @return The label string. - */ - public String getLabel() { - return getString("label", null); - } - - /** - * Returns the version string of the app, or null if not specified. - * - * @return The version string of the app. - */ - public String getVersion() { - return getString("version", null); - } - - /** - * Returns an indication if the app's custom setup has been - * performed. This field is only available in Splunk's version 4.2.4+. - * - * @return Indicates if the app's custom setup has been performed. - */ - public boolean isConfigured() { - return getBoolean("configured", false); - } - - /** - * Returns whether or not the app can be managed by Splunk Manager. - * - * @return Indicates if the app can be managed by Splunk Manager or not. - */ - public boolean isManageable() { - return getBoolean("manageable", false); - } - - /** - * Returns whether or not an app is visible and navigable from the Splunk - * GUI. - * - * @return Indicates if the app is visible and navigable from the Splunk - * GUI. - */ - public boolean isVisible() { - return getBoolean("visible", false); - } - - /** - * Indicates whether ot not an app state change requires the app to be - * restarted. - * - * @return Indicates if the app needs to be restarted. - */ - public boolean stateChangeRequiresRestart() { - return getBoolean("state_change_requires_restart", false); - } - - /** - * Archives the appliction into a .spl file on the server's file system. - * The return object contains location specific information. - * - * @return Archival information of the app. - */ - public ApplicationArchive archive() { - return new ApplicationArchive(service, path); - } - - /** - * Returns the the app's setup information. - * - * @return Returns the app's setup information. - */ - public ApplicationSetup setup() { - return new ApplicationSetup(service, path); - } - - /** - * Returns update information of the app. - * - * @return Returns update information for the app. - */ - public ApplicationUpdate update() { - return new ApplicationUpdate(service, path); - } -} - diff --git a/splunk/com/splunk/AtomEntry.java b/splunk/com/splunk/AtomEntry.java deleted file mode 100644 index aa74fb8a..00000000 --- a/splunk/com/splunk/AtomEntry.java +++ /dev/null @@ -1,230 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.util.ArrayList; -import java.util.List; -import org.w3c.dom.Element; -import org.w3c.dom.Node; - -/** - * Representation of an Atom entry element. - */ -public class AtomEntry extends AtomObject { - /** The value of the Atom entry's {@code published} element. */ - public String published; - - /** The value of the Atom entry's {@code content} element. */ - public Record content; - - /** - * Creates a new AtomEntry instance. - * - * @return A new AtomEntry instance. –– - */ - static AtomEntry create() { - return new AtomEntry(); - } - - /** - * Creates a new {@code AtomEntry} instanced based on the given stream. - * There are a few endpoints, such as {@code search/jobs/{sid}}, that - * return an Atom entry element as the root of the response. - * - * @param input The input stream. - * @return An {@code AtomEntry} instance representing the parsed stream. - */ - public static AtomEntry parse(InputStream input) { - Element root = Xml.parse(input).getDocumentElement(); - String rname = root.getTagName(); - String xmlns = root.getAttribute("xmlns"); - if (!rname.equals("entry") || - !xmlns.equals("http://www.w3.org/2005/Atom")) - throw new RuntimeException("Unrecognized format"); - return AtomEntry.parse(root); - } - - /** - * Create a new {@code AtomEntry} instance based on the given XML element. - * - * @param element The XML element. - * @return An {@code AtomEntry} instance representing the parsed element. - */ - static AtomEntry parse(Element element) { - AtomEntry entry = AtomEntry.create(); - entry.load(element); - return entry; - } - - /** - * Initialize the current instance from the given XML element. - * - * @param element The XML element. - */ - @Override void init(Element element) { - String name = element.getTagName(); - if (name.equals("published")) { - this.published = element.getTextContent().trim(); - } - else if (name.equals("content")) { - this.content = parseContent(element); - } - else { - super.init(element); - } - } - - /** - * Returns a filtered list of child XML element nodes. This is a helper - * function that makes it a little easier to get only the element children - * of an XML element. - * - * @param element The XML element to return child nodes for. - * @return A list of child element nodes. - */ - static ArrayList getChildElements(Element element) { - ArrayList result = new ArrayList(); - for (Node child = element.getFirstChild(); - child != null; - child = child.getNextSibling()) - if (child.getNodeType() == Node.ELEMENT_NODE) - result.add((Element)child); - return result; - } - - /** - * Parse the {@code } element of an Atom entry. - * - * @param element The XML element to parse. - * @return A record object containing the parsed values. - */ - Record parseContent(Element element) { - assert(element.getTagName().equals("content")); - - Record content = null; - - List children = getChildElements(element); - - int count = children.size(); - - // Expect content to be empty or a single } content element and return a Record object - * containing the parsed values. - * - * @param element The dict element to parse. - * @return A record object containing the parsed values. - */ - Record parseDict(Element element) { - assert(element.getTagName().equals("s:dict")); - - if (!element.hasChildNodes()) return null; - - List children = getChildElements(element); - - int count = children.size(); - if (count == 0) return null; - - Record result = new Record(); - for (Element child : children) { - assert(child.getTagName().equals("s:key")); - String key = child.getAttribute("name"); - Object value = parseValue(child); - if (value != null) result.put(key, value); - } - return result; - } - - /** - * Parse a {@code } element and return a List object containing the parsed - * values. - * - * @param element The list element to parse. - * @return A list object containing the parsed values. - */ - List parseList(Element element) { - assert(element.getTagName().equals("s:list")); - - if (!element.hasChildNodes()) return null; - - List children = getChildElements(element); - - int count = children.size(); - if (count == 0) return null; - - List result = new ArrayList(count); - for (Element child : children) { - assert(child.getTagName().equals("s:item")); - Object value = parseValue(child); - if (value != null) result.add(value); - } - return result; - } - - /** - * Parse the value content of a dict/key or a list/item element. The value - * is either text, a {@code } or a {@code }} element. - * - * @param element The XML element containing the values to parse. - * @return An object containing the parsed values. The object is a - * {@code String} if the source was a text value, it is a - * {@code Record} object if the source was a {@code } element - * and it is a {@code List} object if the source was a - * element. - */ - Object parseValue(Element element) { - String name = element.getTagName(); - - assert(name.equals("s:key") || name.equals("s:item")); - - if (!element.hasChildNodes()) return null; - - List children = getChildElements(element); - - int count = children.size(); - - // If no element children, then it must be a text value - if (count == 0) return element.getTextContent(); - - // If its not a text value, then expect a single child element. - assert(children.size() == 1); - - Element child = children.get(0); - - name = child.getTagName(); - - if (name.equals("s:dict")) - return parseDict(child); - - if (name.equals("s:list")) - return parseList(child); - - assert(false); // Unreached - return null; - } -} diff --git a/splunk/com/splunk/AtomFeed.java b/splunk/com/splunk/AtomFeed.java deleted file mode 100644 index 192412f2..00000000 --- a/splunk/com/splunk/AtomFeed.java +++ /dev/null @@ -1,104 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.util.ArrayList; -import org.w3c.dom.Element; - -/** - * Representation of an Atom feed. - */ -public class AtomFeed extends AtomObject { - /** The list of Atom entries contained by this Atom feed. */ - public ArrayList entries = new ArrayList(); - - /** The value of the Atom feed's {@code itemsPerPage} element. */ - public String itemsPerPage = null; - - /** The value of the Atom feed's {@code startIndex} element. */ - public String startIndex = null; - - /** The value of the Atom feed's {@code totalResults} element. */ - public String totalResults = null; - - /** - * Creates a new AtomFeed instance. - * - * @return A new AtomFeed instance. - */ - static AtomFeed create() { - return new AtomFeed(); - } - - /** - * Creates a new AtomFeed instance based on the given stream. - * - * @param input The input stream. - * @return An {@code AtomFeed} instance representing the parsed stream. - */ - public static AtomFeed parse(InputStream input) { - Element root = Xml.parse(input).getDocumentElement(); - String rname = root.getTagName(); - String xmlns = root.getAttribute("xmlns"); - if (!rname.equals("feed") || - !xmlns.equals("http://www.w3.org/2005/Atom")) - throw new RuntimeException("Unrecognized format"); - return AtomFeed.parse(root); - } - - /** - * Create a new {@code AtomFeed} instance based on the given XML element. - * - * @param element The XML element. - * @return An {@code AtomFeed} instance representing the parsed element. - */ - static AtomFeed parse(Element element) { - AtomFeed feed = AtomFeed.create(); - feed.load(element); - return feed; - } - - /** - * Initialize the current instance from the given XML element. - * - * @param element The XML element. - */ - @Override void init(Element element) { - String name = element.getTagName(); - if (name.equals("entry")) { - AtomEntry entry = AtomEntry.parse(element); - this.entries.add(entry); - } - else if (name.equals("s:messages")) { - // Ignore - } - else if (name.equals("opensearch:totalResults")) { - this.totalResults = element.getTextContent().trim(); - } - else if (name.equals("opensearch:itemsPerPage")) { - this.itemsPerPage = element.getTextContent().trim(); - } - else if (name.equals("opensearch:startIndex")) { - this.startIndex = element.getTextContent().trim(); - } - else { - super.init(element); - } - } -} - diff --git a/splunk/com/splunk/AtomObject.java b/splunk/com/splunk/AtomObject.java deleted file mode 100644 index 3cb2875a..00000000 --- a/splunk/com/splunk/AtomObject.java +++ /dev/null @@ -1,87 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.HashMap; -import java.util.Map; -import org.w3c.dom.Element; -import org.w3c.dom.Node; - -/** - * Representation of a generic Atom object. This is a common base class shared - * by {@code AtomFeed} and {@code AtomEntry} - */ -public class AtomObject { - /** The value of the Atom {@code id} element. */ - public String id; - - /** The value of any {@code link} elements contains by this Atom object. */ - public Map links = new HashMap(); - - /** The value of the Atom {@code title} element. */ - public String title; - - /** The value of the Atom {@code updated} element. */ - public String updated; - - /** - * Initialize a property of the current instance based on the given XML - * element. - * - * @param element The XML element. - */ - void init(Element element) { - String name = element.getTagName(); - if (name.equals("id")) { - this.id = element.getTextContent().trim(); - } - else if (name.equals("link")) { - String rel = element.getAttribute("rel"); - String href = element.getAttribute("href"); - this.links.put(rel, href); - } - else if (name.equals("title")) { - this.title = element.getTextContent().trim(); - } - else if (name.equals("updated")) { - this.updated = element.getTextContent().trim(); - } - else if (name.equals("author") || name.equals("generator")) { - // Ignore - } - else { - // Ignore - } - } - - /** - * Initialize the current instance from the given XML element by calling - * {@code init} on each child of the XML element. - * - * @param element The XML element. - */ - void load(Element element) { - for (Node child = element.getFirstChild(); - child != null; - child = child.getNextSibling()) - { - if (child.getNodeType() != Node.ELEMENT_NODE) - continue; - init((Element)child); - } - } -} diff --git a/splunk/com/splunk/DeploymentClient.java b/splunk/com/splunk/DeploymentClient.java deleted file mode 100644 index 58ec33d2..00000000 --- a/splunk/com/splunk/DeploymentClient.java +++ /dev/null @@ -1,96 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of the Splunk deployment client - */ -public class DeploymentClient extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - */ - DeploymentClient(Service service) { - super(service, "deployment/client"); - } - - /** - * Returns the action path. - * - * @param action The requested action. - * @return The action path. - */ - @Override protected String actionPath(String action) { - if (action.equals("edit")) - return path + "/deployment-client"; - return super.actionPath(action); - } - - /** - * Disables the deployment client. - */ - @Override public void disable() { - /* - * disable is not handled through the standard enable/disable action - * paths; rather it is an edit (i.e. update) action path. - */ - Args args = new Args("disabled", true); - update(args); - } - - /** - * Enables the deployment client. - */ - @Override public void enable() { - /* - * enable is not handled through the standard enable/disable action - * path; rather it is an edit (i.e. update) action path. - */ - Args args = new Args("disabled", false); - update(args); - } - - /** - * Returns the list of server classes, or null if not specified. - * - * @return The list of server clasess. - */ - public String [] getServerClasses() { - return getStringArray("serverClasses", null); - } - - /** - * Returns the target URI of the deployment server for this deployment - * client, or null if not specified. The format returned is server:port. - * - * @return The target URI for the deployment server. - */ - public String getTargetUri() { - return getString("targetUri", null); - } - - /** - * Reload the deployment client fom the conf file. - */ - public void reload() { - service.get(path + "/deployment-client/Reload"); - invalidate(); - } -} - diff --git a/splunk/com/splunk/DeploymentServer.java b/splunk/com/splunk/DeploymentServer.java deleted file mode 100644 index bfd7af80..00000000 --- a/splunk/com/splunk/DeploymentServer.java +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk deployment server - */ -public class DeploymentServer extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The deployment server endpoint. - */ - DeploymentServer(Service service, String path) { - super(service, path); - } - - /** - * Returns whether or not this deployment server reviews its configuration - * information and informs the deployment client if something is new or - * updated. - * - * @return Whether this deployment server notifies the deployment client for - * new or changed configurations. - */ - public boolean getCheckNew() { - return getBoolean("check-new", false); - } - - /** - * Returns inclusive criteria for determining deployment client access to - * this deployment server. - * - * @return Criteria for determining deployment client access to this - * deployment server. - */ - public String getWhiteList0() { - return getString("whitelist.0"); - } -} diff --git a/splunk/com/splunk/DeploymentServerClass.java b/splunk/com/splunk/DeploymentServerClass.java deleted file mode 100644 index 9ce8b679..00000000 --- a/splunk/com/splunk/DeploymentServerClass.java +++ /dev/null @@ -1,135 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk deployment server class. - */ -public class DeploymentServerClass extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The deployment server class endpoint. - */ - DeploymentServerClass(Service service, String path) { - super(service, path); - } - - /** - * Returns a comma separated list of hosts excluded from this server class, - * or null if not specified. - * - * @return A comma separated list of hosts excluded from this server class. - */ - public String getBlackList() { - return getString("blacklist", null); - } - - /** - * Return excluded client address by index, or null if not specified. - * - * @return Excluded client address by index. - */ - public String getBlackListByIndex(int index) { - return getString(String.format("blacklist.%d", index), null); - } - - /** - * Returns whether lookups halt on first server match (false) or continues - * to match against multiple servers (true). - * - * @return whether server matches first or multiple servers. - */ - public boolean getContinueMatching() { - return getBoolean("continueMatching"); - } - - /** - * Returns the URL endpoint for deployment client content downloads, or null - * if not specified. - * - * @return URL endpoint for deployment client downloads. - */ - public String getEndpoint() { - return getString("endpoint", null); - } - - /** - * Returns the filter type applied first. If filterType is whitelist, all - * whitelist filters are applied first, followed by blacklist filters. If - * filterType is blacklist, all blacklist filters are applied first, - * followed by whitelist filters. - * - * @return Filter type. - */ - public String getFilterType() { - return getString("filterType"); - } - - /** - * Returns the deployment server content storage file path. Note that the - * path may contain macro expansions or substitutions. - * - * @return The deployment server content storage file path. - */ - public String getRepositoryLocation() { - return getString("repositoryLocation"); - } - - /** - * Returns the deployment client content storage file path, or null if not - * specified. Note that the path may contain macro expansions or - * substitutions. - * - * @return The deployment client content storage file path. - */ - public String getTargetRepositoryLocation() { - return getString("targetRepositoryLocation", null); - } - - /** - * Returns the deployment server's working file path, or null if not - * specified. Note that the path may contain macro expansions or - * substitutions. - * - * @return the deployment server's working file path. - */ - public String getTmpFolder() { - return getString("tmpFolder", null); - } - - /** - * Returns a comma separated list of hosts included for this server class, - * or null if not specified. - * - * @return A comma separated list of hosts included for this server class. - */ - public String getWhiteList() { - return getString("whitelist", null); - } - - /** - * Return included client address by index, or null if not specified. - * - * @return Included client address by index. - */ - public String getWhiteListByIndex(int index) { - return getString(String.format("whitelist.%d", index), null); - } -} diff --git a/splunk/com/splunk/DistributedConfiguration.java b/splunk/com/splunk/DistributedConfiguration.java deleted file mode 100644 index ffe0a65d..00000000 --- a/splunk/com/splunk/DistributedConfiguration.java +++ /dev/null @@ -1,222 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk distributed search configuration. - */ -public class DistributedConfiguration extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - */ - DistributedConfiguration(Service service) { - super(service, "search/distributed/config"); - } - - /** - * Returns the action path. - * - * @param action The requested action. - * @return The action path. - */ - @Override protected String actionPath(String action) { - if (action.equals("edit")) - return path + "/distributedSearch"; - return super.actionPath(action); - } - - /** - * Returns whether Splunk automatically discovers other servers. - * - * @return whether Splunk automatically discovers other servers. - */ - public boolean getAutoAddServers() { - return getBoolean("autoAddServers"); - } - - /** - * Returns a comma separated list of server names that are excluded from - * being peers, or null if not available. - * - * @return servers, by name, that are excluded from being peers. - */ - public String getBlacklistNames() { - return getString("blacklistNames", null); - } - - /** - * Returns a comma separated list of server URLs that are excluded from - * being peers. URLs are in the form x.x.x.x:port, or null if not available. - * - * @return servers, by URL, that are excluded from being peers. - */ - public String getBlacklistUrls() { - return getString("blacklistURLs", null); - } - - /** - * Return connection timeout in seconds, or -1 if not specified. - * - * @return The connection timeout in seconds. - */ - public int getConnectionTimeout() { - return getInteger("connectionTimeout", -1); - } - - /** - * Returns the number of seconds between checking servers that are already - * timed-out. Zero means do not recheck. The default is sixty seconds. If - * removeTimedOutServers is false the setting has no effect. - * - * @return The number of seconds to check timed-out servers. - */ - public int getCheckTimedOutServersFrequency() { - return getInteger("checkTimedOutServersFrequency"); - } - - /** - * Returns the number of seconds between checking on other servers health. - * If set to zero, heartbeat checks are disabled. - * - * @return The number of seconds between checking on other servers health. - */ - public int getHeartbeatFrequency() { - return getInteger("heartbeatFrequency"); - } - - /** - * Returns the multi-cast address to discover other servers and receive - * heartbeats, or null if not available. - * - * @return The multi-cast address for discovery and heartbeat messages. - */ - public String getHeartbeatMcastAddress() { - return getString("heartbeatMcastAddr", null); - } - - /** - * Returns the port used for heartbeat messages. - * - * @return The heatbeat port. - */ - public int getHeartbeatPort() { - return getInteger("heartbeatPort"); - } - - /** - * Returns receive timeout in seconds, or -1 if not specified. - * - * @return The receive timeout in seconds. - */ - public int getReceiveTimeout() { - return getInteger("receiveTimeout", -1); - } - - /** - * Returns whether or not timed out servers are removed from the distributed - * configuration. - * - * @return whether ot not timed out servers are removed from the distributed - * configuration. - */ - public boolean getRemovedTimedOutServers() { - return getBoolean("removedTimedOutServers"); - } - /** - * @deprecated Use specific connectionTimeout, receiveTimeout, sendTimeout. - * - * Returns the timeout in seconds, to determine a server timeout. - * - * @return The timeout in seconds, to determine a server timeout. - */ - public int getServerTimeout() { - return getInteger("serverTimeout"); - } - - /** - * Returns send timeout in seconds, or -1 if not specified. - * - * @return The send timeout in seconds. - */ - public int getSendTimeout() { - return getInteger("sendTimeout", -1); - } - - /** - * Returns a comma separated list of peer servers, or null if not available. - * - * @return The list of peer servers. - */ - public String getServers() { - return getString("servers", null); - } - - /** - * Returns whether or not this server uses bundle replication to share - * search time configuration with search peers. Note: if set to false, - * the search head assumes the search peers can access a bundles through - * shared storage (NAS). - * - * @return whether or not this server uses bundle replication. - */ - public boolean getShareBundles() { - return getBoolean("shareBundles"); - } - - /** - * Returns whether or not this server participates in a search. If set to - * true, this server does NOT participate as a server in any search or other - * call. This is used for building a node that does nothing but merge the - * results from other servers. - * - * @return Whether or not this server participates in a search. - */ - public boolean getSkipOurselves() { - return getBoolean("skipOurselves"); - } - - /** - * Returns the number of seconds for connection timeouts when gathering a - * search peer's basic information. - * - * @return The number of seconds for connection timeout. - */ - public int getStatusTimeout() { - return getInteger("statusTimeout"); - } - - /** - * Returns the time-to-live of heartbeat messages. - * - * @return The time-to-live of heartbeat messages. - */ - public int getTtl() { - return getInteger("ttl"); - } - - /** - * Returns whether or not distributed search is enabled. - * - * @return If distributed search is enabled or disabled. - */ - public boolean isDistSearchEnabled() { - return getBoolean("dist_search_enabled"); - } -} diff --git a/splunk/com/splunk/DistributedPeer.java b/splunk/com/splunk/DistributedPeer.java deleted file mode 100644 index 9db13f1e..00000000 --- a/splunk/com/splunk/DistributedPeer.java +++ /dev/null @@ -1,125 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk distributed peer. - */ -public class DistributedPeer extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The deployment server endpoint. - */ - DistributedPeer(Service service, String path) { - super(service, path); - } - - /** - * Returns this peer's build number, or null if not specified. - * - * @return This peer's build number. - */ - public String getBuild() { - return getString("build", null); - } - - /** - * Returns the list of bundle versions, or null if not specified. - * - * @return The list of bundle versions. - */ - public String[] getBundleVersions() { - return getStringArray("bundle_versions", null); - } - - /** - * Returns this peer's GUID, or null if not specified. - * - * @return this peer's GUID. - */ - public String getGuid() { - return getString("guid", null); - } - - /** - * Returns this peer's license signature, or null if not specified. - * - * @return This peer's license signature. - */ - public String getLicenseSignature() { - return getString("licenseSignature", null); - } - - /** - * Returns this peer's name, or null if not specified. - * - * @return Thid peer's name. - */ - public String getPeerName() { - return getString("peerName", null); - } - - /** - * Returns this peer's type, or null if not specified. - * - * @return This peer's type. - */ - public String getPeerType() { - return getString("peerType", null); - } - - /** - * Returns this peer's replication status, or null if not specified. - * - * @return This peer's replication status. - */ - public String getReplicationStatus() { - return getString("replicationStatus", null); - } - - /** - * Return this peer's overall status, or null if not specified. - * - * @return This peer's overall status. - */ - public String getStatus() { - return getString("status", null); - } - - /** - * Returns this peer's version, or null if not specified. - * - * @return This peer's version. - */ - public String getVersion() { - return getString("version", null); - } - - /** - * Returns whether or not this peer is using HTTPS, or null if not - * specified. - * - * @return whether or not this peer is using HTTPS. - */ - public boolean isHttps() { - return getBoolean("is_https", true); - } -} - diff --git a/splunk/com/splunk/EntityCollection.java b/splunk/com/splunk/EntityCollection.java deleted file mode 100644 index 167e0f10..00000000 --- a/splunk/com/splunk/EntityCollection.java +++ /dev/null @@ -1,88 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a collection of entities. - * - * @param The type of members of the collection. - */ -public class EntityCollection extends ResourceCollection { - - /** - * Class constructor. - * - * @param service The connected service instance. - * @param path The entity's endpoint. - */ - EntityCollection(Service service, String path) { - super(service, path, Entity.class); - } - - /** - * Class constructor. - * - * @param service The connected service instance. - * @param path The entity's endpoint. - * @param itemClass The entity's subclass. - */ - public EntityCollection(Service service, String path, Class itemClass) { - super(service, path, itemClass); - } - - /** - * Creates an entity in this collection. - * - * @param name The name of the entity created. - * @return The entity. - */ - public T create(String name) { - return create(name, null); - } - - /** - * Creates an entity in this collection. - * - * @param name The name of the entity created. - * @param args The arguments supplied to the creation. - * @return The entity. - */ - public T create(String name, Map args) { - args = Args.create(args).add("name", name); - service.post(path, args); - invalidate(); - return get(name); - } - - /** - * Removes an entity from this collection. - * - * @param key the name of the entity to remove. - * @return this collection. - */ - public T remove(Object key) { - validate(); - if (!containsKey(key)) return null; - T entity = items.get(key); - entity.remove(); - items.remove(key); - invalidate(); - return entity; - } -} diff --git a/splunk/com/splunk/EventType.java b/splunk/com/splunk/EventType.java deleted file mode 100644 index ce235da7..00000000 --- a/splunk/com/splunk/EventType.java +++ /dev/null @@ -1,74 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of an event type. - */ -public class EventType extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The event type endpoint. - */ - EventType(Service service, String path) { - super(service, path); - } - - /** - * Returns the description of this event type. - * - * @return The description of this event type. - */ - public String getDescription() { - return getString("description", null); - } - - /** - * Returns the priority of this event type. The range is 1 to 10, with 1 - * beging the highest priority. - * - * @return The priority of this event type. - */ - public int getPriority() { - return getInteger("priority", -1); - } - - /** - * Returns this event type's search terms. - * - * @return This event types' search terms. - */ - public String getSearch() { - return getString("search", null); - } - - /** - * @deprecated Use tags.conf.spec file to assign tags to groups of events - * with related field values. - * - * Returns this event types list of tags. - * - * @return This event types list of tags. - */ - public String [] getTags() { - return getStringArray("tags", null); - } -} - diff --git a/splunk/com/splunk/FiredAlert.java b/splunk/com/splunk/FiredAlert.java deleted file mode 100644 index ea1be0a9..00000000 --- a/splunk/com/splunk/FiredAlert.java +++ /dev/null @@ -1,129 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Date; - -/** - * Representation of a fired alert. - */ -public class FiredAlert extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The fired alert endpoint. - */ - FiredAlert(Service service, String path) { - super(service, path); - } - - /** - * Returns this alert's actions, or null if not available. - * - * @return This alert's actions. - */ - public String getAction() { - return getString("actions", null); - } - - /** - * Returns this alert's type, or null if not available. - * - * @return This alert's type. - */ - public String getAlertType() { - return getString("alert_type", null); - } - - /** - * Returns this alerts's rendered expiration time, or null if not available. - * (4.3+) - * - * @return This alert's rendered expiration time. - */ - public String getExpirationTime() { - return getString("expiration_time_rendered", null); - } - - /** - * Returns this alert's saved search name, or null if not available. - * - * @return this alert's saved search name. - */ - public String getSavedSearchName() { - return getString("savedsearch_name", null); - } - - /** - * Returns this alert's severity, on a scale of 1 to 10, with 1 being the - * highest priority. -1 if value not specified. - * - * @return This alert's severity. - */ - public int getSeverity() { - return getInteger("severity", -1); - } - - /** - * Returns this alert's SID, or null if not available. - * - * @return This alerts SID. - */ - public String getSid() { - return getString("sid", null); - } - - /** - * Returns the number of triggered alerts, or -1 if not specified (4.3+) - * - * @return The number of triggered alerts. - */ - public int getTriggeredAlertCount() { - return getInteger("triggered_alerts", -1); - } - - /** - * Returns this alert's trigger time, or null if not available. - * - * @return This alert's trigger time. - */ - public Date getTriggerTime() { - return getDateFromEpoch("trigger_time", null); - } - - /** - * Returns this alert's rendered trigger time, or null if not available. - * (4.3+) - * - * @return This alert's rendered trigger time. - */ - public String getTriggerTimeRendered() { - return getString("trigger_time_rendered", null); - } - - /** - * Returned whether or not the result is a digest, or false if not - * specified (4.3+) - * - * @return whether ot nor the result is a digest. - */ - public boolean isDigestMode() { - return getBoolean("digest_mode", false); - } -} diff --git a/splunk/com/splunk/HttpService.java b/splunk/com/splunk/HttpService.java deleted file mode 100644 index 00ec208b..00000000 --- a/splunk/com/splunk/HttpService.java +++ /dev/null @@ -1,390 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.io.OutputStreamWriter; -import java.util.HashMap; -import java.util.Map; -import java.util.Map.Entry; -import java.net.HttpURLConnection; -import java.net.MalformedURLException; -import java.net.ProtocolException; -import java.net.URL; -import java.net.Socket; -import java.security.cert.X509Certificate; -import javax.net.ssl.HttpsURLConnection; -import javax.net.ssl.SSLContext; -import javax.net.ssl.SSLSession; -import javax.net.ssl.TrustManager; -import javax.net.ssl.X509TrustManager; -import javax.net.ssl.HostnameVerifier; -import javax.net.ssl.SSLSocketFactory; - -/** - * Representation of a generic HTTP service at a given address (host:port) - * accessed using a given protocol "scheme" ({@code http} or {@code https}). - */ -public class HttpService { - /** The scheme used to access the service. */ - protected String scheme = "https"; - - /** The host name of the service. */ - protected String host = "localhost"; - - /** The port number of the service. */ - protected int port = 8089; - - private String prefix = null; - - static Map defaultHeader = new HashMap() {{ - put("User-Agent", "splunk-sdk-java/0.1"); - put("Accept", "*/*"); - }}; - - TrustManager[] trustAll = new TrustManager[] { - new X509TrustManager() { - public X509Certificate[] getAcceptedIssuers() { return null; } - public void checkClientTrusted( - X509Certificate[] certs, String authType) { } - public void checkServerTrusted( - X509Certificate[] certs, String authType) { } - } - }; - - /** Constructs a new {@code HttpService} instance. */ - public HttpService() { - setTrustPolicy(); - } - - /** - * Constructs a new {@code HttpService} instance at the given host. - * - * @param host Host name of the service. - */ - public HttpService(String host) { - this.host = host; - setTrustPolicy(); - } - - /** - * Constructs a new {@code HttpService} instance at the given host and port. - * - * @param host Host name of the service. - * @param port Port number of the service. - */ - public HttpService(String host, int port) { - this.host = host; - this.port = port; - setTrustPolicy(); - } - - /** - * Constructs a new {@code HttpService} instance using the given host, port - * and scheme. - * - * @param host Host name of the service. - * @param port Port number of the service. - * @param scheme Scheme for accessing the service - * ({@code http} or {@code https}). - */ - public HttpService(String host, int port, String scheme) { - this.host = host; - this.port = port; - this.scheme = scheme; - setTrustPolicy(); - } - - // Returns the count of args in the given map - private static int count(Map args) { - if (args == null) return 0; - return args.size(); - } - - /** - * Issue an HTTP GET request against the service using the given path. - * - * @param path Request path. - * @return HTTP response. - */ - public ResponseMessage get(String path) { - return send(path, new RequestMessage("GET")); - } - - /** - * Issue an HTTP GET request against the service using the given path and - * query arguments. - * - * @param path The request path. - * @param args Query arguments. - * @return HTTP response. - */ - public ResponseMessage get(String path, Map args) { - if (count(args) > 0) - path = path + "?" + Args.encode(args); - RequestMessage request = new RequestMessage("GET"); - return send(path, request); - } - - /** - * Returns the host name of this service. - * - * @return Host name. - */ - public String getHost() { - return this.host; - } - - /** - * Returns the port number of this service. - * - * @return Port number. - */ - public int getPort() { - return this.port; - } - - /** - * Returns the URL prefix of this service, consisting of - * {@code scheme://host[:port]} - * - * @return URL prefix. - */ - public String getPrefix() { - if (this.prefix == null) - this.prefix = String.format("%s://%s:%s", - this.scheme, this.host, this.port); - return this.prefix; - } - - /** - * Returns the scheme used by this service. - * - * @return Scheme. - */ - public String getScheme() { - return this.scheme; - } - - /** - * Construct a fully qualified URL for this service using the given path. - * - * @param path The path to qualify. - * @return Fully qualified URL. - */ - public URL getUrl(String path) { - try { - return new URL(getPrefix() + path); - } - catch (MalformedURLException e) { - throw new RuntimeException(e.getMessage()); - } - } - - /** - * Issue a POST request against the service using the given path. - * - * @param path The request path. - * @return HTTP response. - */ - public ResponseMessage post(String path) { - return post(path, null); - } - - /** - * Issue a POST request against the service using the given path and - * form arguments. - * - * @param path The request path. - * @param args Form arguments. - * @return HTTP response. - */ - public ResponseMessage post(String path, Map args) { - RequestMessage request = new RequestMessage("POST"); - request.getHeader().put( - "Content-Type", "application/x-www-form-urlencoded"); - if (count(args) > 0) - request.setContent(Args.encode(args)); - return send(path, request); - } - - /** - * Issue a DELETE request against the service using the given path. - * - * @param path The request path. - * @return HTTP response. - */ - public ResponseMessage delete(String path) { - RequestMessage request = new RequestMessage("DELETE"); - return send(path, request); - } - - /** - * Issue a DELETE request against the service using the given path - * and query arguments. - * - * @param path The request path. - * @param args Query arguments. - * @return HTTP response. - */ - public ResponseMessage delete(String path, Map args) { - if (count(args) > 0) - path = path + "?" + Args.encode(args); - RequestMessage request = new RequestMessage("DELETE"); - return send(path, request); - } - - /** - * Open a socket to this service. - * - * @return Socket - * @throws IOException - */ - Socket open() throws IOException { - if (this.scheme.equals("https")) { - SSLSocketFactory sslsocketfactory; - try { - SSLContext context = SSLContext.getInstance("SSL"); - context.init(null, trustAll, new java.security.SecureRandom()); - sslsocketfactory = context.getSocketFactory(); - } - catch (Exception e) { - throw new RuntimeException("Error installing trust manager."); - } - return sslsocketfactory.createSocket(this.host, this.port); - } - return new Socket(this.host, this.port); - } - - /** - * Issue an HTTP request against the service using the given path and - * request message. - * - * @param path Request path. - * @param request Request message. - * @return HTTP response. - */ - public ResponseMessage send(String path, RequestMessage request) { - // Construct a full URL to the resource - URL url = getUrl(path); - - // Create and initialize the connection object - HttpURLConnection cn; - try { - cn = (HttpURLConnection)url.openConnection(); - } - catch (IOException e) { - throw new RuntimeException(e.getMessage()); - } - cn.setUseCaches(false); - cn.setAllowUserInteraction(false); - - // Set the reqeust method - String method = request.getMethod(); - try { - cn.setRequestMethod(method); - } - catch (ProtocolException e) { - throw new RuntimeException(e.getMessage()); - } - - // Add headers from request message - Map header = request.getHeader(); - for (Entry entry : header.entrySet()) - cn.setRequestProperty(entry.getKey(), entry.getValue()); - - // Add default headers that were absent from the request message - for (Entry entry : defaultHeader.entrySet()) { - String key = entry.getKey(); - if (header.containsKey(key)) continue; - cn.setRequestProperty(key, entry.getValue()); - } - - // Write out request content, if any - try { - Object content = request.getContent(); - if (content != null) { - cn.setDoOutput(true); - OutputStream stream = cn.getOutputStream(); - OutputStreamWriter writer = new OutputStreamWriter(stream); - writer.write((String)content); - writer.close(); - } - } - catch (IOException e) { - throw new RuntimeException(e.getMessage()); - } - - // System.out.format("%s %s => ", method, url.toString()); - - // Execute the request - try { - cn.connect(); - } - catch (IOException e) { - throw new RuntimeException(e.getMessage()); - } - - int status; - try { - status = cn.getResponseCode(); - } - catch (IOException e) { - throw new RuntimeException(e.getMessage()); - } - - InputStream input = null; - try { - input = status >= 400 - ? cn.getErrorStream() - : cn.getInputStream(); - } - catch (IOException e) { assert(false); } - - ResponseMessage response = new ResponseMessage(status, input); - - // System.out.format("%d\n", status); - - if (status >= 400) - throw HttpException.create(response); - - return response; - } - - /** - * Set the trust policy used by this service instance. - */ - void setTrustPolicy() { - try { - SSLContext context = SSLContext.getInstance("SSL"); - context.init(null, trustAll, new java.security.SecureRandom()); - HttpsURLConnection.setDefaultSSLSocketFactory( - context.getSocketFactory()); - HttpsURLConnection.setDefaultHostnameVerifier( - new HostnameVerifier() { - public boolean verify( - String urlHostName, SSLSession session) { return true; } - }); - } - catch (Exception e) { - throw new RuntimeException("Error installing trust manager."); - } - } -} - diff --git a/splunk/com/splunk/Index.java b/splunk/com/splunk/Index.java deleted file mode 100644 index 93706bdc..00000000 --- a/splunk/com/splunk/Index.java +++ /dev/null @@ -1,558 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.IOException; -import java.io.OutputStream; -import java.io.OutputStreamWriter; -import java.io.Writer; -import java.util.Date; -import java.net.Socket; - -/** - * Representation of an index. - */ -public class Index extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The index endpoint. - */ - Index(Service service, String path) { - super(service, path); - } - - /** - * Creates a writable socket to this index. - * - * @return The Socket. - * @throws IOException - */ - public Socket attach() throws IOException { - Socket socket = service.open(); - OutputStream ostream = socket.getOutputStream(); - Writer out = new OutputStreamWriter(ostream, "UTF8"); - String header = String.format( - "POST /services/receivers/stream?index=%s HTTP/1.1\r\n" + - "Host: %s:%d\r\n" + - "Accept-Encoding: identity\r\n" + - "Authorization: %s\r\n" + - "X-Splunk-Input-Mode: Streaming\r\n\r\n", - getName(), - service.getHost(), service.getPort(), - service.token); - out.write(header); - out.flush(); - return socket; - } - - /** - * Cleans this index, removing all events. - * - * @return This index. - */ - public Index clean() { - Args saved = new Args(); - saved.put("maxTotalDataSizeMB", getMaxTotalDataSizeMB()); - saved.put("frozenTimePeriodInSecs", getFrozenTimePeriodInSecs()); - - Args reset = new Args(); - reset.put("maxTotalDataSizeMB", "1"); - reset.put("frozenTimePeriodInSecs", "1"); - update(reset); - rollHotBuckets(); - - while (true) { - try { - Thread.sleep(1000); // 1000ms (1 second sleep) - } - catch (InterruptedException e) { - return this; // eat - } - if (this.getTotalEventCount() == 0) - break; - refresh(); - } - update(saved); - return this; - } - - /** - * Returns whether or not data retrieved from this index is in UTF8 - * encoding. - * - * @return Whether or not data retrieved from this index is in UTF8. - */ - public boolean getAssureUTF8() { - return getBoolean("assureUTF8"); - } - - /** - * Returns this index's block signature database. - * - * @return This index's block signature database. - */ - public String getBlockSignatureDatabase() { - return getString("blockSignatureDatabase"); - } - - /** - * Returns this index's block sign size. This value defines the number of - * events that make up a block for block signatures. A value of 0 means - * block signing is disabled. - * - * @return This index's block sign size. - */ - public int getBlockSignSize() { - return getInteger("blockSignSize"); - } - - /** - * Returns this index's colddbs's absolute file path, or null if not - * specified. This value may contain shell expansion terms. - * - * @return this index's colddbs's absolute file path. - */ - public String getColdPath() { - return getString("coldPath", null); - } - - /** - * Returns this index's colddbs's expanded absolute file path, or null if - * not specified. - * - * @return this index's colddbs's expanded absolute file path. - */ - public String getColdPathExpanded() { - return getString("coldPath_expanded", null); - } - - /** - * Returns this index's frozen archive destination path, or null if not - * specified. - * - * @return This index's frozen archive destination path. - */ - public String getColdToFrozenDir() { - return getString("coldToFrozenDir", null); - } - - /** - * Returns this index's archiving script, or null if not specified. - * - * @see Notes on this attribute - * - * @return This index's archiving script - */ - public String getColdToFrozenScript() { - return getString("coldToFrozenScript", null); - } - - /** - * Returns whether or not raw data is compressed. - * - * @deprecated Splunk always compresses raw data. - * @return Whether or not raw data is compressed. - */ - public boolean getCompressRawdata() { - return getBoolean("compressRawdata"); - } - - /** - * Returns this index's current size in MBs. - * - * @return This index's current size in MB's - */ - public int getCurrentDBSizeMB() { - return getInteger("currentDBSizeMB"); - } - - /** - * Return the Splunk instances default index name. - * - * @return The Splunk instances default index name. - */ - public String getDefaultDatabase() { - return getString("defaultDatabase"); - } - - /** - * Returns whether or not this index has real-time-search enabled. - * - * @return Whether or not this index has real-time-search enabled. - */ - public boolean getEnableRealtimeSearch() { - return getBoolean("enableRealtimeSearch"); - } - - /** - * Returns how long, in seconds, that this index's data rolls to frozen. If - * archiving is necessary for frozen data, see coldToFrozen attributes. - * - * @return How long, in seconds, that this index's data rolls to frozen. - */ - public int getFrozenTimePeriodInSecs() { - return getInteger("frozenTimePeriodInSecs"); - } - - /** - * Returns this index's absolute path to both hot and warm buckets, or null - * if not specified. This value may contain shell expansion terms. - * - * @return This index's absolute path to both hot and warm buckets. - */ - public String getHomePath() { - return getString("homePath", null); - } - - /** - * Returns this index's expanded absolute path to both hot and warm buckets, - * or null if not specified. - * - * @return This index's expanded absolute path to both hot and warm buckets. - */ - public String getHomePathExpanded() { - return getString("homePath_expanded", null); - } - - /** - * Returns this index's index thread. - * - * @return This index's index thread. - */ - public String getIndexThreads() { - return getString("indexThreads"); - } - - /** - * Returns this index's last initialization time, or null if not specified. - * - * @return This index's last initialization time. - */ - public String getLastInitTime() { - return getString("lastInitTime", null); - } - - /** - * Returns this index's maximum number of concurrent optimize processes per - * hot bucket. - * - * @return This index's maximum number of concurrent optimize processes per - * hot bucket. - */ - public int getMaxConcurrentOptimizes() { - return getInteger("maxConcurrentOptimizes"); - } - - /** - * Returns this index's maximum data size, in MB or "auto" or - * "auto_high_volume", before triggering a roll from hot to warm buckets. - * - * @return This index's maximum data size, before triggering a roll from hot - * to warm buckets. - */ - public String getMaxDataSize() { - return getString("maxDataSize"); - } - - /** - * Returns this index's maximum number of hot buckets. - * - * @return this index's maximum number of hot buckets. - */ - public int getMaxHotBuckets() { - return getInteger("maxHotBuckets"); - } - - /** - * Returns this index's hot bucket's maximum life, in seconds. A value of - * zero means infinite. - * - * @return This index's hot bucket's maximum life, in seconds. - */ - public int getMaxHotIdleSecs() { - return getInteger("maxHotIdleSecs"); - } - - /** - * Returns this index's hot/warm bucket upper bound timespan, in seconds. - * - * @return This index's hot/warm bucket upper bound timespan, in seconds. - */ - public int getMaxHotSpanSecs() { - return getInteger("maxHotSpanSecs"); - } - - /** - * Returns this index's single tsidx file maximum size, in MB. - * - * @return This index's single tsidx file maximum size, in MB. - */ - public int getMaxMemMB() { - return getInteger("maxMemMB"); - } - - /** - * Returns this index's maximum number of lines permissible in the .data - * file. A value of zero means infinite. - * - * @return This index's maximum number of lines permissible in the .data - * file. - */ - public int getMaxMetaEntries() { - return getInteger("maxMetaEntries"); - } - - /** - * Returns this index's maximum concurrent helper processes. - * - * @return This index's maximum concurrent helper processes. - */ - public int getMaxRunningProcessGroups() { - return getInteger("maxRunningProcessGroups"); - } - - /** - * Returns this index's max time attribute, or null if not specified. - * - * @return This index's max time attribute. - */ - public Date getMaxTime() { - return getDate("maxTime", null); - } - - /** - * Returns this index's maximum allowable size, in MB. If the index grows - * larger, the oldest data is frozen. - * - * @return This index's maximum allowable size, in MB. - */ - public int getMaxTotalDataSizeMB() { - return getInteger("maxTotalDataSizeMB"); - } - - /** - * Returns this index's warm bucket count maximum. If this value is - * exceeded, the warm buckets with oldest latest times are moved to cold. - * - * @return This index's warm bucket count maximum. - */ - public int getMaxWarmDBCount() { - return getInteger("maxWarmDBCount"); - } - - /** - * Returns this index's memory pool, in MB or "auto". - * - * @return This index's memory pool, in MB. - */ - public String getMemPoolMB() { - return getString("memPoolMB"); - } - - /** - * Returns this index's file system sync frequency while compressing - * journal slices. Note that a value of "disable" disables this feature - * completely, while a value of 0 forces a filesystem sync after - * every journal slice. - * - * @return This index's file system sync frequency while compressing - * journal slices. - */ - public String getMinRawFileSyncSecs() { - return getString("minRawFileSyncSecs"); - } - - /** - * Returns this index's minimum time attribute, or null if not specified. - * - * @return This index's minimum time attribute. - */ - public Date getMinTime() { - return getDate("minTime", null); - } - - /** - * Returns this index's meta data sync interval, in seconds. A value of zero - * disables sync until a requested metadata sync. - * - * @return This index's meta data sync interval, in seconds. - */ - public int getPartialServiceMetaPeriod() { - return getInteger("partialServiceMetaPeriod"); - } - - /** - * Returns this index's future event time quarantine, in seconds. Events - * that are newer than now plus this value are quarantined. - * - * @return This index's future event time quarantine, in seconds. - */ - public int getQuarantineFutureSecs() { - return getInteger("quarantineFutureSecs"); - } - - /** - * Returns this index's past event time quarantine, in seconds. Events - * that are older than now minus this value are quarantined. - * - * @return This index's past event time quarantine, in seconds. - */ - public int getQuarantinePastSecs() { - return getInteger("quarantinePastSecs"); - } - - /** - * Returns this index's raw slice uncompressed size, in bytes. - * - * @return This index's raw slice uncompressed size, in bytes. - */ - public int getRawChunkSizeBytes() { - return getInteger("rawChunkSizeBytes"); - } - - /** - * Returns this index's hot bucket creation check frequency. This value - * also indicates warm to cold and cold to frozen check frequency. - * - * @return This index's hot bucket creation check frequency. - */ - public int getRotatePeriodInSecs() { - return getInteger("rotatePeriodInSecs"); - } - - /** - * Returns this index's meta data sync frequency. - * - * @return This index's meta data sync frequency. - */ - public int getServiceMetaPeriod() { - return getInteger("serviceMetaPeriod"); - } - - /** - * Returns a comma separated list of indexes that suppress index missing - * messages. - * - * @return A comma separated list of indexes that suppress index missing - * messages. - */ - public String getSuppressBannerList() { - return getString("suppressBannerList", null); - } - - /** - * Returns this index's sync attribute. - * - * @return This index's sync attribute. - */ - public boolean getSync() { - return getBoolean("sync"); - } - - /** - * Returns this index's syncMeta attribute. When true, a sync operation is - * invoked before the file descriptor is closed on metadata updates. - * - * @return This index's syncMeta attribute. - */ - public boolean getSyncMeta() { - return getBoolean("syncMeta"); - } - - /** - * Returns this index's absolute path to the thawed index, or null if not - * present. This value may contain shell expansion terms. - * - * @return This index's absolute path to the thawed index. - */ - public String getThawedPath() { - return getString("thawedPath", null); - } - - /** - * Returns this index's expanded absolute path to the thawed index, or null - * if not present. - * - * @return This index's expanded absolute path to the thawed index. - */ - public String getThawedPathExpanded() { - return getString("thawedPath_expanded", null); - } - - /** - * Returns this index's throttling frequency check, in seconds. - * - * @return This index's throttling frequency check, in seconds. - */ - public int getThrottleCheckPeriod() { - return getInteger("throttleCheckPeriod"); - } - - /** - * Returns this index's total event count. - * - * @return This index's total event count. - */ - public int getTotalEventCount() { - return getInteger("totalEventCount"); - } - - /** - * Returns whether or not this index is an internal index. - * - * @return Whether ot not this index is an internal index. - */ - public boolean isInternal() { - return getBoolean("isInternal"); - } - - /** - * Performs rolling hot buckets for this index. - */ - public void rollHotBuckets() { - ResponseMessage response = service.post(path + "/roll-hot-buckets"); - assert(response.getStatus() == 200); - } - - /** - * Submits an event to this index through HTTP POST. - * - * @param data Event data posted. - */ - public void submit(String data) { - RequestMessage request = new RequestMessage("POST"); - request.setContent(data); - service.send("receivers/simple?index=" + getName(), request); - } - - /** - * Uploads a file to this index as an event stream. Note: this file must - * be directly accessible to the Splunk server. - * - * @param filename The file uploaded. - */ - public void upload(String filename) { - Args args = new Args(); - args.put("name", filename); - args.put("index", getName()); - service.post("data/inputs/oneshot", args); - } -} - diff --git a/splunk/com/splunk/InputCollection.java b/splunk/com/splunk/InputCollection.java deleted file mode 100644 index f0bf92f9..00000000 --- a/splunk/com/splunk/InputCollection.java +++ /dev/null @@ -1,161 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a collection of inputs. The collection is heterogeneous - * and each member contains a kind-property that indicates the specific - * kind of input. - */ -public class InputCollection extends EntityCollection { - // CONSIDER: We can probably initialize the following based on platform and - // avoid adding the Windows inputs to the list on non-Windows platforms. - static InputKind[] kinds = new InputKind[] { - InputKind.Monitor, - InputKind.Script, - InputKind.Tcp, - InputKind.TcpSplunk, - InputKind.Udp, - InputKind.WindowsActiveDirectory, - InputKind.WindowsEventLog, - InputKind.WindowsPerfmon, - InputKind.WindowsRegistry, - InputKind.WindowsWmi - }; - - /** - * Class constructor. - * - * @param service The connected service instance. - */ - InputCollection(Service service) { - super(service, "data/inputs"); - } - - /** - * Create stub. - * - * @param name The name of the input. - * @return no return. - * @throws UnsupportedOperationException - */ - @Override public Input create(String name) { - throw new UnsupportedOperationException(); - } - - /** - * Create stub. - * - * @param name The name of the input. - * @param args Optional arguments. - * @return no return. - * @throws UnsupportedOperationException - */ - @Override public Input create(String name, Map args) { - throw new UnsupportedOperationException(); - } - - /** - * Creates a specific kind up input. - * - * @param name The name of the input created. - * @param kind The specific kind of input created. - * @param The implicit type of the input created. - * @return The created input. - */ - public T create(String name, InputKind kind) { - return (T)create(name, kind, null); - } - - /** - * Creates a specific kind up input. - * - * @param name The name of the input created. - * @param kind The specific kind of input created. - * @param args Optional arguments. - * @param The implicit type of the input created. - * @return The created input. - */ - public T - create(String name, InputKind kind, Map args) { - args = Args.create(args).add("name", name); - String path = this.path + "/" + kind.relpath; - service.post(path, args); - invalidate(); - return (T)get(name); - } - - /** - * Create an Input resource item. - * - * @param entry The Atom object describing the entry. - * @return the created input. - */ - @Override protected Input createItem(AtomEntry entry) { - String path = itemPath(entry); - InputKind kind = itemKind(path); - Class inputClass = kind.inputClass; - return createItem(inputClass, path); - } - - /** - * Returns the the path's InputKind. - * - * @param path The input path. - * @return The input kind. - */ - protected InputKind itemKind(String path) { - for (InputKind kind : kinds) { - if (path.indexOf("data/inputs/" + kind.relpath) > 0) - return kind; - } - return InputKind.Unknown; // Didn't recognize the input kind - } - - /** - * Refresh this input collection. - * - * @return The refreshed input collection. - */ - @Override public InputCollection refresh() { - items.clear(); - - // Iterate over all input kinds and collect all instances. - for (InputKind kind : kinds) { - String relpath = kind.relpath; - String inputs = String.format("%s/%s?count=-1", path, relpath); - ResponseMessage response; - try { - response = service.get(inputs); - } - catch (HttpException e) { - // On some platforms certain input endpoints don't exist, for - // example the Windows inputs endpoints don't exist on non- - // Windows platforms. - if (e.getStatus() == 404) continue; - throw e; - } - AtomFeed feed = AtomFeed.parse(response.getContent()); - load(feed); - } - - return this; - } -} - diff --git a/splunk/com/splunk/InputKind.java b/splunk/com/splunk/InputKind.java deleted file mode 100644 index 91146b45..00000000 --- a/splunk/com/splunk/InputKind.java +++ /dev/null @@ -1,69 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Enumeration of the various Splunk input kinds. - */ -public enum InputKind { - /** Unknown input kind. */ - Unknown("Unknown", Input.class), - - /** {@code Monitor} input kind. */ - Monitor("monitor", MonitorInput.class), - - /** {@code Script} input kind. */ - Script("script", ScriptInput.class), - - /** {@code TCP} input kind, raw input data. */ - Tcp("tcp/raw", TcpInput.class), - - /** {@code TCP} input kind, processed input data. */ - TcpSplunk("tcp/cooked", TcpSplunkInput.class), - - /** {@code UDP} input kind. */ - Udp("udp", UdpInput.class), - - /** {@code Windows Active Directory} input kind. */ - WindowsActiveDirectory("ad", WindowsActiveDirectoryInput.class), - - /** {@code Windows Event Log} input kind. */ - WindowsEventLog("win-event-log-collections",WindowsEventLogInput.class), - - /** {@code Windows Perfmon} input kind. */ - WindowsPerfmon("win-perfmon", WindowsPerfmonInput.class), - - /** {@code Windows Registry} input kind. */ - WindowsRegistry("registry", WindowsRegistryInput.class), - - /** {@code Windows WMI} input kind. */ - WindowsWmi("win-wmi-collections", WindowsWmiInput.class); - - /** - * Sets the active objects relative path and input class. - * - * @param relpath The relative path. - * @param inputClass The input class. - */ - InputKind(String relpath, Class inputClass) { - this.relpath = relpath; - this.inputClass = inputClass; - } - - String relpath; - Class inputClass; -} diff --git a/splunk/com/splunk/Job.java b/splunk/com/splunk/Job.java deleted file mode 100644 index 9cd0840e..00000000 --- a/splunk/com/splunk/Job.java +++ /dev/null @@ -1,670 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.util.Date; -import java.util.Map; - -/** - * Representation of a search job. - */ -public class Job extends Entity { - - /** - * Class constructor. - * - * @param service The connected service instance. - * @param path The jobs search endpoint. - */ - Job(Service service, String path) { - super(service, path); - } - - /** - * Returns the action path. - * - * @param action Action requested. - * @return The action path. - */ - @Override protected String actionPath(String action) { - if (action.equals("control")) - return path + "/control"; - return super.actionPath(action); - } - - /** - * Performs the requested action on this job. - * - * @param action The action to perform - * @return The job. - */ - public Job control(String action) { - return control(action, null); - } - - /** - * Performs the requested action on this job. - * - * @param action The action to perform. - * @param args Optional arguments for this action. - * @return The job. - */ - public Job control(String action, Map args) { - args = Args.create(args).add("action", action); - service.post(actionPath("control"), args); - invalidate(); - return this; - } - - /** - * Stops the current search and deletes the result cache. - * - * @return The job. - */ - public Job cancel() { - return control("cancel"); - } - - /** - * Disables preview generation on this job. - * - * @return The job. - */ - public Job disablePreview() { - return control("disablepreview"); - } - - /** - * Enables preview generation on this job (may slow search considerably). - * - * @return The job. - */ - public Job enablePreview() { - return control("enablepreview"); - } - - /** - * Stops the search, and provides intermediate results available for - * retrieval. - * - * @return The job. - */ - public Job finish() { - return control("finalize"); - } - - /** - * Suspends the execution of the current search. - * - * @return The job. - */ - public Job pause() { - return control("pause"); - } - - /** - * Returns this job's cursorTime attribute. - * - * @return This job's cursorTime attribute. - */ - public Date getCursorTime() { - return getDate("cursorTime"); - } - - /** - * Returns this job's delegate attribute. - * - * @return This job's delegate attribute. - */ - public String getDelegate() { - return getString("delegate", null); - } - - /** - * Returns this job's disk usage, in bytes. - * - * @return This job's disk usage, in bytes. - */ - public int getDiskUsage() { - return getInteger("diskUsage"); - } - - /** - * Returns this job's dispatch state. Valid values are from the set: - * QUEUED, PARSING, RUNNING, PAUSED, FINALIZING, FAILED or DONE. - * - * @return This job's dispatch state. - */ - public String getDispatchState() { - return getString("dispatchState"); - } - - /** - * Returns this job's progress, in the range of 0.0 to 1.0. - * - * @return This job's progress. - */ - public float getDoneProgress() { - return getFloat("doneProgress"); - } - - /** - * Returns this job's dropCount attribute. - * - * @return This jobs dropCount attribute. - */ - public int getDropCount() { - return getInteger("dropCount"); - } - - /** - * Returns this job's earliestTime attribute. - * - * @return This job's earlietTime attribute. - */ - public Date getEarliestTime() { - return getDate("earliestTime"); - } - - /** - * Returns this job's eventAvailableCount attribute. - * - * @return This job's eventAvailableCount attribute. - */ - public int getEventAvailableCount() { - return getInteger("eventAvailableCount"); - } - - /** - * Returns this job's number of events being returned. - * - * @return This job's number of events being returned. - */ - public int getEventCount() { - return getInteger("eventCount"); - } - - /** - * Returns this job's eventFieldCount attribute. - * - * @return This job's eventFieldCount attribute. - */ - public int getEventFieldCount() { - return getInteger("eventFieldCount"); - } - - /** - * Returns whether or not this job's event return is streaming. - * - * @return Whether or not this job's event return is streaming. - */ - public boolean getEventIsStreaming() { - return getBoolean("eventIsStreaming"); - } - - /** - * Returns whether or not this job's event return is truncated. - * - * @return Whether or not this job's event return is truncated. - */ - public boolean getEventIsTruncated() { - return getBoolean("eventIsTruncated"); - } - - /** - * Returns this job's event InputStream IO handle. - * - * @return This job's event InputStream IO handle. - */ - public InputStream getEvents() { - return getEvents(null); - } - - /** - * Returns this job's event InputStream IO handle. - * - * @param args Optional arguments to the event get. - * - * @return This job's event InputStream IO handle. - */ - public InputStream getEvents(Map args) { - ResponseMessage response = service.get(path + "/events", args); - return response.getContent(); - } - - /** - * Returns this job's original search query. - * - * @return This job's original search query. - */ - public String getEventSearch() { - return getString("eventSearch", null); - } - - /** - * Returns this job's eventSorting attribute. - * - * @return This job's eventSorting attribute. - */ - public String getEventSorting() { - return getString("eventSorting"); - } - - /** - * Returns this job's keywords attribute. - * - * @return This job's keywords attribute. - */ - public String getKeywords() { - return getString("keywords", null); - } - - /** - * Returns this job's label. - * - * @return This job's label. - */ - public String getLabel() { - return getString("label", null); - } - - /** - * Returns this job's latestTime attribute. - * - * @return This job's latestTime attribute. - */ - public Date getLatestTime() { - return getDate("latestTime"); - } - - /** - * Returns this job's name, or more aptly its SID. - * - * @return This job's name. - */ - @Override public String getName() { - return getSid(); - } - - /** - * Returns this job's numPreviews attribute. - * - * @return This job's numPreviews attribute. - */ - public int getNumPreviews() { - return getInteger("numPreviews"); - } - - /** - * Returns this job's priority in the range of 0-10. - * - * @return This job's priority. - */ - public int getPriority() { - return getInteger("priority"); - } - - /** - * Sets this job's priority in the range of 0-10. - * - * @param value This job's new priority. - */ - public void setPriority(int value) { - control("setpriority", new Args("priority", value)); - } - - /** - * Returns this job's remote search query string. - * - * @return This job's remote search query string. - */ - public String getRemoteSearch() { - return getString("remoteSearch", null); - } - - /** - * Returns this job's reportSearch attribute. - * - * @return This job's reportSearch attribute. - */ - public String getReportSearch() { - return getString("reportSearch", null); - } - - /** - * Returns this job's resultCount attribute. - * - * @return This job's resultCount attribute. - */ - public int getResultCount() { - return getInteger("resultCount"); - } - - /** - * Returns whether or not this job's result is streaming. - * - * @return Whether or not this job's result is streaming. - */ - public boolean getResultIsStreaming() { - return getBoolean("resultIsStreaming"); - } - - /** - * Returns this job's resultPreviewCount attribute. - * - * @return This job's resultPreviewCount attribute. - */ - public int getResultPreviewCount() { - return getInteger("resultPreviewCount"); - } - - /** - * Returns this job's results InputStream IO handle. - * - * @return This job's results InputStream IO handle. - */ - public InputStream getResults() { - return getResults(null); - } - - /** - * Returns this job's results InputStream IO handle. - * - * @param args Optional arguments. - * @return This job's results InputStream IO handle. - */ - public InputStream getResults(Map args) { - ResponseMessage response = service.get(path + "/results", args); - return response.getContent(); - } - - /** - * Returns this job's preview results InputStream IO handle. - * - * @return This job's preview results InputStream IO handle. - */ - public InputStream getResultsPreview() { - return getResultsPreview(null); - } - - /** - * Returns this job's preview results InputStream IO handle. - * - * @param args Optional arguments. - * @return This job's preview results InputStream IO handle. - */ - public InputStream getResultsPreview(Map args) { - ResponseMessage response = service.get(path + "/results_preview", args); - return response.getContent(); - } - - /** - * Returns this job's run-time duration. - * - * @return This job's run-time duration. - */ - public float getRunDuration() { - return getFloat("runDuration"); - } - - /** - * Returns this job's scanCount attribute. - * - * @return This job's scanCount attribute. - */ - public int getScanCount() { - return getInteger("scanCount"); - } - - /** - * Returns this job's search title. - * - * @return This job's search title. - */ - public String getSearch() { - return getTitle(); - } - - /** - * Returns this job's earliest search time. - * - * @return This job's earliest search time. - */ - public String getSearchEarliestTime() { - return getString("searchEarliestTime", null); - } - - /** - * Returns this job's latest search time. - * - * @return This job's latest search time. - */ - public String getSearchLatestTime() { - return getString("searchLatestTime", null); - } - - /** - * Returns this job's search log InputStream IO handle. - * - * @return This job's search log InputStream IO handle. - */ - public InputStream getSearchLog() { - return getSearchLog(null); - } - - /** - * Returns this job's search log InputStream IO handle. - * - * @param args Optional arguments - * @return This job's search log InputStream IO handle. - */ - public InputStream getSearchLog(Map args) { - ResponseMessage response = service.get(path + "/search.log", args); - return response.getContent(); - } - - /** - * Returns this job's SID. - * - * @return This job's SID. - */ - public String getSid() { - return getString("sid"); - } - - /** - * Returns this job's SID from within a response message - * - * @param response The response message. - * @return This job's SID. - */ - static String getSid(ResponseMessage response) { - return Xml.parse(response.getContent()) - .getElementsByTagName("sid").item(0).getTextContent(); - } - - /** - * Returns this jobs summary InputStream IO handle. - * - * @return This job's summary InputStream IO handle. - */ - public InputStream getSummary() { - return getSummary(null); - } - - /** - * Returns this jobs summary InputStream IO handle. - * - * @param args Optional arguments. - * @return This job's summary InputStream IO handle. - */ - public InputStream getSummary(Map args) { - ResponseMessage response = service.get(path + "/summary", args); - return response.getContent(); - } - - /** - * Returns this job's statusBuckets attribute. - * - * @return This job's statusBuckets attribute. - */ - public int getStatusBuckets() { - return getInteger("statusBuckets"); - } - - /** - * Returns this job's timeline InputStream IO handle. - * - * @return this job's timeline InputStream IO handle. - */ - public InputStream getTimeline() { - return getTimeline(null); - } - - /** - * Returns this job's timeline InputStream IO handle. - * - * @param args Optional arguments. - * @return this job's timeline InputStream IO handle. - */ - public InputStream getTimeline(Map args) { - ResponseMessage response = service.get(path + "/timeline", args); - return response.getContent(); - } - - /** - * Returns this job's time-to-live. - * - * @return This job's time-to-live. - */ - public int getTtl() { - return getInteger("ttl"); - } - - /** - * Returns whether or not this job is done. - * - * @return Whether or not this jobs is done. - */ - public boolean isDone() { - return getBoolean("isDone"); - } - - /** - * Returns whether or not this job failed. - * - * @return Whether or not this job failed. - */ - public boolean isFailed() { - return getBoolean("isFailed"); - } - - /** - * Returns whether or not this job is finalized. - * - * @return Whether or not this jobs is finalized. - */ - public boolean isFinalized() { - return getBoolean("isFinalized"); - } - - /** - * Returns whether or not this jobs is paused. - * - * @return Whether or not this jobs is paused. - */ - public boolean isPaused() { - return getBoolean("isPaused"); - } - - /** - * Returns whether or not this job's preview is enabled. - * - * @return Whether or not this job's preview is enabled. - */ - public boolean isPreviewEnabled() { - return getBoolean("isPreviewEnabled"); - } - - /** - * Returns whether or not this job is a real time search. - * - * @return Whether or not this job is a real time search. - */ - public boolean isRealTimeSearch() { - return getBoolean("isRealTimeSearch"); - } - - /** - * Returns whether or not this job has a remote timeline component. - * - * @return whether or not this job has a remote timeline component. - */ - public boolean isRemoteTimeline() { - return getBoolean("isRemoteTimeline"); - } - - /** - * Returns this job's isSaved attribute. - * - * @return this job's isSaved attribute. - */ - public boolean isSaved() { - return getBoolean("isSaved"); - } - - /** - * Return whether or not this search is a saved-search. - * - * @return Whether or not this search is a saved-search. - */ - public boolean isSavedSearch() { - return getBoolean("isSavedSearch"); - } - - /** - * returns this job's isZombie attribute. - * - * @return Thsi job's isZombie attribute. - */ - public boolean isZombie() { - return getBoolean("isZombie"); - } - - // Job "entities" don't return an AtomFeed, only an AtomEntry. - - /** - * Refresh this job. - * - * @return This job. - */ - @Override public Job refresh() { - ResponseMessage response = service.get(path); - AtomEntry entry = AtomEntry.parse(response.getContent()); - load(entry); - return this; - } - - /** - * Removes this job; which is unsupported and will throw an exception. - */ - public void remove() { - throw new UnsupportedOperationException(); - } -} - diff --git a/splunk/com/splunk/JobCollection.java b/splunk/com/splunk/JobCollection.java deleted file mode 100644 index 85e3da50..00000000 --- a/splunk/com/splunk/JobCollection.java +++ /dev/null @@ -1,88 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a collection of jobs. - */ -public class JobCollection extends EntityCollection { - static String oneShotNotAllowed = String.format( - "Oneshot not allowed, use service oneShotSearch method"); - - /** - * Class constructor. - * - * @param service The connected service instance. - */ - JobCollection(Service service) { - super(service, "search/jobs", Job.class); - } - - /** - * Creates a search job with a UTF8 pre-encoded search request. Note that - * a 'oneshot' request is invalid here. Please use the createOneShot method - * instead. - * - * @param query The search query string. - * @return The search job SID. - */ - public Job create(String query) { - return create(query, null); - } - - /** - * Creates a search job. Note that a 'oneshot' request is invalid here. - * Please use the createOneShot method instead. - * - * @param query The search query. - * @param args The arguments supplied to this job's creation. - * @return The search job SID. - */ - public Job create(String query, Map args) { - if (args != null && args.containsKey("exec_mode")) { - if (args.get("exec_mode").equals("oneshot")) - throw new RuntimeException(oneShotNotAllowed); - } - args = Args.create(args).add("search", query); - ResponseMessage response = service.post(path, args); - assert(response.getStatus() == 201); - invalidate(); - String sid = Job.getSid(response); - return get(sid); - } - - /** - * Returns this job's response. - * - * @return This job's response. - */ - @Override public ResponseMessage list() { - return service.get(path + "?count=0"); - } - - /** - * Returns this job's SID. The SID is used as this item's key. - * - * @param entry The Atom response. - * @return This job's SID. - */ - @Override protected String itemKey(AtomEntry entry) { - return (String)entry.content.get("sid"); - } -} diff --git a/splunk/com/splunk/License.java b/splunk/com/splunk/License.java deleted file mode 100644 index 325b1ca7..00000000 --- a/splunk/com/splunk/License.java +++ /dev/null @@ -1,153 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Date; - -/** - * Representation of a license. - */ -public class License extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The license endpoint. - */ - License(Service service, String path) { - super(service, path); - } - - /** - * Returns this license's creation time. - * - * @return This license's creation time. - */ - public Date getCreationTime() { - return getDateFromEpoch("creation_time"); - } - - /** - * Returns this license's expiration time. - * - * @return This license's expiration time. - */ - public Date getExpirationTime() { - return getDateFromEpoch("expiration_time"); - } - - /** - * Returns this license's list of enabled features. - * - * @return This license's list of enabled features. - */ - public String[] getFeatures() { - return getStringArray("features"); - } - - /** - * Returns this license's group ID, or null if not available. - * - * @return This license's group ID. - */ - public String getGroupId() { - return getString("group_id", null); - } - - /** - * Returns this license's label, or null if not available. - * - * @return This license's label. - */ - public String getLabel() { - return getString("label", null); - } - - /** - * Returns this license's hash value. - * - * @return This license's hash value. - */ - public String getLicenseHash() { - return getString("license_hash"); - } - - /** - * Returns this license's maximum violation value. - * - * @return This license's maximum violation value. - */ - public int getMaxViolations() { - return getInteger("max_violations"); - } - - /** - * Returns this license's ingest data quota. - * - * @return This license's ingest data quota. - */ - public long getQuota() { - return getByteCount("quota"); - } - - /** - * Returns this license's sourcetypes, or null if not specified. - * - * @return This license's sourcetypes. - */ - public String[] getSourceTypes() { - return getStringArray("sourcetypes", null); - } - - /** - * Returns this license's stack ID. - * - * @return This license's stack ID. - */ - public String getStackId() { - return getString("stack_id"); - } - - /** - * Returns this license's status. - * - * @return This license's status. - */ - public String getStatus() { - return getString("status"); - } - - /** - * Returns this license's type. - * - * @return This license's type. - */ - public String getType() { - return getString("type"); - } - - /** - * Returns this license's window period. - * - * @return This license's window period. - */ - public int getWindowPeriod() { - return getInteger("window_period"); - } -} - diff --git a/splunk/com/splunk/LicensePool.java b/splunk/com/splunk/LicensePool.java deleted file mode 100644 index 1d7afe1b..00000000 --- a/splunk/com/splunk/LicensePool.java +++ /dev/null @@ -1,89 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a license pool. - */ -public class LicensePool extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The license group endpoint. - */ - LicensePool(Service service, String path) { - super(service, path); - } - - /** - * Returns this license pool's description, or null if not specified. - * - * @return This license pool's description. - */ - public String getDescription() { - return getString("description", null); - } - - /** - * Returns this license pool's ingest quota, in bytes. Note: the return - * type is a string, because the value can also be a literal "MAX". - * - * @return This license pool's data ingest quota. - */ - public String getQuota() { - return getString("quota", "0"); - } - - /** - * Returns this license pool's list of slaves, or null if not specified. - * - * @return This license pool's list of slaves. - */ - public String[] getSlaves() { - return getStringArray("slaves", null); - } - - /** - * Returns this license pool's slave bytes used. - * - * @return This license pool's slave bytes used. - */ - public long getSlavesUsageBytes() { - return getLong("salves_usage_bytes", 0); - } - - /** - * Returns this license pool's stack ID, or null if not specified. The valid - * values are download-trial, enterprise, forwarder, or free. - * - * @return This license pool's stack ID. - */ - public String getStackId() { - return getString("stack_id", null); - } - - /** - * Returns this license pool's used bytes. - * - * @return This license pool's used bytes. - */ - public long getUsedBytes() { - return getLong("used_bytes", 0); - } -} diff --git a/splunk/com/splunk/LicensePoolCollection.java b/splunk/com/splunk/LicensePoolCollection.java deleted file mode 100644 index 0a8d3f15..00000000 --- a/splunk/com/splunk/LicensePoolCollection.java +++ /dev/null @@ -1,69 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a collection of license pools. - */ -public class LicensePoolCollection extends EntityCollection { - - /** - * Class Constructor. - * - * @param service The connected service instance. - */ - LicensePoolCollection(Service service) { - super(service, "licenser/pools", LicensePool.class); - } - - /** - * Creates a license pool. - * - * Quota can be MAX (Only one pool can use MAX size), a number or a number - * followed by MB or GB. - * - * @param name The name of this new license pool. - * @param quota The quota in bytes of this license pool. - * @param stackId The stack ID corresponding to this license pool. - * @return The new license pool. - */ - public LicensePool create(String name, int quota, String stackId) { - return create(name, quota, stackId, null); - } - - /** - * Creates a license pool. - * - * Quota can be MAX (Only one pool can use MAX size), a number or a number - * followed by MB or GB. - * - * @param name The name of this new license pool. - * @param quota The quota in bytes of this license pool. - * @param stackId The stack ID corresponding to this license pool. - * @param args Optional arguments. - * @return The new license pool. - */ - public LicensePool - create(String name, int quota, String stackId, Map args) { - args = Args.create(args); - args.put("quota", quota); - args.put("stack_id", stackId); - return create(name, args); - } -} diff --git a/splunk/com/splunk/MonitorInput.java b/splunk/com/splunk/MonitorInput.java deleted file mode 100644 index 651b7351..00000000 --- a/splunk/com/splunk/MonitorInput.java +++ /dev/null @@ -1,78 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a monitor input. - */ -public class MonitorInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The monitor input endpoint. - */ - MonitorInput(Service service, String path) { - super(service, path); - } - - /** - * Returns this monitor input's filecount. - * - * @return This monitor input's filecount. - */ - public int getFileCount() { - return getInteger("filecount", -1); - } - - /** - * Returns this monitor input's host, or null if not specified. - * - * @return This monitor input's host. - */ - public String getHost() { - return getString("host", null); - } - - /** - * Returns this monitor input's index name. - * - * @return This monitor input's index name. - */ - public String getIndex() { - return getString("index"); - } - - /** - * Returns the monitor input kind. - * - * @return The monitor input kind. - */ - public InputKind getKind() { - return InputKind.Monitor; - } - - /** - * Returns this monitor input's _rcvbuf attribute. - * - * @return This monitor input's _rcvbuf attribute. - */ - public int getRcvBuf() { - return getInteger("_rcvbuf"); - } -} diff --git a/splunk/com/splunk/OutputDefault.java b/splunk/com/splunk/OutputDefault.java deleted file mode 100644 index 4d2647b9..00000000 --- a/splunk/com/splunk/OutputDefault.java +++ /dev/null @@ -1,169 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of the default TCP output configuration. - */ -public class OutputDefault extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - */ - OutputDefault(Service service) { - super(service, "data/outputs/tcp/default"); - } - - /** - * Returns whether or not this forwarded performs automatic load balancing. - * When true, this forwarder selects a new indexer every autoLBFrequency - * seconds, or immediately when an open connection to an indexer is lost. - * - * @return Whether or not this forwarder performs automatic load balancing. - */ - public boolean autoLb() { - return getBoolean("autoLB"); - } - - /** - * Returns whether or not this forwarder will block. If set to false, events - * will get thrown away if no indexers in the group are reachable. - * - * @return Whether or not this forwarder will block. - */ - public boolean blockOnQueueFull() { - return getBoolean("blockOnQueueFull", true); - } - - /** - * Returns this forwarder's auto load balancing frequency, or -1 if not - * specified. - * - * @return this forwards auto load balancing frequency. - */ - public int getAutoLbFrequency() { - return getInteger("autoLBFrequency", -1); - } - - /** - * Returns this forwarder's default group as a comma separated list, or null - * if not specified. After Splunk 4.2, this attribute is no longer required. - * - * @return this forwarder's default group list. - */ - public String getDefaultGroup() { - return getString("defaultGroup", null); - } - - /** - * Returns the number of second this forwarder's waits before throwing out - * events if the output queue is full. A setting of 0 or -1 causes this - * forwarder to block. - * - * @return this forwards wait time, in seconds, before events are dropped - * under queue full conditions. - */ - public int getDropEventsOnQueueFull() { - return getInteger("dropEventsOnQueueFull", -1); - } - - /** - * Returns this forwarder's inclusive set of indexes. - * - * @return This forwarder's inclusive set of indexes. - */ - public String getForwardedIndex0Whitelist() { - return getString("forwardedindex.0.whitelist"); - } - - /** - * Returns this forwarder's exclusive set of indexes. - * - * @return This forwarder's exclusive set of indexes. - */ - public String getForwardedIndex1Blacklist() { - return getString("forwardedindex.1.blacklist"); - } - - /** - * Returns this forwarder's inclusive set of indexes. - * - * @return This forwarder's inclusive set of indexes. - */ - public String getForwardedIndex2Whitelist() { - return getString("forwardedindex.2.whitelist"); - } - - /** - * Returns this forwarder's heartbeat frequency sent to the indexer. Note - * that this field is only used if sendCookedData is set to true. - * - * @return This forwarder's heartbeat frequency. - */ - public int getHeartbeatFrequency() { - return getInteger("heartbeatFrequency", 30); - } - - /** - * Returns this forwarder's outbound event queue's maximum size, in bytes. - * Implicitly this forwarder's wait queue is 3 times this value. - * - * @return This forwarder's output event queue's maximum size. - */ - public long getMaxQueueSize() { - return getByteCount("maxQueueSize"); - } - - /** - * Returns whether or not to index data locally in addition to forwarding. - * This setting is not available for light forwarders. - * - * @return Whether or not to index data locally in addition to forarding. - */ - public boolean indexAndForward() { - return getBoolean("indexAndForward", false); - } - - /** - * Returns whether or not this forwarder sends compressed data. - * - * @return Whether or not this forwarder sends compressed data. - */ - public boolean isCompressed() { - return getBoolean("compressed", false); - } - - /** - * Returns whether or not this forwarder's index filter is disabled. - * - * @return Whether or not this forwarder's index filter is disabled. - */ - public boolean isForwardedIndexFilterDisable() { - return getBoolean("forwardedindex.filter.disable"); - } - - /** - * Returns whether or not the event data has been processed by Splunk. - * - * @return Whether ot nor the event data has been processed by Splunk. - */ - public boolean sendCookedData() { - return getBoolean("sendCookedData", true); - } -} diff --git a/splunk/com/splunk/OutputGroup.java b/splunk/com/splunk/OutputGroup.java deleted file mode 100644 index fb9906fe..00000000 --- a/splunk/com/splunk/OutputGroup.java +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of an output group. - */ -public class OutputGroup extends Entity { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The output group endpoint. - */ - OutputGroup(Service service, String path) { - super(service, path); - } - - /** - * Returns this forwarder's group output processor. Valid values are from - * the set tcpout, syslog, httpout. - * - * @return This forwarder's group output processor. - */ - public String getMethod() { - return getString("method", null); - } - - /** - * Returns this forwarder group's server list. - * - * @return This forwarder group's server list. - */ - public String[] getServers() { - return getStringArray("servers"); - } -} diff --git a/splunk/com/splunk/PasswordCollection.java b/splunk/com/splunk/PasswordCollection.java deleted file mode 100644 index 44dfad90..00000000 --- a/splunk/com/splunk/PasswordCollection.java +++ /dev/null @@ -1,74 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a collection of passwords. - */ -public class PasswordCollection extends EntityCollection { - - /** - * Class Constructor. - * - * @param service The connected service instance. - */ - PasswordCollection(Service service) { - // Starting with 4.3 this is available at "storage/passwords" - super(service, "admin/passwords", Password.class); - } - - /** - * Creates a credential. - * - * @param name The username to be created. - * @param password The password associated with this username. - * - * @return The new credential. - */ - public Password create(String name, String password) { - Args args = new Args("password", password); - return create(name, args); - } - - /** - * Creates a credential. - * - * @param name The username to be created. - * @param password The password associated with this username. - * @param realm The credential realm. - * - * @return The new credential. - */ - public Password create(String name, String password, String realm) { - Args args = new Args(); - args.put("password", password); - args.put("realm", realm); - return create(name, args); - } - - // Passwords user the username as a key. - - /** - * Returns the username - * - * @param entry The Atom object describing the credential. - * @return The username. - */ - @Override protected String itemKey(AtomEntry entry) { - return (String)entry.content.get("username"); - } -} diff --git a/splunk/com/splunk/Resource.java b/splunk/com/splunk/Resource.java deleted file mode 100644 index c5514c43..00000000 --- a/splunk/com/splunk/Resource.java +++ /dev/null @@ -1,146 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a Splunk resource. - */ -public abstract class Resource { - protected Map actions; - protected String path; - protected Service service; - protected String title; - private boolean maybeValid = false; - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The target endpoint. - */ - Resource(Service service, String path) { - this.path = service.fullpath(path); - this.service = service; - } - - /** - * Returns a map of actions that are enabled for this resource. - * - * @return Action map. - */ - public Map getActions() { - return validate().actions; - } - - /** - * Returns the resource name. Every resource has a name, which by default - * is its title. That name may also be used as the key for the resources - * if it belongs to a container resource, as in the case of an entity that - * belongs to an entity collection. - * - * @return Resource namne. - */ - // - public String getName() { - return getTitle(); - } - - /** - * Returns the path to this resource. - * - * @return Resource path. - */ - public String getPath() { - return this.path; - } - - /** - * Returns the service instance this resource instance is affiliated with. - * - * @return Service instance. - */ - public Service getService() { - return this.service; - } - - /** - * Return the title of this resource. This corresponds to the Atom title - * element return in the Splunk REST API. - * - * @return Resource title. - */ - public String getTitle() { - return validate().title; - } - - /** - * Set the title of this resource. - * - * @param value Resource title. - */ - void setTitle(String value) { - this.title = value; - } - - /** - * Mark the local state of this resource instance as no longer current. - * - * @return The current resource instance. - */ - public Resource invalidate() { - this.maybeValid = false; - return this; - } - - /** - * Load the state of this resource instance from the given Atom object. - * - * @param value Atom object to load resources state from. - * @return The current resource instance. - */ - Resource load(AtomObject value) { - if (value == null) { - this.title = "title"; - } - else { - this.actions = value.links; - this.title = value.title; - } - this.maybeValid = true; - return this; - } - - /** - * Refresh the local state of this resource instance. - * - * @return The current resource instance. - */ - public abstract Resource refresh(); - - /** - * Ensure that the local state of the resource instance is current, - * possibly invoking {@code refresh} if necessarry. - * - * @return The current resource instance. - */ - public Resource validate() { - if (this.maybeValid == false) refresh(); - return this; - } -} diff --git a/splunk/com/splunk/ResourceCollection.java b/splunk/com/splunk/ResourceCollection.java deleted file mode 100644 index a7487c87..00000000 --- a/splunk/com/splunk/ResourceCollection.java +++ /dev/null @@ -1,227 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.lang.reflect.Constructor; -import java.lang.reflect.InvocationTargetException; -import java.util.Collection; -import java.util.HashMap; -import java.util.Map; -import java.util.Set; - -/** - * Representation of a collection of Splunk resources. - * - * @param The type of members of the collection. - */ -public class ResourceCollection - extends Resource implements Map -{ - protected Map items = new HashMap(); - protected Class itemClass; - - ResourceCollection(Service service, String path, Class itemClass) { - super(service, path); - this.itemClass = itemClass; - } - - /** {@inheritDoc} */ - public void clear() { - throw new UnsupportedOperationException(); - } - - /** {@inheritDoc} */ - public boolean containsKey(Object key) { - return validate().items.containsKey(key); - } - - /** {@inheritDoc} */ - public boolean containsValue(Object value) { - return validate().items.containsValue(value); - } - - static Class[] itemSig = new Class[] { Service.class, String.class }; - - /** - * Creates a collection member (aka item). - * - * @param itemClass Class of the member to create. - * @param path Path to the member resource. - * @return The created member. - */ - protected T createItem(Class itemClass, String path) { - Constructor ctor; - try { - ctor = itemClass.getDeclaredConstructor(itemSig); - } - catch (NoSuchMethodException e) { - throw new RuntimeException(e); - } - - T item; - try { - item = (T)ctor.newInstance(service, path); - } - catch (IllegalAccessException e) { - throw new RuntimeException(e); - } - catch (InvocationTargetException e) { - throw new RuntimeException(e); - } - catch (InstantiationException e) { - throw new RuntimeException(e); - } - - return item; - } - - /** - * Creates a collection member corresponding to the given Atom entry. - * This base implementation uses the class object pass in when the generic - * ResourceCollection was created. Subclasses may override this method - * to provide alternative means of instantiating collection items. - * - * @param entry Atom entry corresponding to the member to instantiate. - * @return The newly created member. - */ - protected T createItem(AtomEntry entry) { - return createItem(itemClass, itemPath(entry)); - } - - /** {@inheritDoc} */ - public Set> entrySet() { - return validate().items.entrySet(); - } - - /** {@inheritDoc} */ - @Override public boolean equals(Object o) { - return validate().items.equals(o); - } - - /** {@inheritDoc} */ - public T get(Object key) { - return validate().items.get(key); - } - - @Override public int hashCode() { - return validate().items.hashCode(); - } - - /** {@inheritDoc} */ - public boolean isEmpty() { - return validate().items.isEmpty(); - } - - /** - * Returns the value to use as the item key from the given Atom entry. - * Subclasses may override this for collections that use something other - * than title as the key. - * - * @param entry The Atom entry corresponding to the collection member. - * @return The value to use as the member's key. - */ - protected String itemKey(AtomEntry entry) { - return entry.title; - } - - /** - * Returns the vlaue to use as the item path from the given Atom entry. - * Subclasses may override this to support alternative methods of - * determining a members path. - * - * @param entry The Atom entry corresponding to the collection member. - * @return The value to use as the members path. - */ - protected String itemPath(AtomEntry entry) { - return entry.links.get("alternate"); - } - - /** {@inheritDoc} */ - public Set keySet() { - return validate().items.keySet(); - } - - /** - * Issues an HTTP request to list the contents of the collection resource. - * - * @return List response message. - */ - public ResponseMessage list() { - return service.get(path + "?count=-1"); - } - - /** - * Loads the collection resource from the given {@code AtomFeed}. - * - * @param value The {@code AtomFeed} instance to load the collection from. - * @return The current resource collection instance. - */ - ResourceCollection load(AtomFeed value) { - super.load(value); - for (AtomEntry entry : value.entries) { - String key = itemKey(entry); - T item = createItem(entry); - items.put(key, item); - } - return this; - } - - /** {@inheritDoc} */ - public T put(String key, T value) { - throw new UnsupportedOperationException(); - } - - /** - * Copies all mappings from the given map to this map (unsupported). - * - * @param map The set of mappings to copy into this map. - */ - public void putAll(Map map) { - throw new UnsupportedOperationException(); - } - - /** {@inheritDoc} */ - @Override public ResourceCollection refresh() { - items.clear(); - ResponseMessage response = list(); - assert(response.getStatus() == 200); - AtomFeed feed = AtomFeed.parse(response.getContent()); - load(feed); - return this; - } - - /** {@inheritDoc} */ - public T remove(Object key) { - throw new UnsupportedOperationException(); - } - - /** {@inheritDoc} */ - public int size() { - return validate().items.size(); - } - - /** {@inheritDoc} */ - @Override public ResourceCollection validate() { - super.validate(); - return this; - } - - /** {@inheritDoc} */ - public Collection values() { - return validate().items.values(); - } -} diff --git a/splunk/com/splunk/Role.java b/splunk/com/splunk/Role.java deleted file mode 100644 index 532f57c8..00000000 --- a/splunk/com/splunk/Role.java +++ /dev/null @@ -1,191 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk role. - */ -public class Role extends Entity { - - /** - * Constructs an instance of the Role entity. - * - * @param service The service the entity is affiliated with. - * @param path The resource path. - */ - Role(Service service, String path) { - super(service, path); - } - - /** - * Returns an array of capabilities assigned to this role. - * - * @return Array of capabilities. - */ - public String[] getCapabilities() { - return getStringArray("capabilities"); - } - - /** - * Returns the name of the app to use as the default for this role. - * - * @return The default app for this role. - */ - public String getDefaultApp() { - return getString("defaultApp", null); - } - - /** - * Returns an array of capabilities imported for this role. - * - * @return Array of imported capabilities. - */ - public String[] getImportedCapabilities() { - return getStringArray("imported_capabilities", null); - } - - /** - * Returns an array of roles used to import attributes from. - * - * @return Array of roles imported from. - */ - public String[] getImportedRoles() { - return getStringArray("imported_roles", null); - } - - /** - * Returns the imported real time search jobs quota. - * - * @return Imported real time search jobs quota. - */ - public int getImportedRtSearchJobsQuota() { - return getInteger("imported_rtSrchJobsQuota"); - } - - /** - * Returns the imported search disk quota. - * - * @return Imported serach disk quota. - */ - public int getImportedSearchDiskQuota() { - return getInteger("imported_srchDiskQuota"); - } - - /** - * Returns the imported search filter. - * - * @return Imported search filter. - */ - public String getImportedSearchFilter() { - return getString("imported_srchFilter", null); - } - - /** - * Returns an array of imported allowed indexes. - * - * @return Array of imported allowed indexes. - */ - public String[] getImportedIndexesAllowed() { - return getStringArray("imported_srchIndexesAllowed", null); - } - - /** - * Returns an array of imported default indexes. - * - * @return Array of imported default indexes. - */ - public String[] getImportedIndexesDefault() { - return getStringArray("imported_srchIndexesDefault", null); - } - - /** - * Returns the imported normal search jobs quota. - * - * @return The imported normal search jobs quota. - */ - public int getImportedSearchJobsQuota() { - return getInteger("imported_srchJobsQuota"); - } - - /** - * Returns the maximum number of concurrent real time search jobs allowed - * for this role. - * - * @return Maximum number of concurrent real time search jobs. - */ - public int getRtSearchJobsQuota() { - return getInteger("rtSrchJobsQuota"); - } - - /** - * Returns the maximum disk space in MB that can be used by a users in - * this role. - * - * @return Maximum disk space usage for this role. - */ - public int getSearchDiskQuota() { - return getInteger("srchDiskQuota"); - } - - /** - * Returns a search string that restricts the scope of searches run by - * users in this role. - * - * @return Search string that restrics scope of searches. - */ - public String getSearchFilter() { - return getString("srchFilter", null); - } - - /** - * Returns an array of indexes that the role has permission to search. - * - * @return Array of indexes the role has permission to search. - */ - public String[] getSearchIndexesAllowed() { - return getStringArray("srchIndexesAllowed", null); - } - - /** - * Returns an array of default indexes to search when no index is specified. - * - * @return An array of default indexes to search when none is specified. - */ - public String[] getSearchIndexesDefault() { - return getStringArray("srchIndexesDefault", null); - } - - /** - * Returns the maximum number of concurrently running normal searches jobs - * allowed for users in this role. - * - * @return Maximum number of concurrent normal search jobs. - */ - public int getSearchJobsQuota() { - return getInteger("srchJobsQuota"); - } - - /** - * Returns the maximum time span of a search, in seconds, for users in this - * role. - * - * @return Maximum time span of a search, in seconds. - */ - public int getSearchTimeWin() { - return getInteger("srchTimeWin"); - } -} diff --git a/splunk/com/splunk/SavedSearch.java b/splunk/com/splunk/SavedSearch.java deleted file mode 100644 index 8e40c14c..00000000 --- a/splunk/com/splunk/SavedSearch.java +++ /dev/null @@ -1,507 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a saved search. - */ -public class SavedSearch extends Entity { - - /** - * Constructs an instance of the SavedSearch entity. - * - * @param service The service the entity is affiliated with. - * @param path The resource path. - */ - SavedSearch(Service service, String path) { - super(service, path); - } - - /** - * Acknowledge the suppression of alerts from this saved search and resume - * alerting. - */ - public void acknowledge() { - service.post(actionPath("acknowledge")); - invalidate(); - } - - /** {@inheritDoc} */ - @Override protected String actionPath(String action) { - if (action.equals("acknowledge")) - return path + "/acknowledge"; - if (action.equals("dispatch")) - return path + "/dispatch"; - if (action.equals("history")) - return path + "/history"; - return super.actionPath(action); - } - - /** - * Dispatch (execute) the saved search. - * - * @return The search job. - */ - public Job dispatch() { - return dispatch(null); - } - - /** - * Dispatch (execute) the saved search using the given dispatch args. - * - * @param args Dispatch arguments. - * @return The search job. - */ - // CONSIDER: We should take an optional maxWait argument - // CONSIDER: Another alternative is to return a MaybeJob object that - // has an "exists" property, so the user can call maybeJob.refresh() - // until exists == true. - public Job dispatch(Map args) { - ResponseMessage response = service.post(actionPath("dispatch"), args); - invalidate(); - String sid = Job.getSid(response); - - // The sad fact here is that the search job does not immediately show - // up once the saved search is dispatched, and we may therefore have - // to wait a while in order to return the search job. - - Job job = null; - JobCollection jobs = service.getJobs(); - for (int retry = 5; retry > 0; --retry) { - jobs.refresh(); - job = jobs.get(sid); - if (job != null) break; - try { Thread.sleep(1000); } - catch (InterruptedException e) {}; - } - - return job; - } - - /** - * Returns an array of search jobs created from this saved search. - * - * @return An array of search jobs created from this saved search. - */ - public Job[] history() { - ResponseMessage response = service.get(actionPath("history")); - AtomFeed feed = AtomFeed.parse(response.getContent()); - int count = feed.entries.size(); - Job[] result = new Job[count]; - for (int i = 0; i < count; ++i) { - String sid = feed.entries.get(i).title; - result[i] = new Job(service, "search/jobs/" + sid); - } - return result; - } - - /** - * Answers if search results are attached to an email. - * - * @return Answer if search results are attached to an email. - */ - public String getActionEmailSendResults() { - return getString("action.email.sendresults", null); - } - - /** - * Returns a semicolon delimited list of email recipients. - * - * @return Semicolon delimited list of email recipients. - */ - public String getActionEmailTo() { - return getString("action.email.to", null); - } - - /** - * Returns the period of time to show the alert in the dashboard. - * - * @return The period of time to show the alert in the dashboard. - */ - public String getAlertExpires() { - return getString("alert.expires"); - } - - /** - * Returns the alert severity level. - * - * @return The alert severity level. - */ - public int getAlertSeverity() { - return getInteger("alert.severity"); - } - - /** - * Answers if alert suppression is enabled for this search. - * - * @return Answer if alert suppression is enabled for this search. - */ - public String getAlertSuppress() { - return getString("alert.suppress", null); - } - - /** - * Returns the alert suppression period. - * - * @return The alert suppression period. - */ - public String getAlertSuppressPeriod() { - return getString("alert.suppress.period", null); - } - - /** - * Returns alert tracking setting. - * - * @return Returns alert tracking setting. - */ - public String getAlertTrack() { - return getString("alert.track"); - } - - /** - * Returns the alert comparator. - * - * @return The alert comparator. - */ - public String getAlertComparator() { - return getString("alert_comparator", null); - } - - /** - * Returns a conditional search that is evaluated against the results of - * the saved search, defaults to empty. - * - * @return A conditional search used against the results of the saved - * search. - */ - public String getAlertCondition() { - return getString("alert_condition", null); - } - - /** - * Returns the value to compare to before triggering the alert action. - * - * @return The alert threashold value. - */ - public String getAlertThreshold() { - return getString("alert_threshold", null); - } - - /** - * Returns what to base the alert on, overridden by {@code alert_condition}. - * Valid values are: always, custom, number of events, number of hosts and - * number of sources. - * - * @return The alert type. - */ - public String getAlertType() { - return getString("alert_type"); - } - - /** - * Returns the cron schedule for executing this saved search. - * - * @return The cron schedule for this saved search. - */ - public String getCronSchedule() { - return getString("cron_schedule", null); - } - - /** - * Returns a human readable description of this saved search, defaults to - * empty. - * - * @return A description of this saved search. - */ - public String getDescription() { - return getString("description", null); - } - - /** - * Returns the maximum number of timeline buckets. - * - * @return The maximum number of timeline buckets. - */ - public int getDispatchBuckets() { - return getInteger("dispatch.buckets"); - } - - /** - * Returns the earliest time for this search. - * - * @return The earliest time for this search. - */ - public String getDispatchEarliestTime() { - return getString("dispatch.earliest_time", null); - } - - /** - * Returns the latest time for this search. - * - * @return The latest time for this search. - */ - public String getDispatchLatestTime() { - return getString("dispatch.latest_time", null); - } - - /** - * Answers if lookups are enabled for this search. - * - * @return {@code true} if lookups are enabled. - */ - public boolean getDispatchLookups() { - return getBoolean("dispatch.lookups"); - } - - - /** - * Returns the maximum number of results before finalizing the search. - * - * @return The maximum number of results before finalizing the search. - */ - public int getDispatchMaxCount() { - return getInteger("dispatch.max_count"); - } - - /** - * Returns the maximum amount of time (in seconds) before finalizing the - * search. - * - * @return The maximum amount of time before finalizing the search. - */ - public String getDispatchMaxTime() { - return getString("dispatch.max_time"); - } - - /** - * Returns how frequently Splunk should run the reduce phase on accumulated - * map values. - * - * @return Frequency Splunk should run the reduce phase on accumulated - * map values. - */ - public int getDispatchReduceFreq() { - return getInteger("dispatch.reduce_freq"); - } - - /** - * Answers if Splunk spawns a new search process when this saved search - * is executed. - * - * @return {@code true} if Splunk spawns a new process when this saved - * search is executed. - */ - public boolean getDispatchSpawnProcess() { - return getBoolean("dispatch.spawn_process"); - } - - /** - * Returns the time format used to specify the earliest and latest times - * for this search. - * - * @return The time format used to specify the earliest and latest times - * for this search. - */ - public String getDispatchTimeFormat() { - return getString("dispatch.time_format"); - } - - /** - * Returns the time to live (in seconds) for artifacts of the scheduled - * search, if no alerts are triggered. - * - * @return The time to live for artifacts of the scheduled search. - */ - public String getDispatchTtl() { - return getString("dispatch.ttl"); - } - - /** - * Returns the default UI view in which to load results - * - * @return The default UI view in which to load results. - */ - public String getDisplayView() { - return getString("displayview", null); - } - - /** - * The maximum number of concurrent instances of this search the scheduler - * is allowed to run. - * - * @return Maximum number of concurrent instances of this search allowed. - */ - public int getMaxConcurrent() { - return getInteger("max_concurrent"); - } - - /** - * Returns the method used by the scheduler to compute the next execution - * time of a scheduled search. - * - * @return The method for computing the next execution time of a scheduled - * search. - */ - public boolean getRealtimeSchedule() { - return getBoolean("realtime_schedule"); - } - - /** - * Returns the app this search should be dispatched in. - * - * @return the app this search should be dispatched in. - */ - public String getRequestUiDispatchApp() { - return getString("request.ui_dispatch_app", null); - } - - /** - * Returns the view this search should be displayed in. - * - * @return The view this search should be displayed in. - */ - public String getRequestUiDispatchView() { - return getString("request.ui_dispatch_view", null); - } - - /** - * Answers if a realtime search managed by the scheduler is restarted when - * a search peer becomes available for this saved search. - * - * @return {@code true} if a realtime search is restarted when a new - * search peer becomes available. - */ - public boolean getRestartOnSearchPeerAdd() { - return getBoolean("restart_on_searchpeer_add"); - } - - /** - * Answers if this search is run when Splunk starts. If the search is not - * run on startup, then it runs at the next scheduled time. - * - * @return {@code true} if this search is run when Splunk starts. - */ - public boolean getRunOnStartup() { - return getBoolean("run_on_startup"); - } - - /** - * Returns the search expression for this saved search. - * - * @return The search expression. - */ - public String getSearch() { - return getString("search"); - } - - /** - * Returns thew viewstate id associated with the view named in the - * {@code displayView} property. - * - * @return The viewstate id. - */ - public String getVsid() { - return getString("vsid", null); - } - - /** - * Answers if the email action is enabled. - * - * @return {@code true} if the email action is enabled. - */ - public boolean isActionEmail() { - return getBoolean("action.email"); - } - - /** - * Answers if the populate-lookup action is enabled. - * - * @return {@code true} if the populate-lookup action is enabled. - */ - public boolean isActionPopulateLookup() { - return getBoolean("action.populate_lookup"); - } - - /** - * Answers if the RSS action is enabled. - * - * @return {@code true} if the RSS action is enabled. - */ - public boolean isActionRss() { - return getBoolean("action.rss"); - } - - /** - * Answers if the script action is enabled. - * - * @return {@code true} if the script action is enabled. - */ - public boolean isActioncScript() { - return getBoolean("action.script"); - } - - /** - * Answers if the summary-index action is enabled. - * - * @return {@code true} if the summary-index action is enabled. - */ - public boolean isActionSummaryIndex() { - return getBoolean("action.summary_index"); - } - - /** - * Answers if Splunk applies the alert actions to the entire result set - * or to each individual search result. - * - * @return Answer if Splunk applies the alert to the entire result set or - * to each individual search result. - */ - public boolean isDigestMode() { - return getBoolean("alert.digest_mode"); - } - - /** - * Answers if this search is run on a schedule. - * - * @return {@code true} if this search is run on a schedule. - */ - public boolean isScheduled() { - return getBoolean("is_scheduled"); - } - - /** - * Answers if the search should be visible in the saved search list. - * - * @return {@code true} if the search should be visible in the saved search - * list. - */ - public boolean isVisible() { - return getBoolean("is_visible"); - } - - /** {@inheritDoc} */ - @Override public void update(Map args) { - // Updates to a saved search *require* that the search string be - // passed, so add the current search string here if the value wasn't - // passed in by the caller. - if (!args.containsKey("search")) - args = Args.create(args).add("search", getSearch()); - super.update(args); - } -} diff --git a/splunk/com/splunk/ScriptInput.java b/splunk/com/splunk/ScriptInput.java deleted file mode 100644 index 7db46b12..00000000 --- a/splunk/com/splunk/ScriptInput.java +++ /dev/null @@ -1,89 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a script input. - */ -public class ScriptInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Script input endpoint. - */ - ScriptInput(Service service, String path) { - super(service, path); - } - - /** - * Returns this script input's group. - * - * @return This script input's group. - */ - public String getGroup() { - return getString("group", null); - } - - /** - * Returns this script input's source host, or null if not specified. - * - * @return This TCP input's source host. - */ - public String getHost() { - return getString("host", null); - } - - /** - * Returns this script input's index name. - * - * @return This script input's index name. - */ - public String getIndex() { - return getString("index"); - } - - /** - * Returns this script input's execution frequency in seconds, or a cron - * schedule. - * - * @return This scripts input's execution frequency in seconds, or a cron - * schedule. - */ - public String getInterval() { - return getString("interval"); - } - - /** - * Returns the script input kind. - * - * @return The script input kind. - */ - public InputKind getKind() { - return InputKind.Script; - } - - /** - * Returns this script input's _rcvbuf attribute. - * - * @return This script input's _rcvbuf attribute. - */ - public int getRcvBuf() { - return getInteger("_rcvbuf"); - } -} diff --git a/splunk/com/splunk/Service.java b/splunk/com/splunk/Service.java deleted file mode 100644 index c826a466..00000000 --- a/splunk/com/splunk/Service.java +++ /dev/null @@ -1,657 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.util.Map; - -/** - * Representation of a Splunk service at a given address (host:port) accessed - * using a given protocol "scheme" ({@code http} or {@code https}). A service - * instance also captures an optional namespace context consisting of - * an optional owner name (or "-" wildcard) and optional app name (or "-" - * wildcard. In order to access {@code Service} members the instance must - * be authenticated by presenting credentials using the {@code login} method - * or by constructing the instance using the {@code connect} method which - * both creates and authenticates the instance. - */ -public class Service extends HttpService { - /** The current app context */ - protected String app = null; - - /** The current session token */ - protected String token = null; - - /** The current owner context */ - protected String owner = null; - - /** The username used to authenticate the instance */ - protected String username = null; - - /** The password used to authenticate the instance */ - protected String password = null; - - /** The default host name, used if no host is provided */ - public static String DEFAULT_HOST = "localhost"; - - /** The default port number, used if no port is provided */ - public static int DEFAULT_PORT = 8089; - - /** The default scheme, used if no scheme is provided */ - public static String DEFAULT_SCHEME = "https"; - - /** - * Creates a new {@code Service} instance using the given host. - * - * @param host Host name of the service. - */ - public Service(String host) { - super(host); - } - - /** - * Creates a new {@code Service} instance using the given host and port. - * - * @param host Host name of the service. - * @param port Port number of the service - */ - public Service(String host, int port) { - super(host, port); - } - - /** - * Creates a new {@code Service} instance using the given host, port and - * scheme. - * - * @param host Host name of the service. - * @param port Port number of the service. - * @param scheme Scheme for accessing the service - * ({@code http} or {@code https}). - */ - public Service(String host, int port, String scheme) { - super(host, port, scheme); - } - - /** - * Creates a new {@code Service} instance using the given - * {@code ServiceArgs} - * - * @param args {@code ServiceArgs} to initialize the service. - */ - public Service(ServiceArgs args) { - super(); - this.app = args.app; - this.host = args.host == null ? DEFAULT_HOST : args.host; - this.owner = args.owner; - this.port = args.port == null ? DEFAULT_PORT : args.port; - this.scheme = args.scheme == null ? DEFAULT_SCHEME : args.scheme; - this.token = args.token; - } - - /** - * Creates a new {@code Service} instance using the given {@code Map} of - * service arguments. - * - * @param args {@code Map} of arguments to initialize the service. - */ - public Service(Map args) { - super(); - this.app = Args.get(args, "app", null); - this.host = Args.get(args, "host", DEFAULT_HOST); - this.owner = Args.get(args, "owner", null); - this.port = Args.get(args, "port", DEFAULT_PORT); - this.scheme = Args.get(args, "scheme", DEFAULT_SCHEME); - this.token = Args.get(args, "token", null); - } - - /** - * Establish a connection to a Splunk service using the given arguments. - * This member constructs a new {@code Service} instance and authenticates - * the session using credentials passed in the {@code args} map. - * - * @param args Map of arguments used to initialize and authenticate the - * sevice. - * @return A new {@code Service} instance. - */ - public static Service connect(Map args) { - Service service = new Service(args); - if (args.containsKey("username")) { - String username = Args.get(args, "username", null); - String password = Args.get(args, "password", null); - service.login(username, password); - } - return service; - } - - /** - * Execute a search using the export endpoint which streams results back - * in the returned {@code InputStream}. - * - * @param search The search query to execute. - * @return {@code InputStream} containing the search results. - */ - public InputStream export(String search) { - return export(search, null); - } - - /** - * Execute a search using the export endpoint which streams results back - * in the returned {@code InputStream}. - * - * @param search The search query to execute. - * @param args Additional search arguments. - * @return {@code InputStream} containing the search results. - */ - public InputStream export(String search, Map args) { - args = Args.create(args).add("search", search); - ResponseMessage response = get("search/jobs/export", args); - return response.getContent(); - } - - /** - * Ensures that the given path is fully qualified, prepending a path - * prefix if necessarry. The path prefix will be constructed using the - * current owner & app context if available. - * - * @param path The path to verify. - * @return A fully qualified resource path. - */ - String fullpath(String path) { - if (path.startsWith("/")) - return path; - if (owner == null && app == null) - return "/services/" + path; - return String.format("/servicesNS/%s/%s/%s", - owner == null ? "-" : owner, app == null ? "-" : app, path); - } - - /** - * Returns the app context for this service instance, {@code null} - * indicates no app context and {@code "-"} indicates an app wildcard. - * - * @return The app context for the service. - */ - public String getApp() { - return this.app; - } - - /** - * Returns the collection of applications. - * - * @return Application collection. - */ - public EntityCollection getApplications() { - return new EntityCollection( - this, "apps/local", Application.class); - } - - /** - * Returns the collection of configurations. - * - * @return Configurations collection. - */ - public ConfCollection getConfs() { - return new ConfCollection(this); - } - - /** - * Returns an array of system capabilities. - * - * @return Capabilities. - */ - public String[] getCapabilities() { - Entity caps = new Entity(this, "authorization/capabilities"); - return caps.getStringArray("capabilities"); - } - - /** - * Returns deployment client configuration and status. - * - * @return Deployment client configuration and status. - */ - public DeploymentClient getDeploymentClient() { - return new DeploymentClient(this); - } - - /** - * Returns the configuration of all deployment servers. - * - * @return Configuration of deployment servers. - */ - public EntityCollection getDeploymentServers() { - return new EntityCollection( - this, "deployment/server", DeploymentServer.class); - } - - /** - * Returns collection of deployment server class configurations. - * - * @return Collection of server class configurations. - */ - public EntityCollection getDeploymentServerClasses(){ - return new EntityCollection( - this, "deployment/serverclass", DeploymentServerClass.class); - } - - /** - * Returns collection of multi-tenant configurations. - * - * @return Colleciton of multi-tenant configurations. - */ - public EntityCollection getDeploymentTenants() { - return new EntityCollection( - this, "deployment/tenants", DeploymentTenant.class); - } - - /** - * Returns information regarding distributed search options. - * - * @return Distributed search information. - */ - public DistributedConfiguration getDistributedConfiguration() { - return new DistributedConfiguration(this); - } - - - /** - * Returns collection of distributed search peers. A search peer is a - * Splunk server to which another Splunk server distributes searches. The - * Splunk server where the search originates is referred to as the search - * head. - * - * @return Collection of search peers. - */ - public EntityCollection getDistributedPeers() { - return new EntityCollection( - this, "search/distributed/peers", DistributedPeer.class); - } - - /** - * Returns collection of saved event types. - * - * @return Collection of saved event types. - */ - public EventTypeCollection getEventTypes() { - return new EventTypeCollection(this); - } - - /** - * Returns collection of alerts that have been fired by the service. - * - * @return Collection of fired alerts. - */ - public EntityCollection getFiredAlerts() { - return new EntityCollection( - this, "alerts/fired_alerts", FiredAlert.class); - } - - /** - * Returns collection of Splunk indexes. - * - * @return Collection of indexes. - */ - public EntityCollection getIndexes() { - return new EntityCollection(this, "data/indexes", Index.class); - } - - /** - * Returns information about the Splunk service. - * - * @return Splunk service information. - */ - public ServiceInfo getInfo() { - return new ServiceInfo(this); - } - - /** - * Returns a collection of configured inputs. - * - * @return Collection of inputs. - */ - public InputCollection getInputs() { - return new InputCollection(this); - } - - /** - * Returns a collection of current search jobs. - * - * @return Collection of search jobs. - */ - public JobCollection getJobs() { - return new JobCollection(this); - } - - /** - * Returns collection of license group configurations. - * - * @return Collectio nof license group configurations. - */ - public EntityCollection getLicenseGroups() { - return new EntityCollection( - this, "licenser/groups", LicenseGroup.class); - } - - /** - * Returns collection of messages from the licenser. - * - * @return Collection of licenser messages. - */ - public EntityCollection getLicenseMessages() { - return new EntityCollection( - this, "licenser/messages", LicenseMessage.class); - } - - /** - * Returns the current owner context for this service instance, - * {@code "-"} indicates wildcard and {@code null} indicates no owner - * context. - * - * @return Current owner context. - */ - public String getOwner() { - return this.owner; - } - - /** - * Returns collection of licenser pool configurations. - * - * @return Collection of licenser pool configurations. - */ - public LicensePoolCollection getLicensePools() { - return new LicensePoolCollection(this); - } - - /** - * Returns collection of slaves reporting to this license master. - * - * @return Collection of licenser slaves. - */ - public EntityCollection getLicenseSlaves() { - return new EntityCollection( - this, "licenser/slaves", LicenseSlave.class); - } - - /** - * Returns collection of license stack configurations. - * - * @return Collection of license stack configurations. - */ - public EntityCollection getLicenseStacks() { - return new EntityCollection( - this, "licenser/stacks", LicenseStack.class); - } - - /** - * Returns collection of licenses for this service. - * - * @return Collection of licenses. - */ - public EntityCollection getLicenses() { - return new EntityCollection( - this, "licenser/licenses", License.class); - } - - /** - * Returns collection of service logging categories and their status. - * - * @return Collection of logging categories. - */ - public EntityCollection getLoggers() { - return new EntityCollection( - this, "server/logger", Logger.class); - } - - /** - * Returns collection of system messages. - * - * @return Collection of system messages. - */ - public MessageCollection getMessages() { - return new MessageCollection(this); - } - - /** - * Returns global TCP output properties. - * - * @return Global TCP output properties. - */ - public OutputDefault getOutputDefault() { - return new OutputDefault(this); - } - - /** - * Returns collection of output group configurations. - * - * @return Collection of output group configurations. - */ - public EntityCollection getOutputGroups() { - return new EntityCollection( - this, "data/outputs/tcp/group", OutputGroup.class); - } - - /** - * Returns collection of data forwarding configurations. - * - * @return Collection of data forwarding configurations. - */ - public EntityCollection getOutputServers() { - return new EntityCollection( - this, "data/outputs/tcp/server", OutputServer.class); - } - - /** - * Returns collection of configurations for forwarding data in standard - * syslog format. - * - * @return Collection of syslog forwarders. - */ - public EntityCollection getOutputSyslogs() { - return new EntityCollection( - this, "data/outputs/tcp/syslog", OutputSyslog.class); - } - - /** - * Returns the current password use to authenticate the session. - * - * @return Current password. - */ - public String getPassword() { - return this.password; - } - - /** - * Return collection of passwords, this collection is used for the - * management of secure credentials. - * - * @return Collection of passwords. - */ - public PasswordCollection getPasswords() { - return new PasswordCollection(this); - } - - /** - * Returns a collection of Splunk user roles. - * - * @return Collection of user roles. - */ - public EntityCollection getRoles() { - return new EntityCollection( - this, "authentication/roles", Role.class); - } - - /** - * Returns a collection of saved searches. - * - * @return Collection of saved searches. - */ - public SavedSearchCollection getSavedSearches() { - return new SavedSearchCollection(this); - } - - /** - * Returns service configuration information for an instance of Splunk. - * - * @return Service configuration information. - */ - public Settings getSettings() { - return new Settings(this); - } - - /** - * Returns the current session token. This allows sharing of session tokens - * across multiple service instances. - * - * @return Session token. - */ - public String getToken() { - return this.token; - } - - /** - * Returns the username used to authenticate the current session. - * - * @return Current username. - */ - public String getUsername() { - return this.username; - } - - /** - * Returns collection of Splunk users. - * - * @return Collection of users. - */ - public UserCollection getUsers() { - return new UserCollection(this); - } - - /** - * Authenticate the instance using the given credentials. - * - * @param username User name. - * @param password Password. - * @return The current service instance. - */ - public Service login(String username, String password) { - this.username = username; - this.password = password; - - Args args = new Args(); - args.put("username", username); - args.put("password", password); - ResponseMessage response = post("/services/auth/login", args); - String sessionKey = Xml.parse(response.getContent()) - .getElementsByTagName("sessionKey") - .item(0) - .getTextContent(); - this.token = "Splunk " + sessionKey; - - return this; - } - - /** - * Forget the current session token. - * - * @return The current service instance. - */ - public Service logout() { - this.token = null; - return this; - } - - /** - * Creates a 'oneshot' synchronous search. - * - * @param query The search query string. - * @return The response message of the search. - */ - public InputStream oneshot(String query) { - return oneshot(query, null); - } - - /** - * Creates a 'oneshot' synchronous search. - * - * @param query The search query. - * @param args The arguments to the search. - * @return The results of the search. - */ - public InputStream oneshot(String query, Map args) { - args = Args.create(args); - args.put("search", query); - args.put("exec_mode", "oneshot"); - ResponseMessage response = post("search/jobs/", args); - return response.getContent(); - } - - /** - * Parse the given search query and return a semantic map for the search. - * - * @param query The query to parse. - * @return Parse response message. - */ - public ResponseMessage parse(String query) { - return parse(query, null); - } - - /** - * Parse the given search query and return a semantic map for the search. - * - * @param query The query to parse. - * @param args Additional parse arguments. - * @return Parse response message. - */ - public ResponseMessage parse(String query, Map args) { - args = Args.create(args).add("q", query); - return get("search/parser", args); - } - - /** - * Restart the service. The service will be unavailable until it has - * sucessfully restarted. - * - * @return Restart response message. - */ - public ResponseMessage restart() { - return get("server/control/restart"); - } - - /** - * Issue an HTTP request against the service using the given path and - * request message. This method overrides the base HttpService send method - * and applies the Splunk auth header which is required for authenticated - * interactions with the Splunk service. - * - * @param path Request path. - * @param request Request message. - * @return HTTP response. - */ - @Override public ResponseMessage send(String path, RequestMessage request) { - request.getHeader().put("Authorization", token); - return super.send(fullpath(path), request); - } - - /** - * Provides a session token for use by this service instance. This allows - * sharing of session tokens across multiple service instances. - * - * @param value Session token. - */ - public void setToken(String value) { - this.token = value; - } -} diff --git a/splunk/com/splunk/ServiceInfo.java b/splunk/com/splunk/ServiceInfo.java deleted file mode 100644 index 0f2e928b..00000000 --- a/splunk/com/splunk/ServiceInfo.java +++ /dev/null @@ -1,152 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Information regarding a service instance. - */ -public class ServiceInfo extends Entity { - ServiceInfo(Service service) { - super(service, "server/info"); - } - - /** - * Returns the service's build number. - * - * @return Build number. - */ - public int getBuild() { - return getInteger("build"); - } - - /** - * Returns the service's CPU architecture. - * - * @return CPU architecture. - */ - public String getCpuArch() { - return getString("cpu_arch"); - } - - /** - * Returns a GUID identifying the Splunk instance. - * - * @return GUID identifying the Splunk instance. - */ - public String getGuid() { - return getString("guid"); - } - - /** - * Returns an array of the service's license keys. - * - * @return Array of license keys. - */ - public String[] getLicenseKeys() { - return getStringArray("licenseKeys", null); - } - - /** - * Returns the service's license signature. - * - * @return License signature. - */ - public String getLicenseSignature() { - return getString("licenseSignature"); - } - - /** - * Returns the service's curernt license state. - * - * @return License state. - */ - public String getLicenseState() { - return getString("licenseState"); - } - - /** - * Returns the GUID identifying the license master. - * - * @return GUID of the license master. - */ - public String getMasterGuid() { - return getString("master_guid"); - } - - /** - * Returns the service's current mode. - * - * @return Service mode. - */ - public String getMode() { - return getString("mode"); - } - - /** - * Returns the service's OS build. - * - * @return OS build. - */ - public String getOsBuild() { - return getString("os_build"); - } - - /** - * Returns the service's OS version. - * - * @return OS version. - */ - public String getOsVersion() { - return getString("os_version"); - } - - /** - * Returns the services server name. - * - * @return Server name. - */ - public String getServerName() { - return getString("serverName"); - } - - /** - * Returns the services Splunk version number. - * - * @return Splunk version number. - */ - public String getVersion() { - return getString("version"); - } - - /** - * Answers if the service is running under a free license. - * - * @return {@code true} if the current license is a free license. - */ - public boolean isFree() { - return getBoolean("isFree"); - } - - /** - * Answers if the service is running under a trial license. - * - * @return {@code true} if the current license is a trial license. - */ - public boolean isTrial() { - return getBoolean("isTrial"); - } -} diff --git a/splunk/com/splunk/Settings.java b/splunk/com/splunk/Settings.java deleted file mode 100644 index b379c03c..00000000 --- a/splunk/com/splunk/Settings.java +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of configuration information for an instance of Splunk. - */ -public class Settings extends Entity { - Settings(Service service) { - super(service, "server/settings"); - } - - /** - * Returns the fully qualified path to the directory containing the Splunk - * index directories. - * - * @return Path to Splunk index directories. - */ - public String getSplunkDB() { - return getString("SPLUNK_DB"); - } - - /** - * Returns the fully qualified path to the Splunk install directory. - * - * @return Path to Splunk install directory. - */ - public String getSplunkHome() { - return getString("SPLUNK_HOME"); - } - - /** - * Answers if SSL is enabled on the Splunk maangement port. - * - * @return {@code true} if SSL is enabled. - */ - public boolean getEnableSplunkWebSSL() { - return getBoolean("enableSplunkWebSSL"); - } - - /** - * Returns the service's host name. - * - * @return Service host name. - */ - public String getHost() { - return getString("host", null); - } - - /** - * Returns the splunkweb port number. - * - * @return Splunkweb port number. - */ - public int getHttpPort() { - return getInteger("httpport"); - } - - /** - * Returns the splunkd port number. - * - * @return Splunkd port number. - */ - public int getMgmtPort() { - return getInteger("mgmtHostPort"); - } - - /** - * Returns the value in megabytes of free disk space required for Splunk - * to continue operating. - * - * @return Megabyes of free disk space required by Splunk. - */ - public int getMinFreeSpace() { - return getInteger("minFreeSpace"); - } - - /** - * Returns the key that is prepended to the splunk symmetric key to - * generate the final key used to sign all traffic between master & slave - * licensers. - * - * @return Licenser symm key. - */ - public String getPass4SymmKey() { - return getString("pass4SymmKey"); - } - - /** - * Returns the name used to identify this Splunk instance for features - * such as distributed search. - * - * @return The name used to identify the Splunk instance. - */ - public String getServerName() { - return getString("serverName"); - } - - /** - * Returns the amount of time before a user session times out. - * - * @return The amount of time before a user session times out. - */ - public String getSessionTimeout() { - return getString("sessionTimeout"); - } - - /** - * Answers if the instance is configured to start splunkweb. - * - * @return {@code true} if the instance is configured to start splunkweb. - */ - public boolean getStartWebServer() { - return getBoolean("startwebserver"); - } - - /** - * Returns the IP address of the authenticating proxy. - * - * @return IP address of authenticating proxy. - */ - public String getTrustedIP() { - return getString("trustedIP", null); - } -} diff --git a/splunk/com/splunk/TcpInput.java b/splunk/com/splunk/TcpInput.java deleted file mode 100644 index dd1b6110..00000000 --- a/splunk/com/splunk/TcpInput.java +++ /dev/null @@ -1,138 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a TCP input. This differs from TCP cooked, as the data - * indexed is not processed and in raw form. - */ -public class TcpInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The TCP input endpoint. - */ - TcpInput(Service service, String path) { - super(service, path); - } - - /** - * Returns the style of host connection, or null if not specified. Valid - * values are from the set ip, dns, and none. - * - * @return The style of host connection. - */ - public String getConnectionHost() { - return getString("connection_host", null); - } - - /** - * Returns this TCP input's group. - * - * @return This TCP input's group. - */ - public String getGroup() { - return getString("group"); - } - - /** - * Returns this TPC input's source host, where this indexer gets its data. - * Null is returned if it is not specified. - * - * @return This TCP input's source host. - */ - public String getHost() { - return getString("host", null); - } - - /** - * Returns this TCP input's index name, or null if not specified. - * - * @return This TCP input's index name. - */ - public String getIndex() { - return getString("index", null); - } - - /** - * Returns the TCP input kind. - * - * @return The TCP input kind. - */ - public InputKind getKind() { - return InputKind.Tcp; - } - - /** - * Returns this TCP input's queue, or null if not specified. Valid values - * are from the set parsingQueue, indexQueue. - * - * @return This TCP input's queue. - */ - public String getQueue() { - return getString("queue", null); - } - - /** - * Returns this TCP input's _rcvbuf attribute. - * - * @return This TCP input's _rcvbuf attribute. - */ - public int getRcvBuf() { - return getInteger("_rcvbuf"); - } - - /** - * Returns this TCP input's incoming host restriction, or null if not - * specified. - * - * @return This TCP input's incoming host restriction. - */ - public String getRestrictToHost() { - return getString("restrictToHost", null); - } - - /** - * Returns this TCP input's initial source key, or null if not specified. - * This is normally the input file path. - * - * @return This TCP input's source. - */ - public String getSource() { - return getString("source", null); - } - - /** - * Returns this TCP input's event source type, or null if not specified. - * - * @return this TCP input's event source type. - */ - public String getSourceType() { - return getString("sourceType", null); - } - - /** - * Returns Whether or not this TCP input is using SSL. - * - * @return Whether or not this TCP input is using SSL. - */ - public boolean getSSL() { - return getBoolean("SSL", false); - } -} diff --git a/splunk/com/splunk/TcpSplunkInput.java b/splunk/com/splunk/TcpSplunkInput.java deleted file mode 100644 index 5d742f8c..00000000 --- a/splunk/com/splunk/TcpSplunkInput.java +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a TCP cooked input. This differs from TCP, as the data - * indexed is processed and not in raw form. - */ -public class TcpSplunkInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The TCP cooked input endpoint. - */ - TcpSplunkInput(Service service, String path) { - super(service, path); - } - - /** - * Returns the style of host connection, or null if not specified. Valid - * values are from the set ip, dns, and none. - * - * @return The style of host connection. - */ - public String getConnectionHost() { - return getString("connection_host", null); - } - - /** - * Returns this TCP cooked input's group. - * - * @return This TCP cooked input's group. - */ - public String getGroup() { - return getString("group"); - } - - /** - * Returns this TCP cooked input's source host, where this indexer gets its - * data. Null is returned if it is not specified. - * - * @return This TCP cooked input's source host. - */ - public String getHost() { - return getString("host"); - } - - /** - * Returns this TCP cooked input's index name, or null if not specified. - * - * @return This TCP cooked input's index name. - */ - public String getIndex() { - return getString("index"); - } - - /** - * Returns the TCP cooked input kind. - * - * @return The TCP cooked input kind. - */ - public InputKind getKind() { - return InputKind.TcpSplunk; - } - - /** - * Returns this TCP cooked input's queue, or null if not specified. Valid - * values are from the set parsingQueue, indexQueue. - * - * @return This TCP cooked input's queue. - */ - public String getQueue() { - return getString("queue", null); - } - - /** - * Returns this TCP cooked input's _rcvbuf attribute. - * - * @return This TCP cooked input's _rcvbuf attribute. - */ - public int getRcvBuf() { - return getInteger("_rcvbuf"); - } - - /** - * Returns this TCP cooked input's incoming host restriction, or null if not - * specified. - * - * @return This TCP cooked input's incoming host restriction. - */ - public String getRestrictToHost() { - return getString("restrictToHost", null); - } - - /** - * Returns this TCP cooked input's initial source key, or null if not - * specified. This is normally the input file path. - * - * @return This TCP cooked input's source. - */ - public String getSource() { - return getString("source", null); - } - - /** - * Returns this TCP cooked input's event source type, or null if not - * specified. - * - * @return this TCP cooked input's event source type. - */ - public String getSourceType() { - return getString("sourceType", null); - } - - /** - * Returns Whether or not this TCP cooked input is using SSL. - * - * @return Whether or not this TCP cooked input is using SSL. - */ - public boolean getSSL() { - return getBoolean("SSL", false); - } -} diff --git a/splunk/com/splunk/UdpInput.java b/splunk/com/splunk/UdpInput.java deleted file mode 100644 index 67a8269b..00000000 --- a/splunk/com/splunk/UdpInput.java +++ /dev/null @@ -1,140 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a UDP input. - */ -public class UdpInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The UDP input endpoint. - */ - UdpInput(Service service, String path) { - super(service, path); - } - - /** - * Returns the style of host connection, or null if not specified. Valid - * values are from the set ip, dns, and none. - * - * @return The style of host connection. - */ - public String getConnectionHost() { - return getString("connection_host", null); - } - - /** - * Returns this UDP input's group. - * - * @return This UDP input's group. - */ - public String getGroup() { - return getString("group"); - } - - /** - * Returns this UDP input's source host, where this indexer gets its data. - * Null is returned if it is not specified. - * - * @return This UDP input's source host. - */ - public String getHost() { - return getString("host"); - } - - /** - * Returns this UDP input's index name, or null if not specified. - * - * @return This UDP input's index name. - */ - public String getIndex() { - return getString("index"); - } - - /** - * Returns the UDP input kind. - * - * @return The UDP input kind. - */ - public InputKind getKind() { - return InputKind.Udp; - } - - /** - * Returns this UDP input's queue, or null if not specified. Valid values - * are from the set parsingQueue, indexQueue. - * - * @return This UDP input's queue. - */ - public String getQueue() { - return getString("queue", null); - } - - /** - * Returns this UDP input's _rcvbuf attribute. - * - * @return This UDP input's _rcvbuf attribute. - */ - public int getRcvBuf() { - return getInteger("_rcvbuf"); - } - - /** - * Returns this UDP input's initial source key, or null if not specified. - * This is normally the input file path. - * - * @return This UDP input's source. - */ - public String getSource() { - return getString("source", null); - } - - /** - * Returns this UDP input's event source type, or null if not specified. - * - * @return this UDP input's event source type. - */ - public String getSourceType() { - return getString("sourceType", null); - } - - /** - * Returns whether or not Splunk prepends a timestamp and hostname to - * incoming events. - * - * @return Whether or not Splunk prepends a timestamp and hostname to - * incoming events. - */ - public boolean noAppendingTimeStamp() { - return getBoolean("no_appending_timestamp", false); - } - - /** - * Returns whether or not Splunk removes the priority field to incoming - * events. - * - * @return Whether or not Splunk removes the priority field to incoming - * events. - */ - public boolean noPriorityStripping() { - return getBoolean("no_priority_stripping", false); - } -} diff --git a/splunk/com/splunk/User.java b/splunk/com/splunk/User.java deleted file mode 100644 index 4268b819..00000000 --- a/splunk/com/splunk/User.java +++ /dev/null @@ -1,118 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Splunk user. - */ -public class User extends Entity { - - /** - * Constructs an instance of the User entity. - * - * @param service The service the entity is affiliated with. - * @param path The resource path. - */ - User(Service service, String path) { - super(service, path); - } - - /** - * Returns the user's default app. - * - * @return The user's default app. - */ - public String getDefaultApp() { - return getString("defaultApp", null); - } - - /** - * Answers if the user's default app was set specifically by the user. - * - * @return {@code true} if the default app was set by the user. - */ - public boolean getDefaultAppIsUserOverride() { - return getBoolean("defaultAppIsUserOverride"); - } - - /** - * If the default app was inherited from a role, this returns the name of - * the role it was inherited from, or {@code system} if it was inherited - * from the default system setting. - * - * @return The name of the role the default app was inherited from, or - * {@code system} if it was inherited from the default system - * settings. - */ - public String getDefaultAppSourceRole() { - return getString("defaultAppSourceRole"); - } - - /** - * Returns the user's email address. - * - * @return The user's email address. - */ - public String getEmail() { - return getString("email", null); - } - - /** - * Returns the user's password. - * - * @return The user's password. - */ - public String getPassword() { - return getString("password", null); - } - - /** - * Returns the full name associated with this user. - * - * @return The full name associated with this user. - */ - public String getRealName() { - return getString("realname", null); - } - - /** - * Returns an array of roles assigned to this user. - * - * @return Array of roles assigned to this user. - */ - public String[] getRoles() { - return getStringArray("roles", null); - } - - /** - * Returns the authentication method responsible for this user. - * - * @return The authentication method repsonsible for this user. - */ - public String getType() { - return getString("type", null); - } - - /** - * Returns the timezone to use when displaying dates for this user. - * - * @return The timezone to use when displaying dates for this user. - */ - public String getTz() { - return getString("tz", null); - } -} diff --git a/splunk/com/splunk/UserCollection.java b/splunk/com/splunk/UserCollection.java deleted file mode 100644 index 32afa1dc..00000000 --- a/splunk/com/splunk/UserCollection.java +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Map; - -/** - * Representation of a collection of user entities. - */ -public class UserCollection extends EntityCollection { - - /** - * Constructs an instance of {@code UserCollection}. - * - * @param service This service instance this collection is affiliated with. - */ - UserCollection(Service service) { - super(service, "authentication/users", User.class); - } - - /** - * Create a new user entity using the given name, password and role. - * - * @param name The name for the new user entity. - * @param password The password for the new user entity. - * @param role The role to assign to the new entity. - * @return The newly craeted user entity. - */ - public User create(String name, String password, String role) { - return create(name, password, role, null); - } - - /** - * Create a new user entity using the given name, password and array of - * roles. - * - * @param name The name for the new user entity. - * @param password The password for the new user entity. - * @param roles Array of roles to assign to the new user entity. - * @return The newly created user entity. - */ - public User create(String name, String password, String[] roles) { - return create(name, password, roles, null); - } - - /** - * Create a new user entity using the given name, password, role and - * map of extra args. - * - * @param name The name for the new user entity. - * @param password The password for the new user entity. - * @param role The role to assign to the new entity. - * @param args A map of extra arguments for the new user entity. - * @return The newly created user entity. - */ - public User create(String name, String password, String role, Map args) { - args = Args.create(args); - args.put("password", password); - args.put("roles", role); - return create(name, args); - } - - - /** - * Create a new user entity using the given name, password and array of - * roles. - * - * @param name The name for the new user entity. - * @param password The password for the new user entity. - * @param roles Array of roles to assign to the new user entity. - * @param args A map of extra arguments for the new user entity. - * @return The newly created user entity. - */ - public User - create(String name, String password, String[] roles, Map args) { - args = Args.create(args); - args.put("password", password); - args.put("roles", roles); - return create(name, args); - } -} diff --git a/splunk/com/splunk/WindowsActiveDirectoryInput.java b/splunk/com/splunk/WindowsActiveDirectoryInput.java deleted file mode 100644 index 10de91c7..00000000 --- a/splunk/com/splunk/WindowsActiveDirectoryInput.java +++ /dev/null @@ -1,86 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Windows Active Directory input. - */ -public class WindowsActiveDirectoryInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Windows Active Directory input endpoint. - */ - WindowsActiveDirectoryInput(Service service, String path) { - super(service, path); - } - - /** - * Returns this Windows Active Directory input's index name, or null if not - * specified. - * - * @return This Windows Active Directory input's index name. - */ - public String getIndex() { - return getString("index", null); - } - - /** - * Returns the Windows Active Directory input kind. - * - * @return The Windows Active Directory input kind. - */ - public InputKind getKind() { - return InputKind.WindowsActiveDirectory; - } - - /** - * Returns whether or not this Windows Active Directory input's directory - * path subtree is being monitored. - * - * @return Whether or not this Windows Active Directory input's directory - * path subtree is being monitored. - */ - public boolean getMonitorSubtree() { - return getBoolean("monitorSubtree"); - } - - /** - * Returns this Windows Active Directory input's starting location in the - * directory path. Null if not specified. If not specified, the the root of - * the directory tree is used. - * - * @return this Windows Active Directory input's starting location in the - * directory path. - */ - public String getStartingNode() { - return getString("startingNode", null); - } - - /** - * Returns the fully qualified domain name of a valid, network accessible - * Domain Controller. Null if not specified. If not specified, the local - * machine is used. - * - * @return The fully qualified domain name. - */ - public String getTargetDc() { - return getString("targetDc", null); - } -} diff --git a/splunk/com/splunk/WindowsEventLogInput.java b/splunk/com/splunk/WindowsEventLogInput.java deleted file mode 100644 index e1fd2a2c..00000000 --- a/splunk/com/splunk/WindowsEventLogInput.java +++ /dev/null @@ -1,92 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Windows Event Log input. - */ -public class WindowsEventLogInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Windows Event Log input endpoint. - */ - WindowsEventLogInput(Service service, String path) { - super(service, path); - } - - /** - * Returns a comma separated list of additional hosts used in monitoring. - * - * @return additional hosts used in monitoring. - */ - public String getHosts() { - return getString("hosts", null); - } - - /** - * Returns this Windows Event Log input's index name, or null if not - * specified. - * - * @return This Windows Event Log input's index name. - */ - public String getIndex() { - return getString("index", null); - } - - /** - * Returns the Windows Event Log input kind. - * - * @return The Windows Event Log input kind. - */ - public InputKind getKind() { - return InputKind.WindowsEventLog; - } - - /** - * Returns this Windows Event log input's list of event log names. - * - * @return This Windows Event log input's list of event log names. - */ - public String [] getLogs() { - return getStringArray("logs", null); - } - - /** - * Returns this Windows Event log input's collection name. This name - * appears in configuration file, as well as the source and the sourcetype of - * the indexed data. If the value is "localhost", it will use native event - * log collection; otherwise, it will use WMI. - * - * @return This Windows Event log input's collection. - */ - public String getLocalName() { - return getString("name"); - } - - /** - * Returns this Windows Event log input's main host. Secondary hosts are - * specified in the hosts attribute. - * - * @return This Windows Event log input's main host. - */ - public String getLookupHost() { - return getString("lookup_host"); - } -} diff --git a/splunk/com/splunk/WindowsPerfmonInput.java b/splunk/com/splunk/WindowsPerfmonInput.java deleted file mode 100644 index 5d9f3220..00000000 --- a/splunk/com/splunk/WindowsPerfmonInput.java +++ /dev/null @@ -1,91 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Windows Perfmon input. - */ -public class WindowsPerfmonInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Windows Perfmon input endpoint. - */ - WindowsPerfmonInput(Service service, String path) { - super(service, path); - } - - /** - * Returns this Windows Perfmon input's monitored counters. This is a comma - * separated list. Null is returned if not specified. - * - * @return This Windows Perfmon input's counters. - */ - public String getCounters() { - return getString("counters", null); - } - - /** - * Returns this Windows Perfmon input's index name, or null if not - * specified. - * - * @return This Windows Perfmon input's index name. - */ - public String getIndex() { - return getString("index", null); - } - - /** - * Returns this Windows Perfmon input's counter instances. A wildcard - * equivocates to all instances. - * - * @return This Windows Perfmon input's counter instances. - */ - public String getInstances() { - return getString("instances", null); - } - - /** - * Returns the frequency, in seconds, to poll this Windows Perfmon input's - * performance counters. - * - * @return This Windows Perfmon polling frequency. - */ - public int getInterval() { - return getInteger("interval"); - } - - /** - * Returns the Windows Perfmon input kind. - * - * @return The Windows Perfmon input kind. - */ - public InputKind getKind() { - return InputKind.WindowsPerfmon; - } - - /** - * Returns this Windows Perfmon input's Windows performance object. - * - * @return This Windows Perfmon input's Windows performance object. - */ - public String getObject() { - return getString("object"); - } -} diff --git a/splunk/com/splunk/WindowsRegistryInput.java b/splunk/com/splunk/WindowsRegistryInput.java deleted file mode 100644 index b3646c33..00000000 --- a/splunk/com/splunk/WindowsRegistryInput.java +++ /dev/null @@ -1,103 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Windows Registry input. - */ -public class WindowsRegistryInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Windows Registry input endpoint. - */ - WindowsRegistryInput(Service service, String path) { - super(service, path); - } - - /** - * Returns whether or not this Windows Registry input has a baseline - * established. - * - * @return Whether or not this Windows Registry input has a baseline - * established. - */ - public boolean getBaseline() { - return getBoolean("baseline"); - } - - /** - * Returns this Windows Registry input's regular expression (regex) that is - * executed against process names when including/excluding events. - * - * @return This Windows Registry input's process regular expression. - */ - public String getProc() { - return getString("proc"); - } - - /** - * Returns this Windows Registry input's hive name to monitor. - * - * @return This Windows Registry input's hive name to monitor. - */ - public String getHive() { - return getString("hive"); - } - - /** - * Returns this Windows Registry input's index name, or null if not - * specified. - * - * @return This Windows Registry input's index name. - */ - public String getIndex() { - return getString("index"); - } - - /** - * Returns the Windows Registry input kind. - * - * @return The Windows Registry input kind. - */ - public InputKind getKind() { - return InputKind.WindowsRegistry; - } - - /** - * Returns whether or not this Windows Registry input monitors all - * sub-nodes under a given hive. - * - * @return Whether or not this Windows Registry input monitors all - * sub-nodes under a given hive. - */ - public boolean getMonitorSubnodes() { - return getBoolean("monitorSubnodes", false); - } - - /** - * Returns this Windows Registry input's regular expression (regex) that is - * executed against registry event types. - * - * @return This Windows Registry input's registry type regular expression. - */ - public String getType() { - return getString("type", null); - } -} diff --git a/splunk/com/splunk/WindowsWmiInput.java b/splunk/com/splunk/WindowsWmiInput.java deleted file mode 100644 index 38592180..00000000 --- a/splunk/com/splunk/WindowsWmiInput.java +++ /dev/null @@ -1,129 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -/** - * Representation of a Windows WMI input. - */ -public class WindowsWmiInput extends Input { - - /** - * Class Constructor. - * - * @param service The connected service instance. - * @param path The Windows WMI input endpoint. - */ - WindowsWmiInput(Service service, String path) { - super(service, path); - } - - /** - * Returns this Windows WMI input's WMI class name. - * - * @return This Windows WMI input's WMI class name. - */ - public String getClasses() { - return getString("classes"); - } - - /** - * Returns this Windows WMI input's properties list collected for - * this class. - * - * @return This Windows WMI input's properties list collected for - * this class. - */ - public String [] getFields() { - return getStringArray("fields", null); - } - - /** - * Returns this Windows WMI input's index name, or null if not specified. - * - * @return This Windows WMI input's index name. - */ - public String getIndex() { - return getString("index", null); - } - - /** - * Returns a list of this Windows WMI class instances. - * - * @return A list of this Windows WMI class instances. - */ - public String [] getInstances() { - return getStringArray("instances", null); - } - - /** - * Returns the frequency, in seconds, to query this Windows WMI input - * providers. - * - * @return This Windows WMI query frequency. - */ - public int getInterval() { - return getInteger("interval"); - } - - /** - * Returns the Windows WMI input kind. - * - * @return The Windows WMI input kind. - */ - public InputKind getKind() { - return InputKind.WindowsWmi; - } - - /** - * Returns this Windows WMI input's main host. Secondary hosts are - * specified in the server attribute. - * - * @return This Windows WMI input's main host. - */ - public String getLookupHost() { - return getString("lookup_host"); - } - - /** - * Returns this Windows WMI input's collection name. This name appears in - * configuration file, as well as the source and the sourcetype of the - * indexed data. - * - * @return This Windows WMI input's collection. - */ - public String getLocalName() { - return getString("name"); - } - - /** - * Returns a comma separated list of additional servers used in monitoring. - * - * @return additional servers used in monitoring. - */ - public String getServer() { - return getString("server", null); - } - - /** - * Returns this Windows WMI input's query string. - * - * @return This Windows WMI input's query string. - */ - public String getWql() { - return getString("wql"); - } -} diff --git a/splunk/com/splunk/Xml.java b/splunk/com/splunk/Xml.java deleted file mode 100644 index c32888d2..00000000 --- a/splunk/com/splunk/Xml.java +++ /dev/null @@ -1,54 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.io.InputStreamReader; -import javax.xml.parsers.DocumentBuilder; -import javax.xml.parsers.DocumentBuilderFactory; -import org.w3c.dom.Document; -import org.xml.sax.InputSource; - -/** - * A collection of XML utilities. - */ -public class Xml { - - /** - * Parse the given {@code InputStream} and return as an XML DOM. - * - * @param input Input stream. - * @return XML DOM. - */ - public static Document parse(InputStream input) { - try { - DocumentBuilderFactory factory = - DocumentBuilderFactory.newInstance(); - // We are glossing namespaces for now as we can currently - // disambiguate everything in the Splunk REST API via local name. - factory.setNamespaceAware(false); - DocumentBuilder builder = factory.newDocumentBuilder(); - InputSource inputSource = new InputSource(); - inputSource.setCharacterStream(new InputStreamReader(input)); - return builder.parse(inputSource); - } - catch (Exception e) { - throw new RuntimeException(e.getMessage()); - } - } -} - diff --git a/splunk/pom.xml b/splunk/pom.xml new file mode 100644 index 00000000..7dede37e --- /dev/null +++ b/splunk/pom.xml @@ -0,0 +1,97 @@ + + + 4.0.0 + + splunk + 1.9.5 + + splunk-sdk-java + com.splunk + 1.0.1 + + + TLSv1.2 + + + + junit + junit + 4.13.1 + test + + + commons-cli + commons-cli + 1.2 + + + + + + + org.apache.maven.plugins + maven-source-plugin + 3.2.0 + + + attach-sources + + jar + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 3.3.0 + + + attach-javadocs + + jar + + + + + + org.apache.maven.plugins + maven-surefire-plugin + 3.0.0-M5 + + ${skipTests} + alphabetical + + ${https.protocols} + + + + + org.jacoco + jacoco-maven-plugin + 0.8.8 + + + + prepare-agent + + + + + report + test + + report + + + target/test-report + + + + + + + + diff --git a/splunk/splunk.iml b/splunk/splunk.iml index b6f444bc..2fbe4c0c 100644 --- a/splunk/splunk.iml +++ b/splunk/splunk.iml @@ -7,6 +7,9 @@ + + + diff --git a/splunk/src/main/java/com/splunk/Application.java b/splunk/src/main/java/com/splunk/Application.java new file mode 100644 index 00000000..6e44068a --- /dev/null +++ b/splunk/src/main/java/com/splunk/Application.java @@ -0,0 +1,221 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code Application} class represents a locally-installed Splunk app. + */ +public class Application extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The application endpoint. + */ + Application(Service service, String path) { + super(service, path); + } + + /** + * Returns the name of the app's author. For Splunkbase + * apps, this value is the username of the Splunk.com account. For internal + * apps, this value is the full name. + * + * @return The author name, or {@code null} if not specified. + */ + public String getAuthor() { + return getString("author", null); + } + + /** + * Indicates whether Splunk checks Splunkbase for updates. + * + * @return {@code true} if Splunk checks Splunkbase for app updates, + * {@code false} if not. + */ + public boolean getCheckForUpdates() { + return getBoolean("check_for_updates", false); + } + + /** + * Returns a short description of the app. + * + * @return The description, or {@code null} if not specified. + */ + public String getDescription() { + return getString("description", null); + } + + /** + * Returns the app's label (its name). + * + * @return The label, or {@code null} if not specified. + */ + public String getLabel() { + return getString("label", null); + } + + /** + * Indicates whether to reload objects contained in the locally-installed + * app. + * + * @return {@code true} if objects are reloaded, {@code false} if not. + */ + public boolean getRefresh() { + return getBoolean("refresh", false); + } + + /** + * Returns the version of the app. + * + * @return The version, or {@code null} if not specified. + */ + public String getVersion() { + return getString("version", null); + } + + /** + * Indicates whether the app's custom setup has been + * performed. This field is available in Splunk version 4.2.4 and later. + * + * @return {@code true} if custom setup has been performed, {@code false} + * if not. + */ + public boolean isConfigured() { + return getBoolean("configured", false); + } + + /** + * Indicates whether the app is visible and navigable from Splunk Web. + * + * @return {@code true} if the app is visible and navigable from Splunk + * Web, {@code false} if not. + */ + public boolean isVisible() { + return getBoolean("visible", false); + } + + /** + * Indicates whether a state change requires the app to be restarted. + * + * @return {@code true} if state changes require the app to be restarted, + * {@code false} if not. + */ + public boolean stateChangeRequiresRestart() { + return getBoolean("state_change_requires_restart", false); + } + + /*** + * Sets the name of the app's author. For Splunkbase apps, this value is + * the username of the Splunk.com account. For internal apps, this value is + * the full name. + * + * @param author The author name. + */ + public void setAuthor(String author) { + setCacheValue("author", author); + } + + /** + * Sets whether Splunk checks Splunkbase for updates to the app. + * + * @param value {@code true} if Splunk checks Splunkbase for app updates, + * {@code false} if not. + */ + public void setCheckForUpdates(boolean value) { + setCacheValue("check_for_updates", value); + } + + /** + * Sets whether the app's custom setup has been performed. This field + * is available in Splunk 4.2.4 and later. + * + * @param value {@code true} if the app has run its custom setup, + * {@code false} if not. + */ + public void setConfigured(boolean value) { + setCacheValue("configured", value); + } + + /** + * Sets a short description of the application, which is displayed below + * the app's title on the Splunk Home tab in Splunk Web. + * + * @param description The short description of the app. + */ + public void setDescription(String description) { + setCacheValue("description", description); + } + + /** + * Sets the app's name, which is displayed in Splunk Web. The name should be + * between 5-80 characters and should not include the prefix "Splunk For". + * + * @param label The label (name) of the app. + */ + public void setLabel(String label) { + setCacheValue("label", label); + } + + /** + * Sets the version of the app. + * + * @param version The app's version. + */ + public void setVersion(String version) { + setCacheValue("version", version); + } + + /** + * Sets whether the app is visible and navigable from Splunk Web. + * + * @param visible {@code true} if the app can be visible and navigable + * from Splunk Web, {@code false} if not. + */ + public void setVisible(boolean visible) { + setCacheValue("visible", visible); + } + + /** + * Archives the app on the server file system. + * + * @return The location of the archived app, as {app_name}.spl. + */ + public ApplicationArchive archive() { + return new ApplicationArchive(service, path); + } + + /** + * Returns the app's setup information. + * + * @return The app's setup information. + */ + public ApplicationSetup setup() { + return new ApplicationSetup(service, path); + } + + /** + * Returns any update information that is available for the app. + * + * @return Update information for the app. + */ + public ApplicationUpdate getUpdate() { + return new ApplicationUpdate(service, path); + } +} + diff --git a/splunk/com/splunk/ApplicationArchive.java b/splunk/src/main/java/com/splunk/ApplicationArchive.java similarity index 54% rename from splunk/com/splunk/ApplicationArchive.java rename to splunk/src/main/java/com/splunk/ApplicationArchive.java index 7392cf44..1ce41d98 100644 --- a/splunk/com/splunk/ApplicationArchive.java +++ b/splunk/src/main/java/com/splunk/ApplicationArchive.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,44 +17,54 @@ package com.splunk; /** - * Representation of a Splunk application archive. + * The {@code ApplicationArchive} class represents an archive of a Splunk app. */ public class ApplicationArchive extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. - * @param path the full-path of the parent endpoint. + * @param service The connected {@code Service} instance. + * @param path The application endpoint. */ ApplicationArchive(Service service, String path) { super(service, path + "/package"); } /** - * Returns the app name. + * Returns the name of the app. * - * @return The app name string. + * @return The app's name. */ public String getAppName() { return getString("name"); } /** - * Returns the file path, on the server where the archive file is stored, - * accessible with direct file access on the server. + * Returns a path indicating where the app archive file is stored on the + * server, for direct file access. * - * @return The server file path of the archive file. + * @return The path to the archive file. */ public String getFilePath() { return getString("path"); } /** - * Returns the URL that points to the archive file on the server, accessible - * with a browser. + * Indicates whether to reload the objects contained in the + * locally-installed app. * - * @return The URL of the archive file. + * @return {@code true} if objects are reloaded, {@code false} if not. + */ + public boolean getRefresh() { + return getBoolean("refresh", false); + } + + /** + * Returns a URL to the app archive file on the server, for web browser + * access. + * + * @return The URL to the archive file. */ public String getUrl() { return getString("url"); diff --git a/splunk/com/splunk/ApplicationSetup.java b/splunk/src/main/java/com/splunk/ApplicationSetup.java similarity index 61% rename from splunk/com/splunk/ApplicationSetup.java rename to splunk/src/main/java/com/splunk/ApplicationSetup.java index 0139c4c1..1caca007 100644 --- a/splunk/com/splunk/ApplicationSetup.java +++ b/splunk/src/main/java/com/splunk/ApplicationSetup.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,30 +17,41 @@ package com.splunk; /** - * Representation of Splunk application setup information. + * The {@code ApplicationSetup} class represents the setup information for a + * Splunk app. */ public class ApplicationSetup extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. - * @param path the full-path of the parent endpoint. + * @param service The connected {@code Service} instance. + * @param path The application endpoint. */ ApplicationSetup(Service service, String path) { super(service, path + "/setup"); } + /** + * Indicates whether to reload the objects contained in the + * locally-installed app. + * + * @return {@code true} if objects are reloaded, {@code false} if not. + */ + public boolean getRefresh() { + return getBoolean("refresh", false); + } + /** * Returns the app's setup information in XML format. * - * @return The app's setup information in XML format. + * @return The setup information for the app. */ public String getSetupXml() { return getString("eai:setup"); } // Because all other keys are dynamic and context specific, they should - // be retrieved via standard Map access. + // be retrieved using Map (dictionary) get access. } diff --git a/splunk/com/splunk/ApplicationUpdate.java b/splunk/src/main/java/com/splunk/ApplicationUpdate.java similarity index 58% rename from splunk/com/splunk/ApplicationUpdate.java rename to splunk/src/main/java/com/splunk/ApplicationUpdate.java index b780904c..66adaced 100644 --- a/splunk/com/splunk/ApplicationUpdate.java +++ b/splunk/src/main/java/com/splunk/ApplicationUpdate.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,87 +17,88 @@ package com.splunk; /** - * Representation of a Splunk application update information. + * The {@code ApplicationUpdate} class represents information for an update + * to a locally-installed Splunk app. */ public class ApplicationUpdate extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. - * @param path the full-path of the parent endpoint. + * @param service The connected {@code Service} instance. + * @param path The application endpoint. */ ApplicationUpdate(Service service, String path) { super(service, path + "/update"); } /** - * Returns the app's fully qualified update URL, or null if not specified. + * Returns the fully-qualified URL to the app update. * - * @return the app's update URL. + * @return The URL of the app update, or {@code null} if not specified. */ public String getAppUrl() { return getString("update.appurl", null); } /** - * Returns the checksum of the app, or null if not specified. + * Returns the checksum of the app. * - * @return The checksum of them app. + * @return The checksum of the app, or {@code null} if not specified. */ public String getChecksum() { return getString("update.checksum", null); } /** - * Returns the checksum type of the app, or null if not specified. + * Returns the checksum type of the app. * - * @return the checksum type of the app. + * @return The checksum type, or {@code null} if not specified. */ public String getChecksumType() { return getString("update.checksum.type", null); } /** - * Returns the app's fully qualified homepage URL, or null if not specified. + * Returns the fully-qualified URL to the app's homepage. * - * @return The app's homepage URL. + * @return The URL of the app's homepage, or {@code null} if not specified. */ public String getHomepage() { return getString("update.homepage", null); } /** - * Returns the app's name, or null if not specified. + * Returns the app's name. * - * @return The app's name. + * @return The app's name, or {@code null} if not specified. */ public String getUpdateName() { return getString("update.name", null); } /** - * Returns the app's update size, in bytes, or -1 if not specified. + * Returns the size of the app update. * - * @return The app's update size. + * @return The size of the update, in bytes, or -1 if not specified. */ public int getSize() { return getInteger("update.size", -1); } /** - * Returns the app's version string, or null if not specified. + * Returns the app's version. * - * @return The app's version. + * @return The app's version, or {@code null} if not specified. */ public String getVersion() { return getString("update.version", null); } /** - * Returns whether or not implicit ID is required. + * Indicates whether an implicit ID is required. * - * @return A boolean indicating if implicit ID is required. + * @return {@code true} if an implicit ID is required, {@code false} if not. */ public boolean isImplicitIdRequired() { return getBoolean("update.implicit_id_required", false); diff --git a/splunk/com/splunk/Args.java b/splunk/src/main/java/com/splunk/Args.java similarity index 68% rename from splunk/com/splunk/Args.java rename to splunk/src/main/java/com/splunk/Args.java index efd3bbf0..4e93f36a 100644 --- a/splunk/com/splunk/Args.java +++ b/splunk/src/main/java/com/splunk/Args.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -18,18 +18,19 @@ import java.io.UnsupportedEncodingException; import java.net.URLEncoder; -import java.util.HashMap; +import java.util.LinkedHashMap; import java.util.Map; import java.util.Map.Entry; /** - * A helper for Splunk REST API arguments. + * The {@code Args} class is a helper class for working with Splunk REST API + * arguments. * - * The extension is mainly for encoding arguments for UTF8 transmission - * to the Splunk instance in a key?value pairing for a string object, or - * key?value1&key?value2, etc for an array of strings object. + * This extension is used mainly for encoding arguments for UTF8 transmission + * to a Splunk instance in a key=value pairing for a string, or + * {@code key=value1&key=value2 } (and so on) for an array of strings. */ -public class Args extends HashMap { +public class Args extends LinkedHashMap { /** * Class constructor. @@ -37,10 +38,11 @@ public class Args extends HashMap { public Args() { super(); } /** - * Class constructor. Initialization of a single key/value pair. + * Class constructor. Initializes a single key-value pair. * * @param key The key name. - * @param value The value (String or String []) + * @param value The value, as a {@code String:String} or + * {@code String:String[]}. */ public Args(String key, Object value) { super(); @@ -48,20 +50,21 @@ public Args(String key, Object value) { } /** - * Class constructor. Initialization of a pre-existing hash map. + * Class constructor. Initializes a pre-existing hash map. * - * @param values A set of key/value pairings. + * @param values A set of key-value pairs. */ public Args(Map values) { super(values); } /** - * Adds to an args set. + * Adds an argument to an {@code Args} object. * * @param key The key name. - * @param value The value. (String or String []) - * @return This Args set. + * @param value The value, as a {@code String:String} or + * {@code String:String[]}. + * @return This {@code Args} set. */ public Args add(String key, Object value) { put(key, value); @@ -69,30 +72,33 @@ public Args add(String key, Object value) { } /** - * Creates a new Args instance that is empty. + * Creates a new empty instance of {@code Args}. * - * @return The Args instance. + * @return The {@code Args} instance. */ public static Args create() { return new Args(); } /** - * Creates a new Args instance initialized with a single key/value pair. + * Creates a new {@code Args} instance and initializes it with a single + * key-value pair. * * @param key The key name. - * @param value The value. (String or String[]) - * @return The Args instance. + * @param value The value, as a {@code String:String} or + * {@code String:String[]}. + * @return The {@code Args} instance. */ public static Args create(String key, Object value) { return new Args(key, value); } /** - * Creates a new Args instance initialized with a pre-existing hash map. + * Creates a new {@code Args} instance and initializes it with a + * pre-existing hash map. * * @param values The pre-existing hash map. - * @return The Args instance. + * @return The {@code Args} instance. */ public static Args create(Map values) { return values == null ? new Args() : new Args(values); @@ -115,8 +121,8 @@ public static String encode(String value) { } /** - * Encodes a hash map of String:String or String:String[] into a single UTF8 - * encoded string. + * Encodes a hash map of {@code String:String} or {@code String:String[]} + * into a single UTF8-encoded string. * * @param args The hash map. * @return The string. @@ -125,7 +131,7 @@ public static String encode(Map args) { return Args.create(args).encode(); } - // Encode an argument with a list valued argument + // Encodes an argument with a list-valued argument. private void encodeValues(StringBuilder builder, String key, String[] values) { key = encode(key); @@ -138,9 +144,9 @@ public static String encode(Map args) { } /** - * Encodes an Args instance into a UTF8 encoded string. + * Encodes an {@code Args} instance into a UTF8-encoded string. * - * @return The UTF8 encoded string. + * @return The UTF8-encoded string. */ public String encode() { StringBuilder builder = new StringBuilder(); @@ -161,7 +167,7 @@ public String encode() { } /** - * Returns the hash map value of a specific key, or the default value if + * Returns the hash-map value of a specific key, or the default value if * the key is not found. * * @param args The hash map. diff --git a/splunk/src/main/java/com/splunk/AtomEntry.java b/splunk/src/main/java/com/splunk/AtomEntry.java new file mode 100644 index 00000000..1282d2d2 --- /dev/null +++ b/splunk/src/main/java/com/splunk/AtomEntry.java @@ -0,0 +1,249 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.InputStream; +import java.util.ArrayList; +import java.util.List; +import javax.xml.stream.XMLStreamConstants; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamReader; + +/** + * The {@code AtomEntry} class represents an Atom {@code } element. + */ +public class AtomEntry extends AtomObject { + /** The value of the Atom entry's {@code } element. */ + public String published; + + /** The value of the Atom entry's {@code } element. */ + public Record content; + + /** + * Creates a new {@code AtomEntry} instance. + * + * @return A new {@code AtomEntry} instance. + */ + static AtomEntry create() { + return new AtomEntry(); + } + + /** + * Creates a new {@code AtomEntry} instance based on a given stream. + * A few endpoints, such as {@code search/jobs/{sid}}, + * return an Atom {@code } element as the root of the response. + * + * @param input The input stream. + * @return An {@code AtomEntry} instance representing the parsed stream. + */ + + public static AtomEntry parseStream(InputStream input) { + XMLStreamReader reader = createReader(input); + + AtomEntry result = AtomEntry.parse(reader); + + try { + reader.close(); + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + + return result; + } + + /** + * Creates a new {@code AtomEntry} instance based on a given XML reader. + * + * @param reader The XML reader. + * @return An {@code AtomEntry} instance representing the parsed XML. + */ + static AtomEntry parse(XMLStreamReader reader) { + AtomEntry entry = AtomEntry.create(); + entry.load(reader, "entry"); + return entry; + } + + /** + * Initializes the current instance using the given XML reader. + * + * @param reader The XML reader. + */ + @Override void init(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + if (name.equals("published")) { + this.published = parseText(reader); + } + else if (name.equals("content")) { + this.content = parseContent(reader); + } + else { + super.init(reader); + } + } + + /** + * Parses the {@code } element of an Atom entry. + * + * @param reader The XML reader. + * @return A {@code Record} object containing the parsed values. + */ + private Record parseContent(XMLStreamReader reader) { + assert isStartElement(reader, "content"); + + scan(reader); + + // The content element should contain a single element + + if (!isStartElement(reader, "dict")) + syntaxError(reader); + + content = parseDict(reader); + + if (!isEndElement(reader, "content")) + syntaxError(reader); + + scan(reader); // Consume + + return content; + } + + /** + * Parses a {@code } content element and returns a {@code Record} + * object containing the parsed values. + * + * @param reader The {@code } element to parse. + * @return A {@code Record} object containing the parsed values. + */ + private Record parseDict(XMLStreamReader reader) { + assert isStartElement(reader, "dict"); + + Record result = new Record(); + + scan(reader); + while (isStartElement(reader, "key")) { + String key = reader.getAttributeValue(null, "name"); + Object value = parseValue(reader); + // Null values, the result of empty elements, are parsed as though + // they don't exist, making it easier for the client framework to + // supply more meaningful default values. + if (value != null) result.put(key, value); + } + + if (!isEndElement(reader, "dict")) + syntaxError(reader); + + scan(reader); // Consume + + return result; + } + + /** + * Parses a {@code } element and returns a {@code List} object + * containing the parsed values. + * + * @param reader The XML reader. + * @return A {@code List} object containing the parsed values. + */ + private List parseList(XMLStreamReader reader) { + assert isStartElement(reader, "list"); + + List result = new ArrayList(); + + scan(reader); + while (isStartElement(reader, "item")) { + Object value = parseValue(reader); + result.add(value); + } + + if (!isEndElement(reader, "list")) + syntaxError(reader); + + scan(reader); // Consume + + return result; + } + + // Parses either a dict or list structure. + private Object parseStructure(XMLStreamReader reader) { + String name = reader.getLocalName(); + + if (name.equals("dict")) + return parseDict(reader); + + if (name.equals("list")) + return parseList(reader); + + syntaxError(reader); + + return null; // Unreached + } + + /** + * Parses the value contained by the element at the current cursor position + * of the given reader. + *

+ * Note: This function takes the parent element as its starting point + * so that it can correctly match the end element. The function takes the + * start element and its corresponding end element, then returns the + * contained value. The cursor is then located at the next element to be + * parsed. + * + * @param reader The XML reader to parse. + * @return An object containing the parsed values. If the source was a text + * value, the object is a {@code String}. If the source was a {@code } + * element, the object is a {@code Record}. If the source was a + * {@code } element, the object is a {@code List} object. + */ + Object parseValue(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + scan(reader); + + Object value; + switch (reader.getEventType()) { + case XMLStreamConstants.CHARACTERS: + value = reader.getText(); + scan(reader); // Advance cursor + break; + + case XMLStreamConstants.START_ELEMENT: + value = parseStructure(reader); + break; + + case XMLStreamConstants.END_ELEMENT: + value = null; // Empty element + break; + + default: + value = null; + syntaxError(reader); + } + + if (!isEndElement(reader, name)) + syntaxError(reader); + + scan(reader); // Consume end element + + return value; + } +} diff --git a/splunk/src/main/java/com/splunk/AtomFeed.java b/splunk/src/main/java/com/splunk/AtomFeed.java new file mode 100644 index 00000000..27915701 --- /dev/null +++ b/splunk/src/main/java/com/splunk/AtomFeed.java @@ -0,0 +1,115 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.InputStream; +import java.util.*; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamReader; +import javax.xml.stream.XMLStreamConstants; + +/** + * The {@code AtomFeed} class represents an Atom feed. + */ +public class AtomFeed extends AtomObject { + /** The list of Atom entries contained in this {@code AtomFeed} object. */ + public ArrayList entries = new ArrayList(); + + /** The value of the Atom feed's {@code } element. */ + public String itemsPerPage = null; + + /** The value of the Atom feed's {@code } element. */ + public String startIndex = null; + + /** The value of the Atom feed's {@code } element. */ + public String totalResults = null; + + /** + * Creates a new {@code AtomFeed} instance. + * + * @return A new {@code AtomFeed} instance. + */ + static AtomFeed create() { + return new AtomFeed(); + } + + /** + * Creates a new {@code AtomFeed} instance based on the given stream. + * + * @param input The input stream. + * @return An {@code AtomFeed} instance representing the parsed stream. + */ + public static AtomFeed parseStream(InputStream input) { + XMLStreamReader reader = createReader(input); + + AtomFeed result = AtomFeed.parse(reader); + + try { + reader.close(); + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + + return result; + } + + /** + * Creates a new {@code AtomFeed} instance based on a given XML element. + * + * @param input The XML stream. + * @return An {@code AtomFeed} instance representing the parsed element. + * @throws RuntimeException The runtime exception if a parse error occurs. + */ + static AtomFeed parse(XMLStreamReader input) { + AtomFeed feed = AtomFeed.create(); + feed.load(input, "feed"); + return feed; + } + + /** + * Initializes the current instance from a given XML element. + * + * @param reader The XML reader. + */ + @Override void init(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + if (name.equals("entry")) { + AtomEntry entry = AtomEntry.parse(reader); + this.entries.add(entry); + } + else if (name.equals("messages")) { + parseEnd(reader); + } + else if (name.equals("totalResults")) { + this.totalResults = parseText(reader); + } + else if (name.equals("itemsPerPage")) { + this.itemsPerPage = parseText(reader); + } + else if (name.equals("startIndex")) { + this.startIndex = parseText(reader); + } + else { + super.init(reader); + } + } +} + diff --git a/splunk/src/main/java/com/splunk/AtomObject.java b/splunk/src/main/java/com/splunk/AtomObject.java new file mode 100644 index 00000000..67567134 --- /dev/null +++ b/splunk/src/main/java/com/splunk/AtomObject.java @@ -0,0 +1,248 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.InputStream; +import java.util.HashMap; +import java.util.Map; +import javax.xml.stream.Location; +import javax.xml.stream.XMLInputFactory; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamReader; +import javax.xml.stream.XMLStreamConstants; + +/** + * The {@code AtomObject} class represents a generic Atom object. This class is + * a common base class shared by {@code AtomFeed} and {@code AtomEntry}. + */ +public class AtomObject { + /** The value of the Atom {@code } element. */ + public String id; + + /** The value of the {@code } elements in this {@code AtomObject}. */ + public Map links = new HashMap(); + + /** The value of the Atom {@code } element. */ + public String title; + + /** The value of the Atom {@code <updated>} element. */ + public String updated; + + /** + * Instantiates the XMLStreamReader, advances to the root element and + * validates the root document structure. This initialization code is shared + * by the {@code AtomFeed} and {@code AtomEntry} parsers. + * + * @param input The input stream. + * @return An {@code XMLStreamReader} initialized reader, advanced to the + * first element of the document. + */ + protected static XMLStreamReader createReader(InputStream input) { + XMLInputFactory factory = XMLInputFactory.newInstance(); + + // The Atom parser assumes that all adjacent text nodes are coalesced + factory.setProperty(XMLInputFactory.IS_COALESCING, true); + factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, true); + + XMLStreamReader reader; + try { + reader = factory.createXMLStreamReader(input); + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + + assert reader.getEventType() == XMLStreamConstants.START_DOCUMENT; + + // Scan ahead to first element + scanTag(reader); + + return reader; + } + + /** + * Initialize a property of the current instance based on the given XML + * element. + * + * @param reader The XML reader. + */ + void init(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + if (name.equals("id")) { + this.id = parseText(reader); + } + else if (name.equals("link")) { + String rel = reader.getAttributeValue(null, "rel"); + String href = reader.getAttributeValue(null, "href"); + this.links.put(rel, href); + parseEnd(reader); + } + else if (name.equals("title")) { + this.title = parseText(reader); + } + else if (name.equals("updated")) { + this.updated = parseText(reader); + } + else { + parseEnd(reader); // Ignore + } + } + + /** + * Initializes the current instance from the given XML element by calling + * the {@code init} method on each child of the XML element. + * + * @param reader The XML reader. + */ + void load(XMLStreamReader reader, String localName) { + assert isStartElement(reader, localName); + + String name = reader.getLocalName(); + + scan(reader); + while (reader.isStartElement()) { + init(reader); + } + + if (!isEndElement(reader, name)) + syntaxError(reader); + + scan(reader); // Consume the end element + } + + /** + * Parses the element at the current cursor position and reads the + * corresponding end element. + * + * @param reader The XML reader. + */ + protected void parseEnd(XMLStreamReader reader) { + scanEnd(reader); // Scan ahead to the end element + scan(reader); // Consume the end element + } + + /** + * Parses and returns the text value of the element at the current cursor + * position and reads the corresponding end element. + * + * @param reader The XML reader. + * @return The element's text value. + */ + protected String parseText(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + String value = getElementText(reader); + + if (!isEndElement(reader, name)) + syntaxError(reader); + + scan(reader); // Consume the end element + + return value; + } + + // + // Lexical helpers + // + + protected static String getElementText(XMLStreamReader reader) { + try { + return reader.getElementText(); + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + } + + protected static boolean + isEndElement(XMLStreamReader reader, String localName) { + return reader.isEndElement() + && reader.getLocalName().equals(localName); + } + + protected static boolean + isStartElement(XMLStreamReader reader, String localName) { + return reader.isStartElement() + && reader.getLocalName().equals(localName); + } + + // Scan ahead to the next token, skipping whitespace + protected static void scan(XMLStreamReader reader) { + assert !reader.isWhiteSpace(); // current should never be white + try { + do { + reader.next(); + } + while (reader.isWhiteSpace()); // Ignore whitespace + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + } + + // Scan ahead to the end element that matches the current start element. + // Note: function returns cursor located at matching end element. + protected static void scanEnd(XMLStreamReader reader) { + assert reader.isStartElement(); + + String name = reader.getLocalName(); + + while (true) { + scan(reader); + + switch (reader.getEventType()) { + case XMLStreamConstants.CHARACTERS: + continue; + + case XMLStreamConstants.START_ELEMENT: + scanEnd(reader); + continue; + + case XMLStreamConstants.END_ELEMENT: + if (!reader.getLocalName().equals(name)) + syntaxError(reader); + return; + + default: + syntaxError(reader); + } + } + } + + // Scan ahead until the next start tag. + protected static void scanTag(XMLStreamReader reader) { + try { + reader.nextTag(); + } + catch (XMLStreamException e) { + throw new RuntimeException(e.getMessage(), e); + } + } + + // Raises a Syntax error runtime exception + protected static void syntaxError(XMLStreamReader reader) { + Location location = reader.getLocation(); + String where = location.toString(); + String message = String.format("Syntax error @ %s", where); + throw new RuntimeException(message); + } +} diff --git a/splunk/src/main/java/com/splunk/BaseService.java b/splunk/src/main/java/com/splunk/BaseService.java new file mode 100644 index 00000000..d311b13e --- /dev/null +++ b/splunk/src/main/java/com/splunk/BaseService.java @@ -0,0 +1,40 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * Contains functionality common to Splunk Enterprise and Splunk Storm. + * + * This class is an implementation detail and is therefore SDK-private. + */ +abstract class BaseService extends HttpService { + protected BaseService() { + super(); + } + + protected BaseService(String host) { + super(host); + } + + protected BaseService(String host, int port) { + super(host, port); + } + + protected BaseService(String host, int port, String scheme) { + super(host, port, scheme); + } +} diff --git a/splunk/src/main/java/com/splunk/BooleanComparison.java b/splunk/src/main/java/com/splunk/BooleanComparison.java new file mode 100644 index 00000000..8751db96 --- /dev/null +++ b/splunk/src/main/java/com/splunk/BooleanComparison.java @@ -0,0 +1,34 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * Comparisons on boolean valued fields. + */ +public enum BooleanComparison { + IS_NULL { + public String toString() { return "isNull"; } + }, + IS_NOT_NULL { + public String toString() { return "isNotNull"; } + }, + EQUALS { + public String toString() { return "="; } + }, + IS { + public String toString() { return "is"; } + } +} diff --git a/splunk/src/main/java/com/splunk/BooleanPivotColumnSplit.java b/splunk/src/main/java/com/splunk/BooleanPivotColumnSplit.java new file mode 100644 index 00000000..66b096dd --- /dev/null +++ b/splunk/src/main/java/com/splunk/BooleanPivotColumnSplit.java @@ -0,0 +1,42 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; + +/** + * Represents a column split on a boolean valued field in a pivot. + */ +public class BooleanPivotColumnSplit extends PivotColumnSplit { + private final String trueLabel, falseLabel; + + BooleanPivotColumnSplit(DataModelObject owner, String fieldName, String trueLabel, String falseLabel) { + super(owner, fieldName); + this.trueLabel = trueLabel; + this.falseLabel = falseLabel; + } + + @Override + JsonObject toJson() { + JsonObject root = new JsonObject(); + addCommonFields(root); + + root.addProperty("trueLabel", trueLabel); + root.addProperty("falseLabel", falseLabel); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/BooleanPivotFilter.java b/splunk/src/main/java/com/splunk/BooleanPivotFilter.java new file mode 100644 index 00000000..3e08d6c0 --- /dev/null +++ b/splunk/src/main/java/com/splunk/BooleanPivotFilter.java @@ -0,0 +1,54 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Represents a filter on a boolean valued field in a pivot. + */ +public class BooleanPivotFilter extends PivotFilter { + private final BooleanComparison comparison; + private final boolean comparisonValue; + + BooleanPivotFilter(DataModelObject dataModelObject, String fieldName, + BooleanComparison comparison, boolean comparisonValue) { + super(dataModelObject, fieldName); + if (dataModelObject.getField(fieldName).getType() != FieldType.BOOLEAN) { + throw new IllegalArgumentException("Field " + fieldName + " on the data model object was of type " + + dataModelObject.getField(fieldName).getType().toString() + ", expected boolean."); + } + this.comparison = comparison; + this.comparisonValue = comparisonValue; + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + JsonObject filterRule = new JsonObject(); + filterRule.add("comparator", new JsonPrimitive(this.comparison.toString())); + filterRule.add("compareTo", new JsonPrimitive(this.comparisonValue)); + + root.add("rule", filterRule); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/BooleanPivotRowSplit.java b/splunk/src/main/java/com/splunk/BooleanPivotRowSplit.java new file mode 100644 index 00000000..d68df895 --- /dev/null +++ b/splunk/src/main/java/com/splunk/BooleanPivotRowSplit.java @@ -0,0 +1,50 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Represents a row split on a boolean valued field in a pivot. + */ +public class BooleanPivotRowSplit extends PivotRowSplit { + private final String falseDisplayValue; + private final String trueDisplayValue; + + BooleanPivotRowSplit(DataModelObject dataModelObject, String field, String label, + String trueDisplayValue, String falseDisplayValue) { + super(dataModelObject, field, label); + this.trueDisplayValue = trueDisplayValue; + this.falseDisplayValue = falseDisplayValue; + } + + public String getTrueDisplayValue() { return this.trueDisplayValue; } + public String getFalseDisplayValue() { return this.falseDisplayValue; } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + root.add("trueLabel", new JsonPrimitive(this.trueDisplayValue)); + root.add("falseLabel", new JsonPrimitive(this.falseDisplayValue)); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/CollectionArgs.java b/splunk/src/main/java/com/splunk/CollectionArgs.java new file mode 100644 index 00000000..25fd35aa --- /dev/null +++ b/splunk/src/main/java/com/splunk/CollectionArgs.java @@ -0,0 +1,177 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code CollectionArgs} class contains arguments for retrieving and + * listing entities from a collection, such as the number of entities to return + * and how to sort them. + */ +public class CollectionArgs extends Args { + + /** + * Indicates whether to sort entries in ascending or descending order. + */ + public static enum SortDirection { + /** Sort entries in ascending order. */ + ASC("asc"), + /** Sort entries in descending order. */ + DESC("desc"); + + private String value; + + private SortDirection(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Indicates the sorting mode for entries. + */ + public static enum SortMode { + /** + * If all values of the field are numbers, collate numerically. + * Otherwise, collate alphabetically. + */ + AUTO("auto"), + /** Collate alphabetically. */ + ALPHA("alpha"), + /** Collate alphabetically, case-sensitive. */ + ALPHA_CASE("alpha_case"), + /** Collate numerically. */ + NUM("num"); + + private String value; + + private SortMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public CollectionArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the app context in which to list the collection. + * + * @param app + * The app context in which to list the collection. A {@code null} value indicates no app context, and a value of {@code "-"} indicates an app wildcard. + */ + public void setApp(String app) { + this.put("app", app); + } + + /** + * Sets the owner context in which to list the collection. + * + * @param owner + * The owner context in which to list the collection. A value of {@code "-"} indicates a wildcard, and a {@code null} value indicates no owner context. + */ + public void setOwner(String owner) { + this.put("owner", owner); + } + + /** + * Sets the sharing context in which to list the collection. + * + * @param sharing + * The sharing context in which to list the collection. Valid values are "user", "app", "global", and "system". + */ + public void setSharing(String sharing) { + this.put("sharing", sharing); + } + + /** + * Sets the maximum number of entries to return. + * + * @param count + * The maximum number of entries to return. To return all entries, specify 0. + */ + public void setCount(int count) { + this.put("count", count); + } + + /** + * Sets the index of the first entry to return. + * + * @param offset + * The index of the first entry to return. + */ + public void setOffset(int offset) { + this.put("offset", offset); + } + + /** + * Sets a search query to filter the response. The response matches field values against the search query. For example, "foo" matches any object that has "foo" as a substring in a field, and "field_name=field_value" restricts the match to a single field. + * + * @param search + * A search query to filter the response. + */ + public void setSearch(String search) { + this.put("search", search); + } + + /** + * Sets the direction to sort entries. + * + * @param sortDirection + * The sorting order--ascending or descending. + */ + public void setSortDirection(SortDirection sortDirection) { + this.put("sort_dir", sortDirection); + } + + /** + * Sets the field to use for sorting. + * + * @param sortKey + * The field to sort by. + */ + public void setSortKey(String sortKey) { + this.put("sort_key", sortKey); + } + + /** + * Sets the mode to use for sorting. + * + * @param sortMode + * The collating sequence for sorting entries. + */ + public void setSortMode(SortMode sortMode) { + this.put("sort_mode", sortMode); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk-sdk/com/splunk/sdk/Command.java b/splunk/src/main/java/com/splunk/Command.java similarity index 76% rename from splunk-sdk/com/splunk/sdk/Command.java rename to splunk/src/main/java/com/splunk/Command.java index 2772b2b2..4dbd39b6 100644 --- a/splunk-sdk/com/splunk/sdk/Command.java +++ b/splunk/src/main/java/com/splunk/Command.java @@ -14,7 +14,7 @@ * under the License. */ -package com.splunk.sdk; +package com.splunk; import java.io.BufferedReader; import java.io.File; @@ -23,7 +23,6 @@ import java.io.IOException; import java.util.ArrayList; import java.util.HashMap; -import java.lang.reflect.*; import org.apache.commons.cli.CommandLine; import org.apache.commons.cli.CommandLineParser; import org.apache.commons.cli.HelpFormatter; @@ -33,7 +32,11 @@ import org.apache.commons.cli.ParseException; import org.apache.commons.cli.PosixParser; -// Processes and capture command options and arguments +/** + * This class serves as an example and is unsupported. + * + * Processes and capture command options and arguments + */ public class Command { private String appName; private Options rules = new Options(); @@ -44,16 +47,16 @@ public class Command { // The parsed command line options (flags) public HashMap<String, Object> opts = new HashMap<String, Object>(); - // Option fields - public String app = null; + // Whether or not this is a help request public Boolean help = false; - public String host = "localhost"; - public String owner = null; - public int port = 8089; - public String password = null; - public String scheme = "https"; - public String username = null; + public static final HashMap<String, Object> defaultValues = new HashMap<String, Object>(); + { + defaultValues.put("scheme", "https"); + defaultValues.put("host", "localhost"); + defaultValues.put("port", 8089); + } + Command(String appName) { this.appName = appName; } @@ -76,6 +79,7 @@ public Options getRules() { } // Initialize with default Splunk command options. + @SuppressWarnings("static-access") // OptionBuilder API requires this public Command init() { rules.addOption("h", "help", false, "Display this help message"); rules.addOption(null, "host", true, "Host name (default localhost)"); @@ -89,6 +93,8 @@ public Command init() { rules.addOption(null, "password", true, "Password to login with"); rules.addOption(null, "app", true, "App/namespace context"); rules.addOption(null, "owner", true, "Owner/user context"); + // This is here only for compatibility with the JavaScript SDK's .splunkrc. + rules.addOption(null, "version", true, "Version (irrelevant for Java)"); return this; } @@ -97,6 +103,7 @@ public Command addRule(String name, String description) { return this; } + @SuppressWarnings("static-access") // OptionBuilder API requires this public Command addRule(String name, Class argType, String description) { rules.addOption( OptionBuilder @@ -110,28 +117,36 @@ public Command addRule(String name, Class argType, String description) { // Load a file of options and arguments public Command load(String path) { - FileReader fileReader; + ArrayList<String> argList = new ArrayList<String>(); + try { - fileReader = new FileReader(path); - } - catch (FileNotFoundException e) { return this; } - - ArrayList<String> argList = new ArrayList<String>(4); - BufferedReader reader = new BufferedReader(fileReader); - while (true) { - String line; + FileReader fileReader = new FileReader(path); try { - line = reader.readLine(); + BufferedReader reader = new BufferedReader(fileReader); + while (true) { + String line; + line = reader.readLine(); + if (line == null) + break; + if (line.startsWith("#")) + continue; + line = line.trim(); + if (line.length() == 0) + continue; + if (!line.startsWith("-")) + line = "--" + line; + argList.add(line); + } } - catch (IOException e) { return this; } - if (line == null) break; - if (line.startsWith("#")) continue; - line = line.trim(); - if (line.length() == 0) continue; - if (!line.startsWith("-")) - line = "--" + line; - argList.add(line); + finally { + fileReader.close(); + } + } + catch (IOException e) { + error(e.getMessage()); + return this; } + parse(argList.toArray(new String[argList.size()])); return this; } @@ -153,7 +168,7 @@ public Command parse(String[] argv) { for (Option option : cmdline.getOptions()) { String name = option.getLongOpt(); Object value = option.getValue(); - + // Figure out the type of the option and convert the value. if (!option.hasArg()) { // If it has no arg, then its implicitly boolean and presence @@ -180,12 +195,12 @@ else if (type == Integer.class) { // corresponding option value in order to provide simplified // access to command options. try { - Field field = this.getClass().getField(name); + java.lang.reflect.Field field = this.getClass().getField(name); field.set(this, value); } catch (NoSuchFieldException e) { continue; } catch (IllegalAccessException e) { - throw new RuntimeException(e.getMessage()); + throw new RuntimeException(e.getMessage(), e); } } @@ -221,8 +236,8 @@ public static Command splunk(String appName) { // Load the default options file (.splunkrc) if it exists public Command splunkrc() { - String home = System.getProperty("user.home"); - load(home + File.separator + ".splunkrc"); + this.opts.putAll(defaultValues); + load(System.getProperty("user.home") + File.separator + ".splunkrc"); return this; } } diff --git a/splunk/com/splunk/ConfCollection.java b/splunk/src/main/java/com/splunk/ConfCollection.java similarity index 52% rename from splunk/com/splunk/ConfCollection.java rename to splunk/src/main/java/com/splunk/ConfCollection.java index 04ecc704..cc2cbf8d 100644 --- a/splunk/com/splunk/ConfCollection.java +++ b/splunk/src/main/java/com/splunk/ConfCollection.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -19,7 +19,8 @@ import java.util.Map; /** - * Representation of a collection of configurations. + * The {@code ConfCollection} class represents a collection of configuration + * files. */ public class ConfCollection extends ResourceCollection<EntityCollection<Entity>> @@ -27,28 +28,40 @@ public class ConfCollection /** * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. */ ConfCollection(Service service) { super(service, "properties", EntityCollection.class); } /** - * Creates a config. + * Class constructor. * - * @param name The new config name. - * @return The new config. + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + */ + ConfCollection(Service service, Args args) { + super(service, "properties", EntityCollection.class, args); + } + + /** + * Creates a new stanza in the current configuration file. + * + * @param name The name of the stanza to create. + * @return The name of the new stanza. */ public EntityCollection<Entity> create(String name) { return create(name, null); } /** - * Creates a new config. + * Creates a new stanza in the current configuration file with attributes. * - * @param name The new config name. - * @param args Optional arguments. - * @return the new config. + * @param name The name of the stanza to create. + * @param args Optional. A set of attributes as key-value pairs to put in + * the new stanza. + * @return The name of the new stanza. */ public EntityCollection<Entity> create(String name, Map args) { args = Args.create(args).add("__conf", name); @@ -56,12 +69,13 @@ public EntityCollection<Entity> create(String name, Map args) { invalidate(); return get(name); } - + /** - * Returns This config's endpoint path. + * Returns the endpoint path for this configuration stanza. * - * @param entry The atom representation of this entry. - * @return This config's endpoint path. + * @param entry The {@code AtomEntry} representation of this entry. + * @return This stanza's endpoint path in the format + * "/servicesNS/{user}/{app}/configs/conf-{file}/{stanza}". */ @Override protected String itemPath(AtomEntry entry) { return String.format("configs/conf-%s", entry.title); diff --git a/splunk/src/main/java/com/splunk/DataModel.java b/splunk/src/main/java/com/splunk/DataModel.java new file mode 100644 index 00000000..ce42f6f9 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModel.java @@ -0,0 +1,302 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import com.google.gson.*; + +import java.util.Collection; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; + +/** + * DataModel represents a data model on the server. Data models contain + * data model objects, which specify structured views on Splunk data. + */ +public class DataModel extends Entity { + private final static JsonParser jsonParser = new JsonParser(); + private final static Gson gson = new Gson(); + + private static final String ACCELERATION_LABEL = "acceleration"; + private static final String MODEL_NAME_LABEL = "modelName"; + private static final String DISPLAY_NAME_LABEL = "displayName"; + private static final String DESCRIPTION_LABEL = "description"; + private static final String RAW_JSON_LABEL = "description"; // Yes, this is insane. + + // Human readable description, as opposed to the raw JSON, which is also called 'description' + private String description; + + private Map<String, DataModelObject> objects; + private boolean accelerationEnabled; + private String earliestAcceleratedTime; + private String accelerationCronSchedule; + private boolean manualRebuilds; + + DataModel(Service service, String path) { + super(service, path); + // The data provided by the collection is incomplete. Go ahead and refresh so we don't + // have to worry about it. + this.refresh(); + } + + /** + * Returns whether there is an object of the given name in this data model. + * + * @param name Name of the object to check for. + * @return true if there is an object with that name; false otherwise. + */ + public boolean containsObject(String name) { + return this.objects.containsKey(name); + } + + /** + * Retrieve an object by name from this data model. + * + * @param name Name of the object to retrieve. + * @return a DataModelObject if there is such an object; null otherwise. + */ + public DataModelObject getObject(String name) { + return this.objects.get(name); + } + + /** + * @return a collection of all objects in this data model. + */ + public Collection<DataModelObject> getObjects() { + return Collections.unmodifiableCollection(objects.values()); + } + + /** + * Returns the tsidx namespace which holds global acceleration events for this + * data model. The namespace will be returned whether acceleration is enabled + * or not. + * + * @return The tsidx namespace for global acceleration of this data model. + */ + public String getAccelerationNamespace() { + // For the moment, the acceleration namespace for global acceleration of + // data models is the name of the data model. + return getName(); + } + + /** + * @return whether global acceleration is enabled for this data model. + */ + public boolean isAccelerated() { + return this.accelerationEnabled; + } + + /** + * @return A human readable description of this data model. + */ + public String getDescription() { + return this.description; + } + + /** + * @return The raw JSON describing this data model and its objects. + */ + public String getRawJson() { + return getString(RAW_JSON_LABEL); + } + + /** + * @return the human readable name of this data model. + */ + public String getDisplayName() { + return getString(DISPLAY_NAME_LABEL); + } + + @Override + Entity load(AtomObject value) { + Entity result = super.load(value); + // After loading the Atom entity as we would for any other Splunk entity, + // we have to parse the JSON description of the data model and its acceleration + // status. + parseDescription(getString(RAW_JSON_LABEL)); + parseAcceleration(getString(ACCELERATION_LABEL)); + return result; + } + + /** + * Parse the JSON returned from splunkd describing this data model. + * + * This method writes the results into fields of this object. + * + * @param input a String containing JSON. + */ + private void parseDescription(String input) { + objects = new HashMap<String, DataModelObject>(); + + JsonElement rootElement = jsonParser.parse(input); + + for (Entry<String, JsonElement> entry : rootElement.getAsJsonObject().entrySet()) { + if (entry.getKey().equals(MODEL_NAME_LABEL)) { + content.put(MODEL_NAME_LABEL, entry.getValue().getAsString()); + } else if (entry.getKey().equals(DISPLAY_NAME_LABEL)) { + content.put(DISPLAY_NAME_LABEL, entry.getValue().getAsString()); + } else if (entry.getKey().equals(DESCRIPTION_LABEL)) { + description = entry.getValue().getAsString(); + } else if (entry.getKey().equals("objects")) { + JsonArray objectArray = entry.getValue().getAsJsonArray(); + for (JsonElement object : objectArray) { + DataModelObject dmo = DataModelObject.parse(this, object); + objects.put(dmo.getName(), dmo); + } + } else { + // Allow new keys without complaining + } + } + } + + /** + * Parse the acceleration description from splunkd of this data model. + * + * This method writes the results into fields of this object. + * + * @param input a string containing JSON. + */ + private void parseAcceleration(String input) { + JsonElement rootElement = jsonParser.parse(input); + + for (Entry<String, JsonElement> entry : rootElement. getAsJsonObject().entrySet()) { + if (entry.getKey().equals("enabled")) { + // API is broken in 6.1. It returns 1 instead of true (but does return false). + if (((JsonPrimitive)entry.getValue()).isBoolean()) { + accelerationEnabled = entry.getValue().getAsBoolean(); + } else if (((JsonPrimitive)entry.getValue()).isNumber()) { + accelerationEnabled = entry.getValue().getAsInt() != 0; + } else { + throw new RuntimeException("splunkd returned an unknown value " + entry.getValue().toString() + + " for whether acceleration is enabled."); + } + } else if (entry.getKey().equals("earliest_time")) { + earliestAcceleratedTime = entry.getValue().getAsString(); + } else if (entry.getKey().equals("cron_schedule")) { + accelerationCronSchedule = entry.getValue().getAsString(); + } else if (entry.getKey().equals("manual_rebuilds")) { + if (((JsonPrimitive)entry.getValue()).isBoolean()) { + manualRebuilds = entry.getValue().getAsBoolean(); + } else if (((JsonPrimitive)entry.getValue()).isNumber()) { + manualRebuilds = entry.getValue().getAsInt() != 0; + } else { + throw new RuntimeException("splunkd returned an unknown value " + entry.getValue().toString() + + " for whether manual_rebuilds is enabled."); + } + } else { + // Allow new keys without complaining + } + } + } + + /** + * Enable or disable global acceleration on this data model. + * + * @param enabled true enabled, false disables. + */ + public void setAcceleration(boolean enabled) { + this.accelerationEnabled = enabled; + toUpdate.put("enabled", enabled); + } + + /** + * Return the earliest time of the window over which the data model is accelerated. + * + * Times are represented relative to now, given by a minus sign, a number, and a + * suffix indicating the time unit (e.g., "-2mon", "-1day"). + * + * @return a string representing the earliest accelerated time. + */ + public String getEarliestAcceleratedTime() { + return earliestAcceleratedTime; + } + + /** + * Set the size of the window (from the specified earliest time to now) over + * which the data model should be accelerated. + * + * Times are represented relative to now, given by a minus sign, a number, and a + * suffix indicating the time unit (e.g., "-2mon", "-1day"). + * + * @param earliestAcceleratedTime a string specifying a time. + */ + public void setEarliestAcceleratedTime(String earliestAcceleratedTime) { + this.earliestAcceleratedTime = earliestAcceleratedTime; + toUpdate.put("earliest_time", earliestAcceleratedTime); + } + + /** + * Return the cron schedule on which the cached data for acceleration should be + * updated. + * + * @return a string containing a crontab style schedule specification. + */ + public String getAccelerationCronSchedule() { + return accelerationCronSchedule; + } + + /** + * Set the cron schedule on which the cached data for the acceleration should + * be updated. + * + * @param accelerationCronSchedule a crontab style schedule to use. + */ + public void setAccelerationCronSchedule(String accelerationCronSchedule) { + this.accelerationCronSchedule = accelerationCronSchedule; + toUpdate.put("cron_schedule", accelerationCronSchedule); + } + + /** + * This setting prevents outdated summaries from being rebuilt by the + * 'summarize' command. + * + * @return whether manual rebuilds are enabled for this data model. + */ + public boolean isManualRebuilds() { + return this.manualRebuilds; + } + + /** + * Enable or disable manual rebuilds on this data model. + * + * @param enabled true enabled, false disables. + */ + public void setManualRebuilds(boolean enabled) { + this.manualRebuilds = enabled; + toUpdate.put("manual_rebuilds", enabled); + } + + @Override + public void update() { + // We have to do some munging on the acceleration fields to pass them as JSON + // to the server. + Map<String, Object> accelerationMap = new HashMap<String, Object>(); + for (String key : new String[] {"enabled", "earliest_time", "cron_schedule", "manual_rebuilds"}) { + if (toUpdate.containsKey(key)) { + accelerationMap.put(key, toUpdate.get(key)); + toUpdate.remove(key); + } + } + + if (!accelerationMap.isEmpty()) { + toUpdate.put("acceleration", gson.toJson(accelerationMap)); + } + + // Now update like we would any other entity. + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelArgs.java b/splunk/src/main/java/com/splunk/DataModelArgs.java new file mode 100644 index 00000000..a9d0fb7a --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelArgs.java @@ -0,0 +1,28 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * Class representing arguments to creating a data model. + * + * At the moment this is a very minimal class, supporting only the + * description field for writing raw JSON to the server. + */ +public class DataModelArgs extends Args { + public String getRawJsonDescription() { return (String) get("description"); } + public void setRawJsonDescription(String rawJson) { put("description", rawJson); } +} diff --git a/splunk/src/main/java/com/splunk/DataModelCalculation.java b/splunk/src/main/java/com/splunk/DataModelCalculation.java new file mode 100644 index 00000000..499c0584 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelCalculation.java @@ -0,0 +1,166 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +import java.util.*; +import java.util.Map.Entry; + +/** + * Abstract class specifying a calculation on a data model object. + */ +public abstract class DataModelCalculation { + private final String[] ownerLineage; + private final String calculationID; + private final Map<String, DataModelField> generatedFields; + private final String comment; + private final boolean editable; + + protected DataModelCalculation(String[] ownerLineage, String calculationID, + Map<String, DataModelField> generatedFields, String comment, boolean editable) { + this.ownerLineage = ownerLineage; + this.calculationID = calculationID; + this.generatedFields = generatedFields; + this.comment = comment; + this.editable = editable; + } + + /** + * @return the ID of this calculation. + */ + public String getCalculationID() { return this.calculationID; } + + /** + * @param fieldName Name of the field to fetch. + * @return whether this calculation generated a field of the given name. + */ + public boolean containsGeneratedField(String fieldName) { + return this.generatedFields.containsKey(fieldName); + } + + /** + * @return a collection of the fields this calculation generates. + */ + public Collection<DataModelField> getGeneratedFields() { + return Collections.unmodifiableCollection(this.generatedFields.values()); + } + + /** + * @param fieldName Name of the field to fetch. + * @return a DataModelField object. + */ + public DataModelField getGeneratedField(String fieldName) { return this.generatedFields.get(fieldName); } + + /** + * @return the comment on this calculation (if one is specified) or null. + */ + public String getComment() { return this.comment; } + + /** + * Returns the name of the object on which this calculation is defined. + * That need not be the one you accessed it from, as it may be inherited from + * another data model object. + * + * @return The name of the object on which this calculation is defined. + */ + public String getOwner() { return this.ownerLineage[this.ownerLineage.length-1]; } + + /** + * Return the lineage of the data model object on which this calculation is + * defined, starting with the most remote ancestor and ending with the data model object + * on which this calculation is defined. + * + * @return an array of the names of data model objects. + */ + public String[] getLineage() { return this.ownerLineage; } + + /** + * @return whether this calculation can be edited, or it is a system defined calculation. + */ + public boolean isEditable() { return this.editable; } + + static DataModelCalculation parse(JsonElement json) { + String type = null; + String calculationId = null; + List<LookupDataModelCalculation.LookupFieldMapping> lookupInputs = + new ArrayList<LookupDataModelCalculation.LookupFieldMapping>(); + String comment = null; + String expression = null; + String lookupName = null; + String lookupField = null; // We need lookupField and inputField to handle the case in Splunk 6.0 + String inputField = null; // where there is only one entry, and it's not in an array. + String[] owner = new String[0]; // Should always be set below + boolean editable = false; + Map<String, DataModelField> outputFields = new HashMap<String, DataModelField>(); + + String key; + for (Entry<String, JsonElement> entry : json.getAsJsonObject().entrySet()) { + key = entry.getKey(); + if (key.equals("calculationType")) { + type = entry.getValue().getAsString().toLowerCase(); + } else if (key.equals("calculationID")) { + calculationId = entry.getValue().getAsString(); + } else if (key.equals("outputFields")) { + for (JsonElement e : entry.getValue().getAsJsonArray()) { + DataModelField f = DataModelField.parse(e.getAsJsonObject()); + outputFields.put(f.getName(), f); + } + } else if (key.equals("lookupInputs")) { + for (JsonElement lookupInputJsonElement : entry.getValue().getAsJsonArray()) { + if (!(lookupInputJsonElement instanceof JsonObject)) { + throw new RuntimeException("Expected a JSON object for lookupInput entry."); + } + JsonObject lookupInputJson = (JsonObject)lookupInputJsonElement; + LookupDataModelCalculation.LookupFieldMapping mapping = new LookupDataModelCalculation.LookupFieldMapping(); + mapping.inputField = lookupInputJson.get("inputField").getAsString(); + mapping.lookupField = lookupInputJson.get("lookupField").getAsString(); + lookupInputs.add(mapping); + } + } else if (key.equals("inputField")) { + inputField = entry.getValue().getAsString(); + } else if (key.equals("comment")) { + comment = entry.getValue().getAsString(); + } else if (key.equals("expression")) { + expression = entry.getValue().getAsString(); + } else if (key.equals("lookupName")) { + lookupName = entry.getValue().getAsString(); + } else if (key.equals("lookupField")) { + lookupField = entry.getValue().getAsString(); + } else if (key.equals("owner")) { + owner = entry.getValue().getAsString().split("\\."); + } else if (key.equals("editable")) { + editable = entry.getValue().getAsBoolean(); + } + } + + DataModelCalculation c; + if (type.equals("lookup")) { + c = new LookupDataModelCalculation(owner, calculationId, outputFields, comment, editable, lookupName, lookupInputs); + } else if (type.equals("geoip")) { + c = new GeoIPDataModelCalculation(owner, calculationId, outputFields, comment, editable, inputField); + } else if (type.equals("eval")) { + c = new EvalDataModelCalculation(owner, calculationId, outputFields, comment, editable, expression); + } else if (type.equals("rex")) { + c = new RegexpDataModelCalculation(owner, calculationId, outputFields, comment, editable, inputField, expression); + } else { + throw new IllegalStateException("Unknown calculation type: " + type); + } + + return c; + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelCollection.java b/splunk/src/main/java/com/splunk/DataModelCollection.java new file mode 100644 index 00000000..dfad8544 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelCollection.java @@ -0,0 +1,54 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Map; + +public class DataModelCollection extends EntityCollection<DataModel> { + DataModelCollection(Service service) { + super(service, "datamodel/model", DataModel.class); + this.refreshArgs.put("concise", "0"); + } + + /** + * Creates an entity in this collection. + * + * @param name The name of the entity. + * @return The entity. + */ + @Override + public DataModel create(String name) { + return create(name, (Map)null); + } + + /** + * Creates an entity in this collection. + * + * @param name The name of the entity. + * @param args Arguments for creating the entity. + * @return The entity. + */ + @Override + public DataModel create(String name, Map args) { + Args revisedArgs = Args.create(args); + // concise=0 forces the server to return all details of the newly + // created data model. + if (!args.containsKey("concise")) { + revisedArgs = revisedArgs.add("concise", "0"); + } + return super.create(name, revisedArgs); + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelConstraint.java b/splunk/src/main/java/com/splunk/DataModelConstraint.java new file mode 100644 index 00000000..7f7126b4 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelConstraint.java @@ -0,0 +1,64 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +import java.util.Map.Entry; + +/** + * Represents a constraint on a data model object or a field on a data model object. + */ +public class DataModelConstraint { + private String owner; + private String query; + + private DataModelConstraint() { + } + + /** + * @return The Splunk search query this constraint specifies. + */ + public String getQuery() { return this.query; } + + + /** + * @return The DataModelObject that owns this field. + */ + public String getOwner() { return this.owner; } + + /** + * Parse a DataModelConstraint object out of JSON. + * + * @param json JsonElement to parse. + * @return a DataModelConstraint object. + */ + static DataModelConstraint parse(JsonElement json) { + JsonObject jsonObject = json.getAsJsonObject(); + DataModelConstraint constraint = new DataModelConstraint(); + + for (Entry<String, JsonElement> e : jsonObject.entrySet()) { + if (e.getKey().equals("owner")) { + constraint.owner = e.getValue().getAsString(); + } else if (e.getKey().equals("search")) { + constraint.query = e.getValue().getAsString(); + } + } + + return constraint; + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelField.java b/splunk/src/main/java/com/splunk/DataModelField.java new file mode 100644 index 00000000..d83dca1c --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelField.java @@ -0,0 +1,140 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; + +import java.util.Map.Entry; + +/** + * Represents a field of a data model object. + */ +public class DataModelField { + private String[] ownerLineage; + private String name; + private FieldType type; + private boolean required; + private boolean multivalued; + private boolean hidden; + private String displayName; + private String comment; + private boolean editable; + private String fieldSearch; + + private DataModelField() {} + + /** + * @return a search query fragment for this field. + */ + public String getFieldSearch() { return this.fieldSearch; } + + /** + * @return The name of this field. + */ + public String getName() { return this.name; }; + + /** + * Return the name of the data model object on which this field is defined. That need not + * be the data model object you accessed it from. It can be one of its ancestors. + * + * @return The name of the DataModelObject that owns this field. + */ + public String getOwnerName() { return this.ownerLineage[this.ownerLineage.length-1]; } + + /** + * Return the lineage of the data model object on which this field is defined. That need not + * be the data model object you accessed it from. It can be one of its ancestors. + * + * @return An array of names of DataModelObjects representing the lineage of this field's owner. + */ + public String[] getOwnerLineage() { return this.ownerLineage; } + + /** + * @return The type of this field. + */ + public FieldType getType() { return this.type; } + + /** + * Some fields are part of system objects such as BaseEvent or are part + * of the structure of the object, such as a field with the same name + * as the object. Those fields cannot be edited. This method returns + * whether the field is one of these protected fields. + * + * @return whether this field can be edited. + */ + public boolean isEditable() { return editable; } + + /** + * @return whether this field is required on events in the object. + */ + public boolean isRequired() { return required; } + + /** + * @return whether this field is can be multivalued. + */ + public boolean isMultivalued() { return multivalued; } + + /** + * @return whether this field should be displayed in a data model UI. + */ + public boolean isHidden() { return hidden; } + + /** + * @return a human readable name for this field. + */ + public String getDisplayName() { return displayName; } + + /** + * @return a comment on this field (if there is one), or null. + */ + public String getComment() { return comment; } + + public static DataModelField parse(JsonElement fieldJson) { + DataModelField field = new DataModelField(); + + for (Entry<String, JsonElement> entry : fieldJson.getAsJsonObject().entrySet()) { + if (entry.getKey().equals("fieldName")) { + field.name = entry.getValue().getAsString(); + } else if (entry.getKey().equals("owner")) { + field.ownerLineage = entry.getValue().getAsString().split("\\."); + } else if (entry.getKey().equals("type")) { + field.type = FieldType.parseType(entry.getValue().getAsString()); + } else if (entry.getKey().equals("required")) { + field.required = entry.getValue().getAsBoolean(); + } else if (entry.getKey().equals("multivalue")) { + field.multivalued = entry.getValue().getAsBoolean(); + } else if (entry.getKey().equals("hidden")) { + field.hidden = entry.getValue().getAsBoolean(); + } else if (entry.getKey().equals("displayName")) { + field.displayName = entry.getValue().getAsString(); + } else if (entry.getKey().equals("comment")) { + //Before Splunk 7, comment value was just a string but now, its JSON ("comment": {"description": "The body of a message."}) + if(entry.getValue().isJsonObject()) { + field.comment = entry.getValue().getAsJsonObject().get("description").getAsString(); + } else { + field.comment = entry.getValue().getAsString(); + } + } else if (entry.getKey().equals("editable")) { + field.editable = entry.getValue().getAsBoolean(); + } else if (entry.getKey().equals("fieldSearch")) { + field.fieldSearch = entry.getValue().getAsString(); + } + } + + return field; + } +} + diff --git a/splunk/src/main/java/com/splunk/DataModelObject.java b/splunk/src/main/java/com/splunk/DataModelObject.java new file mode 100644 index 00000000..75c84d88 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelObject.java @@ -0,0 +1,394 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; + +import java.util.*; +import java.util.Map.Entry; + +/** + * DataModelObject represents one of the structured views in a data model. + */ +public class DataModelObject { + private DataModel model; + private String name; + private String[] lineage; + private String displayName; + private String parentName; + + private Map<String, DataModelField> autoextractedFields; + private Collection<DataModelConstraint> constraints; + private Map<String, DataModelCalculation> calculations; + + protected DataModelObject(DataModel model) { + this.model = model; + } + + /** + * Checks whether there is a field with the given name in this + * data model object. + * + * @param fieldName name of the field to check for. + * @return true if there is such a field; false otherwise. + */ + public boolean containsField(String fieldName) { + if (autoextractedFields.containsKey(fieldName)) { + return true; + } + for (DataModelCalculation c : calculations.values()) { + if (c.containsGeneratedField(fieldName)) { + return true; + } + } + return false; + } + + /** + * Local acceleration is tsidx acceleration of a data model object that is handled + * manually by a user. You create a job which generates an index, and then use that + * index in your pivots on the data model object. + * + * The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You + * would use it in another job by starting your search query with + * + * | tstats ... from sid={sid} | ... + * + * The tsidx index created by this job is deleted when the job is garbage collected + * by Splunk. + * + * It is the user's responsibility to manage this job, including cancelling it. + * + * @return a Job writing a tsidx index. + */ + public Job createLocalAccelerationJob() { + return createLocalAccelerationJob(null); + } + + /** + * Local acceleration is tsidx acceleration of a data model object that is handled + * manually by a user. You create a job which generates an index, and then use that + * index in your pivots on the data model object. + * + * The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You + * would use it in another job by starting your search query with + * + * | tstats ... from sid={sid} | ... + * + * The tsidx index created by this job is deleted when the job is garbage collected + * by Splunk. + * + * It is the user's responsibility to manage this job, including cancelling it. + * + * @param earliestTime A time modifier (e.g., "-2w") setting the earliest time to index. + * @return a Job writing a tsidx index. + */ + public Job createLocalAccelerationJob(String earliestTime) { + String query = "| datamodel " + this.model.getName() + " " + + this.getName() + " search | tscollect"; + JobArgs args = new JobArgs(); + if (earliestTime != null) { + args.setEarliestTime(earliestTime); + } + return this.model.getService().search(query, args); + } + + /** + * Return the calculations done by this data model object to produce fields. + * + * Each calculation has a unique ID assigned to it by splunkd, which is the key + * in the returned map. For most purposes you will probably only want the values. + * + * @return a map of calculation IDs to DataModelCalculation objects. + */ + public Map<String, DataModelCalculation> getCalculations() { + return Collections.unmodifiableMap(this.calculations); + } + + /** + * Fetch a calculation by its unique ID. + * + * @param calculationId a splunkd assigned unique ID for this calculation. + * @return a DataModelCalculation object. + */ + public DataModelCalculation getCalculation(String calculationId) { + return this.calculations.get(calculationId); + } + + /** + * @return a collection of the constraints limiting events that will appear in this data model object. + */ + public Collection<DataModelConstraint> getConstraints() { + return Collections.unmodifiableCollection(this.constraints); + } + + /** + * Fetch the data model on which this object is defined. + * + * @return A DataModel instance containing this object. + */ + public DataModel getDataModel() { + return this.model; + } + + /** + * @return the human readable name of this data model object. + */ + public String getDisplayName() { + return this.displayName; + } + + /** + * Fetch a single field of a given name from this data model object. + * + * @param fieldName Name of the field to fetch. + * @return A DataModelField object, or null if there is no field of the given name. + */ + public DataModelField getField(String fieldName) { + if (autoextractedFields.containsKey(fieldName)) { + return autoextractedFields.get(fieldName); + } + for (DataModelCalculation c : this.calculations.values()) { + if (c.containsGeneratedField(fieldName)) { + return c.getGeneratedField(fieldName); + } + } + return null; + } + + /** + * Get a collection of objects specifying all the fields that were automatically extracted + * from events (as opposed to generated by calculations in a data model). + * + * @return a collection of DataModelField objects. + */ + public Collection<DataModelField> getAutoExtractedFields() { + return Collections.unmodifiableCollection(autoextractedFields.values()); + } + + /** + * Return all the fields, whether input or created by calculations. + * @return a collection of DataModelField objects. + */ + public Collection<DataModelField> getFields() { + Collection<DataModelField> fields = new ArrayList<DataModelField>(); + fields.addAll(this.autoextractedFields.values()); + for (DataModelCalculation c : this.calculations.values()) { + fields.addAll(c.getGeneratedFields()); + } + return fields; + } + + public String getQuery() { + return "| datamodel " + this.getDataModel().getName() + " " + this.getName() + " search"; + } + + /** + * @return Splunk's identifier for this data model object. + */ + public String getName() { return this.name; } + + /** + * Data model objects can inherit from other data model objects + * in the same data model (or from a couple of global base objects + * such as BaseEvent and BaseTransaction). The lineage is a list of + * data model object names tracing this inheritance, starting with the + * most remote ancestor and ending with this object. + * + * @return An array of names, starting with this object's name, followed by + * the names up the hierarchy. + */ + public String[] getLineage() { return this.lineage; } + + /** + * Returns the name of the parent of this object. + * + * @return a String giving the name. + */ + public String getParentName() { + return this.parentName; + } + + /** + * @return the data model object this one inherits from if it is a user defined data model object + * in the same data model; otherwise returns null (for example if the data model object inherits from BaseEvent + * or BaseTransaction). + */ + public DataModelObject getParent() { + return this.getDataModel().getObject(this.parentName); + } + + /** + * Create a PivotSpecification on this data model object. + * + * @return a PivotSpecification instance. + */ + public PivotSpecification createPivotSpecification() { + return new PivotSpecification(this); + } + + /** + * Start a job that fetches all the events of this data model object. + * + * @return a Job object. + */ + public Job runQuery() { + return runQuery("", null); + } + + /** + * Start a job that fetches all the events of this data model object. + * + * @param args arguments specifying behavior of the job. + * @return a Job object. + */ + public Job runQuery(JobArgs args) { + return runQuery("", args); + } + + /** + * Start a job that applies querySuffix to all the events in this data model object. + * + * @param querySuffix a search query, starting with a '|' that will be appended to the command to fetch + * the contents of this data model object (e.g., "| head 3"). + * @return a Job object. + */ + public Job runQuery(String querySuffix) { + return runQuery(querySuffix, null); + } + + /** + * Start a job that applies querySuffix to all the events in this data model object. + * + * @param querySuffix a search query, starting with a '|' that will be appended to the command to fetch + * the contents of this data model object (e.g., "| head 3"). + * @param args arguments to control the job. + * @return a Job object. + */ + public Job runQuery(String querySuffix, JobArgs args) { + return getDataModel().getService().search(getQuery() + querySuffix, args); + } + + /** + * Produce a data model object from a JSON dictionary specifying it plus a data model that contains it. + + * @param dataModel a DataModel instance that contains this data model object. + * @param object a JsonElement (as produced by Gson) specifying this data model object (usually one of + * the entries in the array of objects in the JSON description of the data model). + * @return a DataModelObject instance. + */ + static DataModelObject parse(DataModel dataModel, JsonElement object) { + String name = null; + String displayName = null; + String comment = null; + String[] lineage = new String[0]; + String parentName = null; + Map<String, DataModelField> fields = new HashMap<String, DataModelField>(); + Collection<String> children = new ArrayList<String>(); + Collection<DataModelConstraint> constraints = new ArrayList<DataModelConstraint>(); + Map<String, DataModelCalculation> calculations = new HashMap<String, DataModelCalculation>(); + + // Fields specific to objects inheriting directly from BaseSearch. + String baseSearch = null; + // Fields specific to objects inheriting directly from BaseTransaction + String transactionMaxPause = null; + String transactionMaxTimeSpan = null; + Collection<String> groupByFields = new ArrayList<String>(); + Collection<String> objectsToGroup = new ArrayList<String>(); + + for (Entry<String, JsonElement> entry : object.getAsJsonObject().entrySet()) { + if (entry.getKey().equals("objectName")) { + name = entry.getValue().getAsString(); + } else if (entry.getKey().equals("displayName")) { + displayName = entry.getValue().getAsString(); + } else if (entry.getKey().equals("lineage")) { + lineage = entry.getValue().getAsString().split("\\."); + } else if (entry.getKey().equals("parentName")) { + parentName = entry.getValue().getAsString(); + } else if (entry.getKey().equals("fields")) { + JsonArray fieldsJson = entry.getValue().getAsJsonArray(); + fields.clear(); + + for (JsonElement fieldJson : fieldsJson) { + DataModelField field = DataModelField.parse(fieldJson); + fields.put(field.getName(), field); + } + } else if (entry.getKey().equals("constraints")) { + JsonArray constraintsJson = entry.getValue().getAsJsonArray(); + + for (JsonElement constraintJson : constraintsJson) { + DataModelConstraint constraint = DataModelConstraint.parse(constraintJson); + constraints.add(constraint); + } + } else if (entry.getKey().equals("calculations")) { + calculations.clear(); + for (JsonElement cjson : entry.getValue().getAsJsonArray()) { + DataModelCalculation c = DataModelCalculation.parse(cjson); + String cid = c.getCalculationID(); + calculations.put(cid, c); + } + } else if (entry.getKey().equals("baseSearch")) { + baseSearch = entry.getValue().getAsString(); + } else if (entry.getKey().equals("transactionMaxPause")) { + transactionMaxPause = entry.getValue().getAsString(); + } else if (entry.getKey().equals("transactionMaxTimeSpan")) { + transactionMaxTimeSpan = entry.getValue().getAsString(); + } else if (entry.getKey().equals("groupByFields")) { + for (JsonElement e : entry.getValue().getAsJsonArray()) { + groupByFields.add(e.getAsString()); + } + } else if (entry.getKey().equals("objectsToGroup")) { + for (JsonElement e : entry.getValue().getAsJsonArray()) { + objectsToGroup.add(e.getAsString()); + } + } + } + + DataModelObject dmo; + // Create the right subclass of DataModelObject. + if (baseSearch != null) { + dmo = new DataModelSearch(dataModel); + } else if (transactionMaxPause != null) { + dmo = new DataModelTransaction(dataModel); + } else { + dmo = new DataModelObject(dataModel); + } + + // Set the fields common to all data model objects + dmo.name = name; + dmo.displayName = displayName; + dmo.lineage = lineage; + dmo.parentName = parentName; + dmo.autoextractedFields = fields; + dmo.constraints = constraints; + dmo.calculations = calculations; + + // Set the fields of particular types + if (baseSearch != null) { + ((DataModelSearch)dmo).baseSearch = baseSearch; + } else if (transactionMaxPause != null) { + ((DataModelTransaction)dmo).groupByFields = groupByFields; + ((DataModelTransaction)dmo).objectsToGroup = objectsToGroup; + ((DataModelTransaction)dmo).maxPause = transactionMaxPause; + ((DataModelTransaction)dmo).maxSpan = transactionMaxTimeSpan; + } else { + // Has no additional fields + } + + return dmo; + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelSearch.java b/splunk/src/main/java/com/splunk/DataModelSearch.java new file mode 100644 index 00000000..87f2e37f --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelSearch.java @@ -0,0 +1,39 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * DataModelSearch represents a data model object that directly wraps a Splunk search query. + * + * It appears only as a direct subobject of the BaseSearch built-in type. All its children + * appear as normal DataModelObject instances. DataModelSearch objects have one additional + * getter, <tt>getBaseSearch</tt>, which returns the underlying search which this object + * wraps. + */ +public class DataModelSearch extends DataModelObject { + protected String baseSearch; + + DataModelSearch(DataModel model) { + super(model); + } + + /** + * @return the search query wrapped by this data model object. + */ + public String getBaseSearch() { + return baseSearch; + } +} diff --git a/splunk/src/main/java/com/splunk/DataModelTransaction.java b/splunk/src/main/java/com/splunk/DataModelTransaction.java new file mode 100644 index 00000000..a95d07a0 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DataModelTransaction.java @@ -0,0 +1,66 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Collection; + +/** + * Represents a datamodel object that inherits directly from BaseTransaction, + * that is, an object that wraps a Splunk transaction. All children of this + * object will appears as standard DataModelObject instances. + */ +public class DataModelTransaction extends DataModelObject { + protected Collection<String> groupByFields; + protected Collection<String> objectsToGroup; + protected String maxSpan; + protected String maxPause; + + DataModelTransaction(DataModel dataModel) { + super(dataModel); + } + + /** + * @return the fields that will be used to group events into transactions. + * + * Contiguous events with identical values of the fields named in this collection + * will be grouped into transactions. + */ + public Collection<String> getGroupByFields() { return this.groupByFields; } + + /** + * @return the names of the data model objects that should be unioned and split into transactions. + */ + public Collection<String> getObjectsToGroup() { return this.objectsToGroup; } + + /** + * maxSpan is the maximum amount of time (in a Splunk defined format, such as <tt>"1m"</tt> + * for one minute or <tt>"20s"</tt> for twenty seconds) that a single transaction can span. + * When a transaction reaches this size, it is automatically ended and a new transaction + * begun. + * + * @return The maximum time that a transaction can span. + */ + public String getMaxSpan() { return this.maxSpan; } + + /** + * maxPause is the maximum amount of time between two events in a transaction, specified as a string + * such as <tt>"1m"</tt> for one minute or <tt>"20s"</tt> for twenty seconds. When a transaction + * has a gap of at least maxPause since its last even, it is ended and a new transaction begun. + * + * @return the maximum pause between events in a transaction. + */ + public String getMaxPause() { return this.maxPause; } +} diff --git a/splunk/src/main/java/com/splunk/DeploymentClient.java b/splunk/src/main/java/com/splunk/DeploymentClient.java new file mode 100644 index 00000000..b67e3a2b --- /dev/null +++ b/splunk/src/main/java/com/splunk/DeploymentClient.java @@ -0,0 +1,111 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code DeploymentClient} class represents a Splunk deployment client, + * providing access to deployment client configuration and status. + */ +public class DeploymentClient extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + DeploymentClient(Service service) { + super(service, "deployment/client"); + } + + /** + * Displays the action path. + * + * @param action The requested action. + * @return The action path. + */ + @Override protected String actionPath(String action) { + if (action.equals("edit")) + return path + "/deployment-client"; + return super.actionPath(action); + } + + /** Not supported for this endpoint. */ + @Override public void disable() { + throw new UnsupportedOperationException(); + } + + /** Not supported for this endpoint. */ + @Override public void enable() { + throw new UnsupportedOperationException(); + } + + /** + * Returns the list of server classes. + * + * @return The list of server classes, or {@code null} if not specified. + */ + public String [] getServerClasses() { + return getStringArray("serverClasses", null); + } + + /** + * Returns the target URI of the deployment server for this deployment + * client. + * + * @return The target URI of the deployment server in the + * format "server:port", or {@code null} if not specified. + */ + public String getTargetUri() { + return getString("targetUri", null); + } + + /** + * Reloads the deployment client from the configuration file. + */ + public void reload() { + service.get(path + "/deployment-client/Reload"); + invalidate(); + } + + /** + * Sets whether to enable or disable the deployment client. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * @see Entity#disable + * @see Entity#enable + * + * @param disabled {@code true} to disable the deployment client, + * {@code false} to enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the deployment server's target URI for this deployment client. The + * form of this URI is "deployment_server_uir:port". + * + * @param targetUri The target URI of the deployment server. + */ + public void setTargetUri(String targetUri) { + setCacheValue("targetUri", targetUri); + } +} + diff --git a/splunk/src/main/java/com/splunk/DeploymentServer.java b/splunk/src/main/java/com/splunk/DeploymentServer.java new file mode 100644 index 00000000..df1bb20b --- /dev/null +++ b/splunk/src/main/java/com/splunk/DeploymentServer.java @@ -0,0 +1,63 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code DeploymentServer} class represents a Splunk deployment server, + * and provides access to the configurations of all deployment servers. + */ +public class DeploymentServer extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The deployment server endpoint. + */ + DeploymentServer(Service service, String path) { + super(service, path); + } + + /** + * Returns inclusive criteria for determining deployment client access to + * this deployment server. + * + * @param index The index of the whitelist entry to return. + * @return A list of included client addresses, or {@code null} if not + * specified. + */ + public String getWhitelistByIndex(int index) { + return getString(String.format("whitelist.%d", index), null); + } + + /** + * Sets whether the deployment server is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * @see Entity#disable + * @see Entity#enable + * + * @param disabled {@code true} to disable the deployment client, + * {@code false} to enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } +} diff --git a/splunk/src/main/java/com/splunk/DeploymentServerClass.java b/splunk/src/main/java/com/splunk/DeploymentServerClass.java new file mode 100644 index 00000000..e2c3c31d --- /dev/null +++ b/splunk/src/main/java/com/splunk/DeploymentServerClass.java @@ -0,0 +1,224 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code DeploymentServerClass} class represents a Splunk deployment server + * class, providing access to the configuration of a server class. + */ +public class DeploymentServerClass extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The deployment server class endpoint. + */ + DeploymentServerClass(Service service, String path) { + super(service, path); + } + + /** + * Returns a list of the hosts that are excluded from this server class. + * + * @return A comma-separated list of excluded hosts, or {@code null} if not + * specified. + */ + public String getBlacklist() { + return getString("blacklist", null); + } + + /** + * Returns a list of excluded client addresses, by index. + * + * @param index The index of the blacklist entry to return. The only valid + * index is 0. + * @return A list of excluded client addresses, or {@code null} if not + * specified. + */ + public String getBlacklistByIndex(int index) { + return getString(String.format("blacklist.%d", index), null); + } + + /** + * Indicates whether look-ups halt on the first server match or continue + * to match against multiple servers. Matching is done in the order that + * server classes are defined. + * + * @return {@code true} if configuration look-ups continue matching server + * classes, beyond the first match. {@code false} if only the first match + * is used. + */ + public boolean getContinueMatching() { + return getBoolean("continueMatching", false); + } + + /** + * Returns the URL template string, which specifies the endpoint from which + * content can be downloaded by a deployment client. + * + * @return The URL template string for deployment client downloads, or + * {@code null} if not specified. + */ + public String getEndpoint() { + return getString("endpoint", null); + } + + /** + * Returns the filter type that is applied first. If {@code filterType} is + * "whitelist", all whitelist filters are applied first, followed by + * blacklist filters. If {@code filterType} is "blacklist", all blacklist + * filters are applied first, followed by whitelist filters. + * + * @return The filter type. + */ + public String getFilterType() { + return getString("filterType"); + } + + /** + * Returns the location on the deployment server to store the content + * that is to be deployed for this server class. + * <p> + * <b>Note:</b> The path may contain macro expansions or substitutions. + * + * @return The file path for content storage on the deployment server. + */ + public String getRepositoryLocation() { + return getString("repositoryLocation"); + } + + /** + * Returns the location on the deployment client where the content to be + * deployed for this server class should be installed. + * <p> + * <b>Note:</b> The path may contain macro expansions or substitutions. + * + * @return The file path for content storage on the deployment client. + */ + public String getTargetRepositoryLocation() { + return getString("targetRepositoryLocation", null); + } + + /** + * Returns the location of the working folder used by the deployment server. + * <p> + * <b>Note:</b> The path may contain macro expansions or substitutions. + * + * @return The path to the deployment server's working folder, or + * {@code null} if not specified. + */ + public String getTmpFolder() { + return getString("tmpFolder", null); + } + + /** + * Returns a list of hosts included for this server class. + * @return A comma-separated list of included hosts, or {@code null} if not + * specified. + */ + public String getWhitelist() { + return getString("whitelist", null); + } + + /** + * Returns a list of included client addresses, by index. + * + * @param index The index of the whitelist entry to return. Valid indexes + * are 0 and 1. + * @return A list of included client addresses, or {@code null} if not + * specified. + */ + public String getWhitelistByIndex(int index) { + return getString(String.format("whitelist.%d", index), null); + } + + /** + * Sets a specific blacklist entry. + * + * @param index The index of the blacklist entry to set. + * @param blacklist The blacklist entry. + */ + public void setBlacklistByIndex(int index, String blacklist) { + setCacheValue(String.format("blacklist.%d", index), blacklist); + } + + /** + * Sets how this deployment server class controls its configurations + * across classes and server-specific settings. If set to {@code true}, + * configuration look-ups continue matching server classes after the first + * match. If set to {@code false}, only the first match is used. Matching + * is done in the order that server classes are defined. + * + * @param matching {@code true} to continue matching, {@code false} to use + * the first match. + */ + public void setContinueMatching(boolean matching) { + setCacheValue("continueMatching", matching); + } + + /** + * Sets a URL template string that specifies the endpoint from which + * content can be downloaded by a deployment client. The deployment client + * knows how to substitute the values of the variables in the URL. Any + * custom URL can be provided here as long as it uses the specified + * variables. + * + * You don't have to set this URL template string unless you have a very + * specific need--for example, you need to acquire deployment application + * files from a third-party httpd for extremely large environments. + * + * @param endPoint The endpoint URL. + */ + public void setEndPoint(String endPoint) { + setCacheValue("endpoint", endPoint); + } + + /** + * Sets the order to apply filters: + * <ul><li>"whitelist" applies the whitelist filters first, followed by + * blacklist filters.</li> + * <li>"blacklist" applies the blacklist filters first, followed by + * whitelist filters. </li></ul> + * + * @param filterType The filter type to apply first. + */ + public void setFilterType(String filterType) { + setCacheValue("filterType", filterType); + } + + /** + * Sets the location on the deployment server to store the content that is + * to be deployed for this server class. + * + * @param location The location (path) for storing content. + */ + public void setRepositoryLocation(String location) { + setCacheValue("repositoryLocation", location); + + } + + /** + * Sets a specific whitelist entry. + * + * @param index The index of the whitelist entry to set. + * @param whitelist The whitelist entry. + */ + public void setWhitelistByIndex(int index, String whitelist) { + setCacheValue(String.format("whitelist.%d", index), whitelist); + } +} diff --git a/splunk/com/splunk/DeploymentTenant.java b/splunk/src/main/java/com/splunk/DeploymentTenant.java similarity index 50% rename from splunk/com/splunk/DeploymentTenant.java rename to splunk/src/main/java/com/splunk/DeploymentTenant.java index e609f51f..67edff79 100644 --- a/splunk/com/splunk/DeploymentTenant.java +++ b/splunk/src/main/java/com/splunk/DeploymentTenant.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,15 @@ package com.splunk; /** - * Representation of a Splunk deployment tenant. + * The {@code DeploymentTenant} class represents a Splunk deployment tenant, and + * provides access to the multi-tenants configuration for this Splunk instance. */ public class DeploymentTenant extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The deployment tenant endpoint. */ DeploymentTenant(Service service, String path) { @@ -32,26 +33,32 @@ public class DeploymentTenant extends Entity { } /** - * Returns whether or not this deployment server should review its - * configuration, in a multi-tenant configuration, and inform the deployment - * client if something is new or updated. + * Returns inclusive criteria for determining deployment client access to + * this deployment server. * - * @return Whether this deployment server notifies the deployment client for - * new or changed configurations. + * @param index The whitelist index. The only valid index is 0. + * @return Criteria for determining deployment client access to this + * deployment server. */ - public boolean getCheckNew() { - return getBoolean("check-new", false); + public String getWhitelistByIndex(int index) { + return getString(String.format("whitelist.%d", index), null); } /** - * Returns inclusive criteria for determining deployment client access to - * this deployment server. + * Sets whether the deployment tenant is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * @see Entity#disable + * @see Entity#enable * - * @return Criteria for determining deployment client access to this - * deployment server. + * @param disabled {@code true} to disabled to deployment client, + * {@code false} to enable. */ - public String getWhiteList0() { - return getString("whitelist.0"); + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); } } diff --git a/splunk/src/main/java/com/splunk/DistributedConfiguration.java b/splunk/src/main/java/com/splunk/DistributedConfiguration.java new file mode 100644 index 00000000..4105d1b4 --- /dev/null +++ b/splunk/src/main/java/com/splunk/DistributedConfiguration.java @@ -0,0 +1,321 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code DistributedConfiguration} class represents a Splunk distributed + * search configuration, providing access to Splunk's distributed search + * options. + */ +public class DistributedConfiguration extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + DistributedConfiguration(Service service) { + super(service, "search/distributed/config"); + } + + /** + * Returns the action path. + * + * @param action The requested action. + * @return The action path. + */ + @Override protected String actionPath(String action) { + if (action.equals("edit")) + return path + "/distributedSearch"; + return super.actionPath(action); + } + + /** + * Disable distributed search on this Splunk instance. + * + * Requires restarting Splunk before it takes effect. + */ + @Override + public void disable() { + Args args = new Args(); + args.put("disabled", "1"); + update(args); + } + + /** + * Enable distributed search on this Splunk instance. + * + * Requires restarting Splunk before it takes effect. + */ + @Override + public void enable() { + Args args = new Args(); + args.put("disabled", "0"); + update(args); + } + + /** + * Returns a list of server names that are excluded from being peers. + * + * @return A comma-separated list of excluded servers by name, or + * {@code null} if not available. + */ + public String getBlacklistNames() { + return getString("blacklistNames", null); + } + + /** + * Returns a list of server URLs that are excluded from being peers. + * + * @return A comma-separated list of excluded servers by URL in the + * format "x.x.x.x:port", or {@code null} if not available. + */ + public String getBlacklistUrls() { + return getString("blacklistURLs", null); + } + + /** + * Returns the time-out period for connecting to search peers. + * + * @return The connection time-out period, in seconds, or -1 if not + * specified. + */ + public int getConnectionTimeout() { + return getInteger("connectionTimeout", -1); + } + + /** + * Returns the frequency at which servers that have timed out are rechecked. + * If {@code removeTimedOutServers} is false, this setting has no effect. + * + * @return The frequency, in seconds, to recheck timed-out servers. If 0, + * servers are not rechecked. The default is 60 seconds. + */ + public int getCheckTimedOutServersFrequency() { + return getInteger("checkTimedOutServersFrequency", 60); + } + + /** + * Returns the time-out period for trying to read and receive data from a + * search peer. + * + * @return The receive time-out period, in seconds, or -1 if not specified. + */ + public int getReceiveTimeout() { + return getInteger("receiveTimeout", -1); + } + + /** + * Indicates whether timed-out servers are removed from the distributed + * configuration. + * + * @return {@code true} if timed-out servers are removed from the + * distributed configuration, {@code false} if not. + */ + public boolean getRemovedTimedOutServers() { + return getBoolean("removedTimedOutServers", false); + } + + /** + * Returns the time-out period for trying to write or send data to a search + * peer. + * + * @return The send time-out period, in seconds, or -1 if not specified. + */ + public int getSendTimeout() { + return getInteger("sendTimeout", -1); + } + + /** + * Returns a list of peer servers. + * + * @return The comma-separated list of peer servers, or {@code null} if not + * available. + */ + public String getServers() { + return getString("servers", null); + } + + /** + * Indicates whether this server uses bundle replication to share + * search-time configuration with search peers. + * <p> + * <b>Note:</b> If set to {@code false}, the search head assumes that the + * search peers can access the correct bundles using an NFS share. + * + * @return {@code true} if this server uses bundle replication, + * {@code false} if not. + */ + public boolean getShareBundles() { + return getBoolean("shareBundles", true); + } + + /** + * Returns the time-out period for gathering a search peer's basic information. + * + * @return The time-out period, in seconds. + * @see ServiceInfo + */ + public int getStatusTimeout() { + return getInteger("statusTimeout", 10); + } + + /** + * Indicates whether distributed search is enabled. + * + * @return {@code true} if distributed search is enabled, {@code false} if + * disabled. + */ + public boolean isDistSearchEnabled() { + return getBoolean("dist_search_enabled", true); + } + + /** + * Sets the blacklist server names that are excluded from being peers. + * + * @param names A comma-separated list of server names. + */ + public void setBlacklistNames(String names) { + setCacheValue("blacklistNames", names); + } + + /** + * Sets the blacklist server names or URIs that are excluded from being + * peers. The format for a URI is "x.x.x.x:port". + * + * @param names A comma-separated list of server names or URIs. + */ + public void setBlacklistURLs(String names) { + setCacheValue("blacklistURLs", names); + } + + /** + * Sets the server recheck frequency. + * <p> + * <b>Note:</b> This attribute is only relevant when + * {@code removeTimedOutServers} is set to {@code true}--otherwise, this + * attribute is ignored. + * @see #getRemovedTimedOutServers + * + * @param frequency The server recheck frequency, in seconds. If set to 0, a + * recheck does not occur. + */ + public void setCheckTimedOutServersFrequency(int frequency) { + setCacheValue("checkTimedOutServersFrequency", frequency); + } + + /** + * Sets the time-out period for establishing a search peer connection. + * + * @param seconds The connection time-out period, in seconds. + */ + public void setConnectionTimeout(int seconds) { + setCacheValue("connectionTimeout", seconds); + } + + /** + * Sets whether the distributed configuration is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * @see Entity#disable + * @see Entity#enable + * + * @param disabled {@code true} to disabled to deployment client, + * {@code false} to enable. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the time-out period for reading and receiving data from a search + * peer. + * + * @param seconds The receive time-out period, in seconds. + */ + public void setReceiveTimeout(int seconds) { + setCacheValue("receiveTimeout", seconds); + } + + /** + * Sets whether to remove a server connection that cannot be made within the + * time-out period specified by {@code connectionTimeout}, + * {@code sendTimeout}, or {@code receiveTimeout}. + * If {@code false}, every call to that server attempts to connect, which + * might result in a slow user interface. + * @see #setConnectionTimeout + * @see #setSendTimeout + * @see #setReceiveTimeout + * + * @param removeTimedOutServers {@code true} to remove timed-out server + * connections, {@code false} to attempt every call to the server. + */ + public void setRemoveTimedOutServers(boolean removeTimedOutServers) { + setCacheValue("removedTimedOutServers", removeTimedOutServers); + } + + /** + * Sets the time-out period for writing and sending data to a search peer. + * + * @param seconds The send time-out period, in seconds. + */ + public void setSendTimeout(int seconds) { + setCacheValue("sendTimeout", seconds); + } + + /** + * Sets the initial peer server list. You don't need to set servers here + * if you are operating completely in {@code autoAddServers} mode + * (discovered servers are automatically added). + * + * @param servers A comma-separated list of peer servers. + */ + public void setServers(String servers) { + setCacheValue("servers", servers); + } + + /** + * Sets whether this server uses bundle replication to share search-time + * configuration with search peers. + * + * If set to {@code false}, the search head assumes that the search peers + * can access the correct bundles using an NFS share and have correctly + * configured the options for mounted_bundles and bundles_location in the + * distsearch.conf file. + * + * @param shareBundles {@code true} to share search-time configuration + * with peers, {@code false} if not. + */ + public void setShareBundles(boolean shareBundles) { + setCacheValue("shareBundles", shareBundles); + } + + /** + * Sets the time-out period for connecting to a search peer for getting its + * basic information. + * + * @param seconds The connection time-out period, in seconds. + * @see ServiceInfo + */ + public void setStatusTimeout(int seconds) { + setCacheValue("statusTimeout", seconds); + } + +} diff --git a/splunk/src/main/java/com/splunk/DistributedPeer.java b/splunk/src/main/java/com/splunk/DistributedPeer.java new file mode 100644 index 00000000..2a42a75f --- /dev/null +++ b/splunk/src/main/java/com/splunk/DistributedPeer.java @@ -0,0 +1,149 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code DistributedPeer} class represents a Splunk distributed peer, + * providing distributed peer server management. + */ +public class DistributedPeer extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The deployment server endpoint. + */ + DistributedPeer(Service service, String path) { + super(service, path); + } + + /** + * Returns this peer's build number. + * + * @return The build number. + */ + public String getBuild() { + return getString("build"); + } + + /** + * Returns a list of bundle versions. + * + * @return The bundle versions, or {@code null} if not specified. + */ + public String[] getBundleVersions() { + return getStringArray("bundle_versions", null); + } + + /** + * Returns this peer's GUID. + * + * @return The GUID, or {@code null} if not specified. + */ + public String getGuid() { + return getString("guid", null); + } + + /** + * Returns this peer's license signature. + * + * @return The license signature, or {@code null} if not specified. + */ + public String getLicenseSignature() { + return getString("licenseSignature", null); + } + + /** + * Returns this peer's name. + * + * @return The name, or {@code null} if not specified. + */ + public String getPeerName() { + return getString("peerName", null); + } + + /** + * Returns this peer's type. + * + * @return The type, or {@code null} if not specified. + */ + public String getPeerType() { + return getString("peerType", null); + } + + /** + * Returns this peer's replication status. + * + * @return The replication status, or {@code null} if not specified. + */ + public String getReplicationStatus() { + return getString("replicationStatus", null); + } + + /** + * Return this peer's overall status. + * + * @return The overall status, or {@code null} if not specified. + */ + public String getStatus() { + return getString("status", null); + } + + /** + * Returns this peer's version. + * + * @return The version, or {@code null} if not specified. + */ + public String getVersion() { + return getString("version", null); + } + + /** + * Indicates whether this peer is using HTTPS. + * + * @return {@code true} if this peer is using HTTPS, {@code false} if not. + */ + public boolean isHttps() { + return getBoolean("is_https", true); + } + + /** + * Sets the remote password. + * <p> + * <b>Note:</b> The username and password must be set at the same time. + * @see #setRemoteUsername + * + * @param password The remote password. + */ + public void setRemotePassword(String password) { + setCacheValue("remotePassword", password); + } + + /** + * Sets the remote username. + * <p> + * <b>Note:</b> The username and password must be set at the same time. + * @see #setRemotePassword + * + * @param username The remote username. + */ + public void setRemoteUsername(String username) { + setCacheValue("remoteUsername", username); + } +} + diff --git a/splunk/com/splunk/Entity.java b/splunk/src/main/java/com/splunk/Entity.java similarity index 59% rename from splunk/com/splunk/Entity.java rename to splunk/src/main/java/com/splunk/Entity.java index d50a21be..a4856e2a 100644 --- a/splunk/com/splunk/Entity.java +++ b/splunk/src/main/java/com/splunk/Entity.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -16,31 +16,29 @@ package com.splunk; -import java.util.Collection; -import java.util.Date; -import java.util.Map; -import java.util.Set; +import java.util.*; /** - * Base class for all Splunk entity resources. + * The {@code Entity} class represents a Splunk entity. */ public class Entity extends Resource implements Map<String, Object> { - private Record content; + protected Record content; + protected HashMap<String, Object> toUpdate = new LinkedHashMap<String, Object>(); /** * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The entity's endpoint. */ - Entity(Service service, String path) { + public Entity(Service service, String path) { super(service, path); } /** - * Returns the path corresponding to the requested action. + * Returns the path that corresponds to the requested action. * - * @param action Action requested. + * @param action The requested action. * @return The return path. */ protected String actionPath(String action) { @@ -50,10 +48,10 @@ protected String actionPath(String action) { return path; if (action.equals("enable")) return path + "/enable"; - if (action.equals("reload")) - return path + "/_reload"; if (action.equals("remove")) return path; + if (action.equals("acl")) + return path + "/acl"; throw new IllegalArgumentException("Invalid action: " + action); } @@ -73,8 +71,8 @@ public boolean containsValue(Object value) { } /** - * Disabled the entity named by this endpoint. Available on almost every - * endpoint. + * Disables the entity that is named by this endpoint. This method is + * available on almost every endpoint. */ public void disable() { service.post(actionPath("disable")); @@ -82,8 +80,8 @@ public void disable() { } /** - * Enables the entity named by this endpoint. Available on almost every - * endpoint. + * Enables the entity that is named by this endpoint. This method is + * available on almost every endpoint. */ public void enable() { service.post(actionPath("enable")); @@ -97,58 +95,67 @@ public Set<Map.Entry<String, Object>> entrySet() { /** {@inheritDoc} */ public Object get(Object key) { + if (toUpdate.containsKey(key)) return toUpdate.get(key); return getContent().get(key); } /** - * Returns the boolean value associated with the specified key. Values - * values can be converted from the set 0, 1, true, false. + * Returns the Boolean value associated with the specified key. Values + * can be converted from: 0, 1, true, false. * * @param key The key to look up. - * @return The boolean value associated with the specified key. + * @return The Boolean value associated with the specified key. */ boolean getBoolean(String key) { + if (toUpdate.containsKey(key)) + return Value.toBoolean(toUpdate.get(key).toString()); return getContent().getBoolean(key); } /** - * Returns the boolean value associated with the specified key, or the + * Returns the Boolean value associated with the specified key, or the * default value if the key does not exist. Boolean values can be converted - * from the set 0, 1, true, false. + * from: 0, 1, true, false. * * @param key The key to look up. * @param defaultValue The default value. - * @return The boolean value associated with the specified key. + * @return The Boolean value associated with the specified key. */ boolean getBoolean(String key, boolean defaultValue) { + if (toUpdate.containsKey(key)) + return Value.toBoolean(toUpdate.get(key).toString()); return getContent().getBoolean(key, defaultValue); } /** * Returns the long value associated with the specified key. Long values - * can be converted from the set number, numberMB, numberGB. + * can be converted from: number, numberMB, numberGB. * * @param key The key to look up. * @return The long value associated with the specified key. */ long getByteCount(String key) { + if (toUpdate.containsKey(key)) + return Value.toByteCount(toUpdate.get(key).toString()); return getContent().getByteCount(key); } /** * Returns the long value associated with the specified key, or the default - * value if the key does not exist. Long values can be converted from the - * set number, numberMB, numberGB. + * value if the key does not exist. Long values can be converted from: + * number, numberMB, numberGB. * * @param key The key to look up. * @param defaultValue The default value. * @return The long value associated with the specified key. */ long getByteCount(String key, long defaultValue) { + if (toUpdate.containsKey(key)) + return Value.toByteCount(toUpdate.get(key).toString()); return getContent().getByteCount(key, defaultValue); } - private Record getContent() { + protected Record getContent() { return validate().content; } @@ -160,12 +167,18 @@ private Record getContent() { * @return The date value associated with the specified key. */ Date getDate(String key) { - return getContent().getDate(key); + if (toUpdate.containsKey(key)) + return Value.toDate(toUpdate.get(key).toString()); + if (getContent().containsKey(key)) { + return getContent().getDate(key); + } else { + return null; + } } /** * Returns a date value associated with the specified key, or the default - * value if the key does not exist. ate values can be converted from + * value if the key does not exist. Date values can be converted from * standard UTC time formats. * * @param key The key to look up. @@ -173,33 +186,11 @@ Date getDate(String key) { * @return The date value associated with the specified key. */ Date getDate(String key, Date defaultValue) { + if (toUpdate.containsKey(key)) + return Value.toDate(toUpdate.get(key).toString()); return getContent().getDate(key, defaultValue); } - /** - * Returns a date value associated with the specified key. Date values can - * be converted from epoch time formats. - * - * @param key The key to look up. - * @return The date value associated with the specified. key. - */ - Date getDateFromEpoch(String key) { - return getContent().getDateFromEpoch(key); - } - - /** - * Returns a date value associated with the specified key, or the default - * value if the key does not exist. Date values can be converted from epoch - * time formats. - * - * @param key The key to look up. - * @param defaultValue The default value. - * @return The date value associated with the specified. key. - */ - Date getDateFromEpoch(String key, Date defaultValue) { - return getContent().getDateFromEpoch(key, defaultValue); - } - /** * Returns the floating point value associated with the specified key. * @@ -207,6 +198,8 @@ Date getDateFromEpoch(String key, Date defaultValue) { * @return The floating point value associated with the specified key. */ float getFloat(String key) { + if (toUpdate.containsKey(key)) + return Value.toFloat(toUpdate.get(key).toString()); return getContent().getFloat(key); } @@ -217,6 +210,8 @@ float getFloat(String key) { * @return The integer point value associated with the specified key. */ int getInteger(String key) { + if (toUpdate.containsKey(key)) + return Value.toInteger(toUpdate.get(key).toString()); return getContent().getInteger(key); } @@ -228,6 +223,8 @@ int getInteger(String key) { * @return The integer value associated with the specified key. */ int getInteger(String key, int defaultValue) { + if (toUpdate.containsKey(key)) + return Value.toInteger(toUpdate.get(key).toString()); return getContent().getInteger(key, defaultValue); } @@ -238,6 +235,8 @@ int getInteger(String key, int defaultValue) { * @return The long value associated with the specified key. */ long getLong(String key) { + if (toUpdate.containsKey(key)) + return Value.toLong(toUpdate.get(key).toString()); return getContent().getLong(key); } @@ -249,17 +248,21 @@ long getLong(String key) { * @return The long value associated with the specified key. */ long getLong(String key, int defaultValue) { + if (toUpdate.containsKey(key)) + return Value.toLong(toUpdate.get(key).toString()); return getContent().getLong(key, defaultValue); } /** - * Returns the meta data (eai:acl) of this entity, or null if none exist. + * Returns the metadata (eai:acl) of this entity. This data includes + * permissions for accessing the resource, and values that indicate + * which resource fields are wildcards, required, and optional. * - * @return the meta data of this entity. + * @return The metadata of this entity, or {@code null} if none exist. */ public EntityMetadata getMetadata() { // CONSIDER: For entities that don't have an eai:acl field, which is - // uncommon, but does happen at least in the case of a DeploymentClient + // uncommon but does happen at least in the case of a DeploymentClient // that is not enabled, we return null. A slightly friendlier option // would be to return a metadata instance that defaults all values? if (!containsKey("eai:acl")) return null; @@ -273,6 +276,8 @@ public EntityMetadata getMetadata() { * @return The string value associated with the specified key. */ String getString(String key) { + if (toUpdate.containsKey(key)) + return toUpdate.get(key).toString(); return getContent().getString(key); } @@ -285,6 +290,8 @@ String getString(String key) { * @return The string value associated with the specified key. */ String getString(String key, String defaultValue) { + if (toUpdate.containsKey(key)) + return toUpdate.get(key).toString(); return getContent().getString(key, defaultValue); } @@ -295,6 +302,9 @@ String getString(String key, String defaultValue) { * @return The string array value associated with the specified key. */ String[] getStringArray(String key) { + if (toUpdate.containsKey(key)) { + return ((String)toUpdate.get(key)).split("\\|"); + } return getContent().getStringArray(key); } @@ -307,6 +317,8 @@ String[] getStringArray(String key) { * @return The string array value associated with the specified key. */ String[] getStringArray(String key, String[] defaultValue) { + if (toUpdate.containsKey(key)) + return getStringArray(key); return getContent().getStringArray(key, defaultValue); } @@ -316,21 +328,33 @@ public boolean isEmpty() { } /** - * Returns whether or not this entity is disabled. Available on almost - * evey endpoint. + * Indicates whether this entity is disabled. This method is + * available on almost every endpoint. * - * @return Whether or not this entity is disabled. + * @return {@code true} if this entity is disabled, {@code false} if + * enabled. */ public boolean isDisabled() { return getBoolean("disabled", false); } + + /** + * Returns whether this entity's name can be changed via {@link #update}. + * + * Most entity names cannot be changed in this way. + * @return false. + */ + protected boolean isNameChangeAllowed() { + return false; + } /** {@inheritDoc} */ public Set<String> keySet() { return getContent().keySet(); } - @Override Entity load(AtomObject value) { + @Override + Entity load(AtomObject value) { super.load(value); AtomEntry entry = (AtomEntry)value; if (entry == null) { @@ -354,41 +378,97 @@ public void putAll(Map<? extends String, ? extends Object> map) { /** {@inheritDoc} */ @Override public Entity refresh() { + // Update any attribute values set by a setter method that has not + // yet been written to the object. ResponseMessage response = service.get(path); assert(response.getStatus() == 200); - AtomFeed feed = AtomFeed.parse(response.getContent()); + AtomFeed feed; + try { + feed = AtomFeed.parseStream(response.getContent()); + } catch (Exception e) { + throw new RuntimeException(e); + } int count = feed.entries.size(); - assert(count == 0 || count == 1); + if (count > 1) { + throw new IllegalStateException("Expected 0 or 1 Atom entries; found " + feed.entries.size()); + } AtomEntry entry = count == 0 ? null : feed.entries.get(0); load(entry); return this; } - /** - * Performs this entity's reload action. - */ - public void reload() { - service.get(actionPath("reload")); - invalidate(); - } - /** {@inheritDoc} */ public Object remove(Object key) { throw new UnsupportedOperationException(); } + /** + * Sets the local cache update value. Writing is deferred until + * {@code update} has been called. + * + * @param key The key to set. + * @param value The default value. + */ + void setCacheValue(String key, Object value) { + toUpdate.put(key, value); + } + /** {@inheritDoc} */ public int size() { return getContent().size(); } /** - * Updates the entity with the specified arguments. + * Updates the entity with the values you previously set using the setter + * methods, and any additional specified arguments. The specified arguments + * take precedent over the values that were set using the setter methods. * - * @param args The arguments being updated. + * @param args The arguments to update. */ public void update(Map<String, Object> args) { - service.post(actionPath("edit"), args); + if (!toUpdate.isEmpty() || !args.isEmpty()) { + // Merge cached setters and live args together before updating. + Map<String, Object> mergedArgs = + new LinkedHashMap<String, Object>(); + mergedArgs.putAll(toUpdate); + mergedArgs.putAll(args); + + if (mergedArgs.containsKey("name") && !isNameChangeAllowed()) { + throw new IllegalStateException("Cannot set 'name' on an existing entity."); + } + + service.post(actionPath("edit"), mergedArgs); + toUpdate.clear(); + invalidate(); + } + } + + /** + * Updates the entity with the accumulated arguments, established by the + * individual setter methods for each specific entity class. + */ + @SuppressWarnings("unchecked") + public void update() { + update(Collections.EMPTY_MAP); + } + + + /** + * Update the access control list (ACL) properties for this entity, + * + * @param args: Properties to update for this entity. + * Required Properties in 'args' + * - `owner`: The Splunk username, such as "admin". A value of "nobody" means no specific user. + * - `sharing`: A mode that indicates how the resource is shared. The sharing mode can be "user", "app", "global", or "system". + */ + public void aclUpdate(Map<String, Object> args){ + if(!args.containsKey("sharing")){ + throw new IllegalArgumentException("Required argument 'sharing' is missing."); + } + if(!args.containsKey("owner")){ + throw new IllegalArgumentException("Required argument 'owner' is missing."); + } + service.post(actionPath("acl"), args); invalidate(); } diff --git a/splunk/src/main/java/com/splunk/EntityCollection.java b/splunk/src/main/java/com/splunk/EntityCollection.java new file mode 100644 index 00000000..a0378d60 --- /dev/null +++ b/splunk/src/main/java/com/splunk/EntityCollection.java @@ -0,0 +1,152 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.LinkedList; +import java.util.Map; + +/** + * The {@code EntityCollection} class represents a collection of Splunk + * entities. + * + * @param <T> The type of members in the collection. + */ +public class EntityCollection<T extends Entity> extends ResourceCollection<T> { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The entity's endpoint. + */ + EntityCollection(Service service, String path) { + super(service, path, Entity.class); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The entity's endpoint. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + EntityCollection(Service service, String path, Args args) { + super(service, path, Entity.class, args); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The entity's endpoint. + * @param itemClass The entity's class. + */ + EntityCollection(Service service, String path, Class itemClass) { + super(service, path, itemClass); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The entity's endpoint. + * @param itemClass The entity's class. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + public EntityCollection(Service service, String path, Class itemClass, Args args) { + super(service, path, itemClass, args); + } + + /** + * Creates an entity in this collection. + * + * @param name The name of the entity. + * @return The entity. + */ + public T create(String name) { + return create(name, (Map)null); + } + + /** + * Creates an entity in this collection. + * + * @param name The name of the entity. + * @param args Arguments for creating the entity. + * @return The entity. + */ + public T create(String name, Map args) { + args = Args.create(args).add("name", name); + service.post(path, args); + invalidate(); + return get(name); + } + + /** + * Removes an entity from this collection. + * + * @param key The name of the entity to remove. + * @return The collection. + * @throws SplunkException The exception "AMBIGUOUS" if the collection + * contains more than one entity with the specified key. Disambiguation is + * done through a similar method, + * {@code remove(Object key, HashMap<String,String>namespace}, which uses + * the namespace to perform the disambiguation. + */ + public T remove(String key) { + validate(); + if (!containsKey(key)) return null; + LinkedList<T> entities = items.get(key); + if (entities != null && entities.size() > 1) { + throw new SplunkException(SplunkException.AMBIGUOUS, + "Key has multiple values, specify a namespace"); + } + if (entities == null) return null; + T entity = entities.get(0); + entity.remove(); + // by invalidating any access to items will get refreshed + invalidate(); + return entity; + } + + /** + * Removes an entity from this collection, with a namespace restriction. + * + * @param key The name of the entity to remove. + * @param namespace The namespace restriction within the collection. + * @return This collection. + */ + public T remove(String key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + validate(); + + if (!containsKey(key)) return null; + LinkedList<T> entities = items.get(key); + String pathMatcher = service.fullpath("", namespace); + if (entities == null || entities.size() == 0) return null; + for (T entity: entities) { + if (entity.path.startsWith(pathMatcher)) { + entity.remove(); + // By invalidating, any access to items will get refreshed + invalidate(); + return entity; + } + } + return null; + } +} diff --git a/splunk/com/splunk/EntityMetadata.java b/splunk/src/main/java/com/splunk/EntityMetadata.java similarity index 55% rename from splunk/com/splunk/EntityMetadata.java rename to splunk/src/main/java/com/splunk/EntityMetadata.java index 6829cf49..b36b775a 100644 --- a/splunk/com/splunk/EntityMetadata.java +++ b/splunk/src/main/java/com/splunk/EntityMetadata.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,15 @@ package com.splunk; /** - * Provides access to the metadata properties of a corresponding entity. - * Instances of this class are obtained via {@code Entity.getMetadata}. + * The {@code EntityMetadata} class provides access to the metadata properties + * of a corresponding entity. Use {@code Entity.getMetadata} to obtain an + * instance of this class. */ public class EntityMetadata { private Entity entity; /** - * Clas constructor. + * Class constructor. * * @param entity This entity. */ @@ -33,101 +34,107 @@ public class EntityMetadata { } /** - * Returns whether or not this entity's permission can be changed. + * Indicates whether this entity's permission can be changed. * - * @return Whether or not this entity's permission can be changed. + * @return {@code true} if this entity's permission can be changed, + * {@code false} if not. */ public boolean canChangePermissions() { return getEaiAcl().getBoolean("can_change_perms", false); } /** - * Returns whether or not the resource can be shared via an app. + * Indicates whether this entity can be shared via an app. * - * @return Whether or not the resource can be shared via an app. + * @return {@code true} if this entity can be shared via an app, + * {@code false} if not. */ public boolean canShareApp() { return getEaiAcl().getBoolean("can_share_app", false); } /** - * Returns whether or not the resource can be shared globally. + * Indicates whether the entity can be shared globally. * - * @return Whether or not the resource can be shared globally. + * @return {@code true} if this entity can be shared globally, + * {@code false} if not. */ public boolean canShareGlobal() { return getEaiAcl().getBoolean("can_share_global", false); } /** - * Returns whether or not the resource can be shared to a specific user. + * Indicates whether the entity can be shared to a specific user. * - * @return Whether ot nor the resource can be shared to a specific user. + * @return {@code true} if this entity can be shared to a specific user, + * {@code false} if not. */ public boolean canShareUser() { return getEaiAcl().getBoolean("can_share_user", false); } /** - * Returns whether or not this entity can be modified. + * Indicates whether this entity can be modified. * - * @return Whether or not this entity can be modified. + * @return {@code true} if this entity can be modified, + * {@code false} if not. */ public boolean canWrite() { return getEaiAcl().getBoolean("can_write", false); } /** - * Returns the app context of this resource. + * Returns the app context of this entity. * - * @return The app context of this resource. + * @return The app context of this entity. */ public String getApp() { return getEaiAcl().getString("app", "system"); } /** - * Returns the record containing all the metadata information. + * Returns a record containing all of the metadata information + * for this entity. * - * @return The record containing all the metadata information. + * @return The record containing the metadata information. */ Record getEaiAcl() { return (Record)entity.validate().get("eai:acl"); } /** - * Returns the resource owner's username. + * Returns the username of the entity owner. * - * @return The resource owner's username. + * @return The entity owner's username. */ public String getOwner() { return getEaiAcl().getString("owner"); } /** - * Returns this entity's permissions. These permissions represent an + * Returns this entity's permissions, which represent an * allowable inclusive action:list-of-roles map. * * @return This entity's permissions map. */ public Record getPermissions() { - return getEaiAcl().<Record>getValue("perms", null); + return getEaiAcl().getValue("perms", null); } /** - * Returns how this resource is shared. Sharing values are from the list - * app, global and user. + * Returns how this entity is shared (app, global, and/or user). * - * @return How this resource is shared. + * @return Values that indicate how this entity is shared. */ public String getSharing() { return getEaiAcl().getString("sharing"); } /** - * Returns whether or not this entity can be modified. + * Indicates whether this entity can be modified. * - * @return Whether or not this entity can be modified. + * @return {@code true} if this entity can be modified, + * {@code false} if not. */ public boolean isModifiable() { return getEaiAcl().getBoolean("modifiable", false); diff --git a/splunk/src/main/java/com/splunk/EvalDataModelCalculation.java b/splunk/src/main/java/com/splunk/EvalDataModelCalculation.java new file mode 100644 index 00000000..c425313b --- /dev/null +++ b/splunk/src/main/java/com/splunk/EvalDataModelCalculation.java @@ -0,0 +1,37 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Map; + +/** + * Represents a calculation on a data model object done by an eval. + */ +public class EvalDataModelCalculation extends DataModelCalculation { + private final String expression; + + public EvalDataModelCalculation(String[] owner, String calculationID, + Map<String, DataModelField> generatedFields, String comment, + boolean editable, String expression) { + super(owner, calculationID, generatedFields, comment, editable); + this.expression = expression; + } + + /** + * @return eval expression specifying this calculation + */ + public String getExpression() { return this.expression; } +} diff --git a/splunk/src/main/java/com/splunk/Event.java b/splunk/src/main/java/com/splunk/Event.java new file mode 100644 index 00000000..a37b91bc --- /dev/null +++ b/splunk/src/main/java/com/splunk/Event.java @@ -0,0 +1,214 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.HashMap; +import java.util.Map; +import java.util.regex.Pattern; + +/** + * The {@code Event} class wraps an individual event or result that was returned + * by the {@link ResultsReader#getNextEvent} method. + * <p> + * An event maps each field name to a list of zero of more values. + * These values can be accessed as either an array (using the {@link #getArray} + * method) or as a delimited string (using the {@link #get} method). We + * recommend accessing values as an array when possible. + * <p> + * The delimiter for field values depends on the underlying result format. + * If the underlying format does not specify a delimiter, such as with the + * {@link ResultsReaderXml} class, the delimiter is a comma (,). + */ +public class Event extends HashMap<String, String> { + private Map<String, String[]> arrayValues = new HashMap<String, String[]>(); + private String segmentedRaw; + + // Prevent non-SDK instantiation. + Event() { + // nothing + } + + /** + * Sets the single value or delimited set of values for the specified + * field name. + * + * When setting a multi-valued field, use the + * {@link #putArray(String, String[])} method instead. + * + * @param key The field name. + * @param valueOrDelimitedValues The single values or delimited set of + * values. + */ + String putSingleOrDelimited(String key, String valueOrDelimitedValues) { + return super.put(key, valueOrDelimitedValues); + } + + /** + * Sets the values for the specified field name, with the assumption that + * the value delimiter is a comma (,). + * + * @param key The field name. + * @param values The delimited set of values. + */ + void putArray(String key, String[] values) { + arrayValues.put(key, values); + + // For backward compatibility with the Map interface + super.put(key, Util.join(",", values)); + } + + /** + * Sets the value for the XML element for the {@code _raw} field. This value + * is only used by the {@link ResultsReaderXml} class. + * @param value The text of the XML element. + */ + void putSegmentedRaw(String value) { + segmentedRaw = value; + } + + /** + * Returns the single value or delimited set of values for the specified + * field name, or {@code null} if the specified field is not present. + * + * When getting a multi-valued field, use the {@link #getArray(String)} or + * {@link #getArray(String, String)} method instead. + * + * @param key The field name. + * @return The single value or delimited set of values. + */ + public String get(String key) { + return super.get(key); + } + + /** + * Gets the values for the specified field name. + * <br><br> + * <b>Caution:</b> This variant of {@link #getArray(String, String)} is + * unsafe for {@link ResultsReader} implementations that require a + * delimiter. Therefore, this method should only be used for results that + * are returned by {@link ResultsReaderXml}. For other readers, use the + * {@link #getArray(String, String)} method instead. + * <br><br> + * If the underlying {@link ResultsReader} object has no delimiter, the + * original array of values is returned. If the object <i>does</i> have a + * delimiter, the single/delimited value is assumed to be a single value and + * is returned as a single-valued array. + * + * @param key The field name. + * @return The original array of values if there is no delimiter, or the + * single-valued array. + */ + public String[] getArray(String key) { + String[] arrayValue = arrayValues.get(key); + if (arrayValue != null) { + return arrayValue; + } + + String singleValue = super.get(key); + if (singleValue == null) { + return null; + } + return new String[] { singleValue }; + } + + /** + * Gets the values for the specified field name. + * + * The delimiter must be determined empirically based on the search + * string and the data format of the index. The delimiter can differ + * between fields in the same {@link Event} object. + * + * The delimiter is ignored for {@link ResultsReader} implementations + * that do not require a delimiter, such as {@link ResultsReaderXml}. + * + * If the underlying {@link ResultsReader} object has no delimiter, the + * original array of values is returned (and the specified delimiter is + * ignored). If the object <i>does</i> have a delimiter, the + * single/delimited value is split based on the specified delimiter and is + * returned as an array. + * + * @param key The field name. + * @param delimiter The delimiter. + * @return The original array of values if there is no delimiter, or the + * array of values split by delimiter. + */ + public String[] getArray(String key, String delimiter) { + String[] arrayValue = arrayValues.get(key); + if (arrayValue != null) { + return arrayValue; + } + + String delimitedValues = super.get(key); + if (delimitedValues == null) { + return null; + } + return delimitedValues.split(Pattern.quote(delimiter)); + } + + /** + * Gets the XML markup for the {@code "_raw"} field value. This value + * is only used by the {@link ResultsReaderXml} class. + * <p> + * The return value is different than that of {@code get("_raw")} + * in that this segmented raw value is an XML fragment that includes all + * markup such as XML tags and escaped characters. + * <p> + * For example, {@code get("_raw")} returns this: + * <p> + * {@code "http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt"} + * <p> + * The {@code getSegmentedRaw} method returns this: + * <p> + * {@code <v xml:space="preserve" trunc="0">"http://localhost:8000/en-US/app/<sg h=\"1\">search</sg>/flashtimeline?q=<sg h=\"1\">search</sg>%20<sg h=\"1\">search</sg>%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt"</v>} + * @return the segmented raw xml including tags and escaped characters. + */ + public String getSegmentedRaw() { + if (segmentedRaw == null) { + // ResultsReaderXml will always set this to not null. Using this + // method for other result reader is not supported. + throw new UnsupportedOperationException( + "The value is not available. Use ResultsReaderXml instead."); + } + return segmentedRaw; + } + // === Read Only === + + @Override + public void clear() { + throw new UnsupportedOperationException(); + } + + @Override + public Object clone() { + throw new UnsupportedOperationException(); + } + + @Override + public String put(String key, String value) { + throw new UnsupportedOperationException(); + } + + @Override + public void putAll(Map<? extends String, ? extends String> m) { + throw new UnsupportedOperationException(); + } + + @Override + public String remove(Object key) { + throw new UnsupportedOperationException(); + } +} diff --git a/splunk/src/main/java/com/splunk/EventType.java b/splunk/src/main/java/com/splunk/EventType.java new file mode 100644 index 00000000..4766f256 --- /dev/null +++ b/splunk/src/main/java/com/splunk/EventType.java @@ -0,0 +1,142 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code EventType} class represents an event type. + */ +public class EventType extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The event type endpoint. + */ + EventType(Service service, String path) { + super(service, path); + } + + /** + * Returns the description of this event type. + * + * @return The description of this event type. + */ + public String getDescription() { + return getString("description", null); + } + + /** + * Returns the priority of this event type. The range is 1 to 10, with 1 + * being the highest priority. + * + * @return The priority of this event type. + */ + public int getPriority() { + return getInteger("priority", -1); + } + + /** + * Returns the search terms for this event type. + * + * @return The search terms for this event type. + */ + public String getSearch() { + return getString("search", null); + } + + /** + * @deprecated Use tags.conf.spec file to assign tags to groups of events + * with related field values. + * + * Returns the list of tags for this event type. + * + * @return The list of tags for this event type. + */ + public String [] getTags() { + return getStringArray("tags", null); + } + + /** + * Sets the description of the event type. + * + * @param description The description of the event type. + */ + public void setDescription(String description) { + setCacheValue("description", description); + } + + /** + * Sets whether the event type is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * @see Entity#disable + * @see Entity#enable + * @param disabled The boolean flag + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the priority of the event type. Valid values are from 1 to 10, with + * 1 being the highest priority. + * + * @param priority The priority of the event type. + */ + public void setPriority(int priority) { + setCacheValue("priority", priority); + } + + /** + * Sets the search string. + * + * @param search The search string. + */ + public void setSearch(String search) { + setCacheValue("search", search); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("search")) { + args = Args.create(args).add("search", getSearch()); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("search")) { + setCacheValue("search", getSearch()); + } + super.update(); + } +} + diff --git a/splunk/com/splunk/EventTypeCollection.java b/splunk/src/main/java/com/splunk/EventTypeCollection.java similarity index 56% rename from splunk/com/splunk/EventTypeCollection.java rename to splunk/src/main/java/com/splunk/EventTypeCollection.java index 55b95046..516c2efc 100644 --- a/splunk/com/splunk/EventTypeCollection.java +++ b/splunk/src/main/java/com/splunk/EventTypeCollection.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -19,24 +19,35 @@ import java.util.Map; /** - * Representation of a collection of event types. + * The {@code EventTypeCollection} class represents a collection of event types. */ public class EventTypeCollection extends EntityCollection<EventType> { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. */ EventTypeCollection(Service service) { super(service, "saved/eventtypes", EventType.class); } + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + EventTypeCollection(Service service, Args args) { + super(service, "saved/eventtypes", EventType.class, args); + } + /** * Creates an event type. * - * @param name The name of this new event type. - * @param search The search string of this new event type. + * @param name The name of the event type. + * @param search The search string of the event type. * * @return The event type. */ @@ -45,12 +56,13 @@ public EventType create(String name, String search) { } /** - * Create an event type. + * Creates an event type. * - * @param name The name of this new event type. - * @param search The search string of this new event type. - * @param args Optional arguments. - * @return the event type. + * @param name The name of the event type. + * @param search The search string of the event type. + * @param args Optional arguments: "description", "disabled", and + * "priority". + * @return The event type. */ public EventType create(String name, String search, Map args) { args = Args.create(args).add("search", search); diff --git a/splunk/src/main/java/com/splunk/ExportResultsStream.java b/splunk/src/main/java/com/splunk/ExportResultsStream.java new file mode 100644 index 00000000..c56067dd --- /dev/null +++ b/splunk/src/main/java/com/splunk/ExportResultsStream.java @@ -0,0 +1,31 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.FilterInputStream; +import java.io.InputStream; + +/** + * The {@code ExportResultsStream} class represents a stream constructed by the + * {@link Service#export} method. + * + */ +class ExportResultsStream extends FilterInputStream { + public ExportResultsStream(InputStream stream) { + super(stream); + } +} diff --git a/splunk/src/main/java/com/splunk/FieldType.java b/splunk/src/main/java/com/splunk/FieldType.java new file mode 100644 index 00000000..8f78a469 --- /dev/null +++ b/splunk/src/main/java/com/splunk/FieldType.java @@ -0,0 +1,71 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.HashMap; +import java.util.Map; + +/** + * Represents the type of a field in a data model object. + */ +public enum FieldType { + STRING { + public String toString() { return "string"; } + }, + NUMBER { + public String toString() { return "number"; } + }, + BOOLEAN { + public String toString() { return "boolean"; } + }, + IPV4 { + public String toString() { return "ipv4"; } + }, + TIMESTAMP { + public String toString() { return "timestamp"; } + }, + CHILDCOUNT { + public String toString() { return "childcount"; } + }, + OBJECTCOUNT { + public String toString() { return "objectcount"; } + }, + UNDEFINED { + public String toString() { + throw new UnsupportedOperationException("No serialization for undefined field type."); + } + }; + + private final static Map<String, FieldType> typeLookup = new HashMap<String, FieldType>() {{ + put("string", STRING); + put("number", NUMBER); + put("boolean", BOOLEAN); + put("ipv4", IPV4); + put("timestamp", TIMESTAMP); + put("childcount", CHILDCOUNT); + put("objectcount", OBJECTCOUNT); + }}; + + public static FieldType parseType(String text) { + FieldType result = typeLookup.get(text.toLowerCase()); + if (result == null) { + result = UNDEFINED; + } + return result; + } + +}; diff --git a/splunk/src/main/java/com/splunk/FiredAlert.java b/splunk/src/main/java/com/splunk/FiredAlert.java new file mode 100644 index 00000000..b9b1c151 --- /dev/null +++ b/splunk/src/main/java/com/splunk/FiredAlert.java @@ -0,0 +1,148 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; + +/** + * The {@code FiredAlert} class represents a fired alert. + */ +public class FiredAlert extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The fired alert endpoint. + */ + FiredAlert(Service service, String path) { + super(service, path); + } + + /** + * Returns this alert's actions (such as notifying by email, running a + * script, adding to RSS, tracking in Alert Manager, and enabling + * summary indexing). + * + * @return The alert actions, or {@code null} if not available. + */ + public String[] getAction() { + return getStringArray("actions", null); + } + + /** + * Returns this alert's type. + * + * @return The alert type, or {@code null} if not available. + */ + public String getAlertType() { + return getString("alert_type", null); + } + + /** + * Returns the rendered expiration time for this alert. + * This method is available in Splunk 4.3 and later. + * + * @return This alert's rendered expiration time, or {@code null} if not + * available. + */ + public String getExpirationTime() { + return getString("expiration_time_rendered", null); + } + + /** + * Returns the rendered expiration time for this alert, + * parsed as a Date object. + * This method is available in Splunk 4.3 and later. + * + * @return This alert's rendered expiration time, or {@code null} if not + * available. + */ + public Date getParsedExpirationTime() { + return getDate("expiration_time_rendered", null); + } + + /** + * Returns the saved search for this alert. + * + * @return The saved search name, or {@code null} if not available. + */ + public String getSavedSearchName() { + return getString("savedsearch_name", null); + } + + /** + * Returns this alert's severity on a scale of 1 to 10, with 1 being the + * highest severity. + * + * @return This alert's severity, or -1 if the value is not specified. + */ + public int getSeverity() { + return getInteger("severity", -1); + } + + /** + * Returns this alert's search ID (SID). + * + * @return This alert's SID, or {@code null} if not available. + */ + public String getSid() { + return getString("sid", null); + } + + /** + * Returns the count of triggered alerts. + * This method is available in Splunk 4.3 and later. + * + * @return The number of triggered alerts, or -1 if not specified. + */ + public int getTriggeredAlertCount() { + return getInteger("triggered_alerts", -1); + } + + /** + * Returns the time this alert was triggered. + * + * @return This alert's trigger time, or {@code null} if not available. + */ + public Date getTriggerTime() { + return getDate("trigger_time", null); + } + + /** + * Returns this alert's rendered trigger time. + * This method is available in Splunk 4.3 and later. + * + * @return This alert's trigger time, or {@code null} if not available. + */ + public Date getTriggerTimeRendered() { + return getDate("trigger_time_rendered", null); + } + + /** + * Indicates whether the result is a set of events (digest) or a single + * event (per result). + * + * This method is available in Splunk 4.3 and later. + * + * @return {@code true} if the result is a digest, {@code false} if per + * result. + */ + public boolean isDigestMode() { + return getBoolean("digest_mode", false); + } +} diff --git a/splunk/com/splunk/OutputServer.java b/splunk/src/main/java/com/splunk/FiredAlertGroup.java similarity index 51% rename from splunk/com/splunk/OutputServer.java rename to splunk/src/main/java/com/splunk/FiredAlertGroup.java index 915c774e..7d6b0994 100644 --- a/splunk/com/splunk/OutputServer.java +++ b/splunk/src/main/java/com/splunk/FiredAlertGroup.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -15,29 +15,29 @@ */ package com.splunk; - /** - * Representation of an output server. + * The {@code FiredAlertGroup} class represents a group of fired alerts, which + * are the alerts for a given saved search. */ -public class OutputServer extends Entity { +public class FiredAlertGroup extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. - * @param path The output server endpoint. + * @param service The connected {@code Service} instance. + * @param path The fired alert endpoint. */ - OutputServer(Service service, String path) { + FiredAlertGroup(Service service, String path) { super(service, path); } /** - * Returns this server's all-connections object. + * Returns a group of fired alerts for a given saved search. * - * @return This server's all-connections object. + * @return The fired alerts in the group. */ - public OutputServerAllConnections allConnections() { - return new OutputServerAllConnections( - service, path + "/allconnections"); + public EntityCollection<FiredAlert> getAlerts() { + return new EntityCollection<FiredAlert>( + service, this.path, FiredAlert.class); } } diff --git a/splunk/src/main/java/com/splunk/FiredAlertGroupCollection.java b/splunk/src/main/java/com/splunk/FiredAlertGroupCollection.java new file mode 100644 index 00000000..875accd5 --- /dev/null +++ b/splunk/src/main/java/com/splunk/FiredAlertGroupCollection.java @@ -0,0 +1,44 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; +/** + * The {@code FiredAlertGroupCollection} class represents a collection of fired + * alert groups. + */ +public class FiredAlertGroupCollection + extends EntityCollection<FiredAlertGroup>{ + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + FiredAlertGroupCollection(Service service) { + super(service, "alerts/fired_alerts", FiredAlertGroup.class); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + FiredAlertGroupCollection(Service service, Args args) { + super(service, "alerts/fired_alerts", FiredAlertGroup.class, args); + } +} diff --git a/splunk/src/main/java/com/splunk/GeoIPDataModelCalculation.java b/splunk/src/main/java/com/splunk/GeoIPDataModelCalculation.java new file mode 100644 index 00000000..cad9f5bf --- /dev/null +++ b/splunk/src/main/java/com/splunk/GeoIPDataModelCalculation.java @@ -0,0 +1,39 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Map; + +/** + * Represents a GeoIP lookup on a data model object, which uses an input + * field to add geographic information to the output. + */ + +public class GeoIPDataModelCalculation extends DataModelCalculation { + private final String inputField; + + GeoIPDataModelCalculation(String[] ownerLineage, String calculationID, + Map<String, DataModelField> generatedFields, String comment, + boolean editable, String inputField) { + super(ownerLineage, calculationID, generatedFields, comment, editable); + this.inputField = inputField; + } + + /** + * @return field to do GeoIP lookup on + */ + public String getInputField() { return this.inputField; } +} diff --git a/splunk/com/splunk/HttpException.java b/splunk/src/main/java/com/splunk/HttpException.java similarity index 67% rename from splunk/com/splunk/HttpException.java rename to splunk/src/main/java/com/splunk/HttpException.java index 4323827e..4bdd7d17 100644 --- a/splunk/com/splunk/HttpException.java +++ b/splunk/src/main/java/com/splunk/HttpException.java @@ -19,6 +19,8 @@ import org.w3c.dom.Document; import org.w3c.dom.NodeList; +import java.io.*; + /** * Thrown for HTTP responses that return an error status code. */ @@ -41,15 +43,38 @@ public class HttpException extends RuntimeException { static HttpException create(ResponseMessage response) { int status = response.getStatus(); - // Attempt to read the error detail from the error response content. - String detail = ""; + StringBuilder s = new StringBuilder(); + InputStreamReader r; + try { + r = new InputStreamReader(response.getContent(), "UTF-8"); + } catch (UnsupportedEncodingException e1) { + throw new AssertionError("How does your system not support UTF-8?"); + } + + int c = -1; + while (true) { + try { + c = r.read(); + } catch (IOException e1) { + // Not much to be done here if that stream is bad... + } + if (c == -1) break; + + s.appendCodePoint(c); + } + + // Initialize detail with raw response data. Prevents XML parser failures. + String detail = s.toString(); try { - Document document = Xml.parse(response.getContent()); + // Attempt to read the error detail from the error response content as XML + Document document = Xml.parse(new ByteArrayInputStream(detail.getBytes()), true); NodeList msgs = document.getElementsByTagName("msg"); if (msgs.getLength() > 0) detail = msgs.item(0).getTextContent(); } - catch (Exception e) {} // Couldn't get detail + catch (Exception e) { + // Not an XML document; keep the raw string. + } String message = String.format("HTTP %d", status); diff --git a/splunk/src/main/java/com/splunk/HttpService.java b/splunk/src/main/java/com/splunk/HttpService.java new file mode 100644 index 00000000..70b99269 --- /dev/null +++ b/splunk/src/main/java/com/splunk/HttpService.java @@ -0,0 +1,614 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import javax.net.ssl.*; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.OutputStreamWriter; +import java.net.*; +import java.security.cert.X509Certificate; +import java.util.*; +import java.util.Map.Entry; + +/** + * The {@code HttpService} class represents a generic HTTP service at a given + * address ({@code host:port}), accessed using a given protocol scheme + * ({@code http} or {@code https}). + */ +public class HttpService { + // For debugging purposes + private static final boolean VERBOSE_REQUESTS = false; + protected static SSLSecurityProtocol sslSecurityProtocol = null; + + /** + * Boolean flag for validating certificates at either of the sides (client/server). + * If true, then it will check and validate relevant certificates otherwise, in case of false, it will accept all certificates. + * For PROD environment, TRUE is strongly recommended, whereas working in localhost OR development environment, FALSE is used. + * Default Value: TRUE + */ + protected static boolean validateCertificates = true; + + private static SSLSocketFactory sslSocketFactory = createSSLFactory(); + private static String HTTPS_SCHEME = "https"; + private static String HTTP_SCHEME = "http"; + private static List<String> VALID_HOSTS = new ArrayList<String>(Arrays.asList("localhost", "127.0.0.1", "::1")); + + private static final HostnameVerifier HOSTNAME_VERIFIER = new HostnameVerifier() { + public boolean verify(String s, SSLSession sslSession) { + if(VALID_HOSTS.contains(s)){ + return true; + } else { + HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier(); + return hv.verify(s, sslSession); + } + } + }; + + /** + * A variable to hold an optional custom HTTPS handler + */ + protected URLStreamHandler httpsHandler = null; + + /** + * The scheme used to access the service. + */ + protected String scheme = "https"; + + /** + * The host name of the service. + */ + protected String host = "localhost"; + + /** + * The port number of the service. + */ + protected int port = 8089; + + protected Integer connectTimeout = null; + protected Integer readTimeout = null; + + private String prefix = null; + + static Map<String, String> defaultHeader = new HashMap<String, String>() {{ + put("User-Agent", "splunk-sdk-java/1.9.5"); + put("Accept", "*/*"); + }}; + + protected Map<String, String> customHeaders = new HashMap<>(); + + protected SimpleCookieStore cookieStore = new SimpleCookieStore(); + + /** + * Constructs a new {@code HttpService} instance. + */ + public HttpService() { + } + + /** + * Constructs a new {@code HttpService} instance at the given host. + * + * @param host The host name of the service. + */ + public HttpService(String host) { + this.host = host; + } + + /** + * Constructs a new {@code HttpService} instance at the given host and port. + * + * @param host The host name of the service. + * @param port The port number of the service. + */ + public HttpService(String host, int port) { + this.host = host; + this.port = port; + } + + /** + * Constructs a new {@code HttpService} instance using the given host, + * port, and scheme. + * + * @param host The host name of the service. + * @param port The port number of the service. + * @param scheme Scheme for accessing the service ({@code http} or + * {@code https}). + */ + public HttpService(String host, int port, String scheme) { + this.host = host; + this.port = port; + this.scheme = scheme; + } + + /** + * Constructs a new {@code HttpService} instance using the given host, + * port, and scheme, and instructing it to use the specified HTTPS handler. + * + * @param host The host name of the service. + * @param port The port number of the service. + * @param scheme Scheme for accessing the service ({@code http} or + * {@code https}). + * @param httpsHandler A custom URL Stream handler. + */ + public HttpService(String host, int port, String scheme, + URLStreamHandler httpsHandler) { + this.host = host; + this.port = port; + this.scheme = scheme; + this.httpsHandler = httpsHandler; + } + + // Returns the count of arguments in the given {@code args} map. + private static int count(Map<String, Object> args) { + if (args == null) return 0; + return args.size(); + } + + /** + * Issues an HTTP GET request against the service using a given path. + * + * @param path The request path. + * @return The HTTP response. + */ + public ResponseMessage get(String path) { + return send(path, new RequestMessage("GET")); + } + + /** + * Issues an HTTP GET request against the service using a given path and + * query arguments. + * + * @param path The request path. + * @param args The query arguments. + * @return The HTTP response. + */ + public ResponseMessage get(String path, Map<String, Object> args) { + if (count(args) > 0) + path = path + "?" + Args.encode(args); + RequestMessage request = new RequestMessage("GET"); + return send(path, request); + } + + /** + * Returns the host name of this service. + * + * @return The host name. + */ + public String getHost() { + return this.host; + } + + /** + * Returns the port number of this service. + * + * @return The port number. + */ + public int getPort() { + return this.port; + } + + /** + * Sets Custom Headers of this service + * + * @param headers The custom headers. + */ + public void setCustomHeaders(Map<String, String> headers) { + if (Objects.nonNull(headers)) { + customHeaders = headers; + } + } + + /** + * Returns the SSL security protocol of this service. + * + * @return The SSL security protocol. + */ + public static SSLSecurityProtocol getSslSecurityProtocol() { + return sslSecurityProtocol; + } + + /** + * Sets the SSL security protocol of this service. + * @param securityProtocol The SSLSecurityProtocal instance + */ + public static void setSslSecurityProtocol(SSLSecurityProtocol securityProtocol) { + // Only update the SSL_SOCKET_FACTORY if changing protocols + if (sslSecurityProtocol != securityProtocol) { + sslSecurityProtocol = securityProtocol; + sslSocketFactory = createSSLFactory(); + } + } + + /** + * Adds list of Cluster Master Hosts to the list of Valid Hosts for Hostname verification. + * @param searchHeadService Splunk SearchHead Service instance + */ + public static void addClusterMasterURIsToHosts(Service searchHeadService){ + VALID_HOSTS.addAll(searchHeadService.getClusterMasters()); + } + + /** + * Returns the URL prefix of this service, consisting of + * {@code scheme://host[:port]}. + * + * @return The URL prefix. + */ + public String getPrefix() { + if (this.prefix == null) + this.prefix = String.format("%s://%s:%s", + this.scheme, this.host, this.port); + return this.prefix; + } + + /** + * Returns the scheme used by this service. + * + * @return The scheme. + */ + public String getScheme() { + return this.scheme; + } + + /** + * Constructs a fully-qualified URL for this service using a given path. + * + * @param path The path to qualify. + * @return The fully-qualified URL for the service. + */ + public URL getUrl(String path) { + try { + if (HTTPS_SCHEME.equals(getScheme()) && httpsHandler != null) { + // This branch is not currently covered by unit tests as I + // could not figure out a generic way to get the default + // HTTPS handler. + return new URL(getScheme(), getHost(), getPort(), path, + httpsHandler); + } else { + return new URL(getScheme(), getHost(), getPort(), path); + } + } catch (MalformedURLException e) { + throw new RuntimeException(e.getMessage(), e); + } + } + + /** + * Returns all the stored custom headers + * + * @return customHeaders The custom headers + */ + public Map<String, String> getCustomHeaders() { + return customHeaders; + } + + /** + * Returns all the stored cookies + * + * @return All cookies as in a string in the format key=value; key=value; etc=etc + */ + public String stringifyCookies() { + return cookieStore.getCookies(); + } + + /** + * Adds the passed cookie header to the cookieStore + * + * @param setCookieHeader The result from a getRequestHeader("Set-Cookie") call + */ + public void addCookie(String setCookieHeader) { + cookieStore.add(setCookieHeader); + } + + /** + * Removes all cookies from the cookieStore + */ + public void removeAllCookies() { + cookieStore.removeAll(); + } + + /** + * Returns true if the cookieStore has any Splunk Authorization cookies, false otherwise + * + * @return True if there are cookies, false otherwise + */ + public Boolean hasSplunkAuthCookies() { + return cookieStore.hasSplunkAuthCookie(); + } + + /** + * Returns the connect timeout used by this service. + * + * @return The timeout in milliseconds. + */ + public Integer getConnectTimeout() { + return connectTimeout; + } + + /** + * Sets a specified timeout value, in milliseconds, to be used when opening a communications link. + * + * @param connectTimeout timeout in milliseconds, a timeout of zero is interpreted as an infinite timeout. + */ + public void setConnectTimeout(Integer connectTimeout) { + this.connectTimeout = connectTimeout; + } + + /** + * Returns the read timeout used by this service. + * + * @return The timeout in milliseconds. + */ + public Integer getReadTimeout() { + return readTimeout; + } + + /** + * Sets a specified timeout value, in milliseconds, to be used when reading from a communications link. + * + * @param readTimeout timeout in milliseconds, a timeout of zero is interpreted as an infinite timeout. + */ + public void setReadTimeout(Integer readTimeout) { + this.readTimeout = readTimeout; + } + + /** + * Issues a POST request against the service using a given path. + * + * @param path The request path. + * @return The HTTP response. + */ + public ResponseMessage post(String path) { + return post(path, null); + } + + /** + * Issues a POST request against the service using a given path and + * form arguments. + * + * @param path The request path. + * @param args The form arguments. + * @return The HTTP response. + */ + public ResponseMessage post(String path, Map<String, Object> args) { + RequestMessage request = new RequestMessage("POST"); + request.getHeader().put( + "Content-Type", "application/x-www-form-urlencoded"); + if (count(args) > 0) + request.setContent(Args.encode(args)); + return send(path, request); + } + + /** + * Issues a DELETE request against the service using a given path. + * + * @param path The request path. + * @return The HTTP response. + */ + public ResponseMessage delete(String path) { + RequestMessage request = new RequestMessage("DELETE"); + return send(path, request); + } + + /** + * Issues a DELETE request against the service using a given path + * and query arguments. + * + * @param path The request path. + * @param args The query arguments. + * @return The HTTP response. + */ + public ResponseMessage delete(String path, Map<String, Object> args) { + if (count(args) > 0) + path = path + "?" + Args.encode(args); + RequestMessage request = new RequestMessage("DELETE"); + return send(path, request); + } + + /** + * Opens a socket to this service. + * + * @return The socket. + * @throws IOException + */ + Socket open() throws IOException { + if (this.scheme.equals("https")) { + return sslSocketFactory.createSocket(this.host, this.port); + } + return new Socket(this.host, this.port); + } + + /** + * Issue an HTTP request against the service using a given path and + * request message. + * + * @param path The request path. + * @param request The request message. + * @return The HTTP response. + */ + public ResponseMessage send(String path, RequestMessage request) { + // Construct a full URL to the resource + URL url = getUrl(path); + // Create and initialize the connection object + HttpURLConnection cn; + try { + cn = (HttpURLConnection) url.openConnection(); + } catch (IOException e) { + throw new RuntimeException(e.getMessage(), e); + } + if (cn instanceof HttpsURLConnection) { + ((HttpsURLConnection) cn).setSSLSocketFactory(sslSocketFactory); + ((HttpsURLConnection) cn).setHostnameVerifier(HOSTNAME_VERIFIER); + } + cn.setUseCaches(false); + cn.setAllowUserInteraction(false); + cn.setConnectTimeout(connectTimeout == null ? 0 : connectTimeout); + cn.setReadTimeout(readTimeout == null ? 0 : readTimeout); + + // Set the request method + String method = request.getMethod(); + try { + cn.setRequestMethod(method); + } catch (ProtocolException e) { + throw new RuntimeException(e.getMessage(), e); + } + + // Add headers from request message + Map<String, String> header = request.getHeader(); + for (Entry<String, String> entry : header.entrySet()) + cn.setRequestProperty(entry.getKey(), entry.getValue()); + // Add default headers that were absent from the request message + for (Entry<String, String> entry : defaultHeader.entrySet()) { + String key = entry.getKey(); + if (header.containsKey(key)) continue; + cn.setRequestProperty(key, entry.getValue()); + } + // Add Custom Headers + for (Entry<String, String> entry: customHeaders.entrySet()) { + String key = entry.getKey(); + if (!header.containsKey(key)) { + cn.setRequestProperty(key, entry.getValue()); + } + } + + // Add cookies to header + cn.setRequestProperty("Cookie", cookieStore.getCookies()); + + // Write out request content, if any + try { + Object content = request.getContent(); + if (content != null) { + cn.setDoOutput(true); + OutputStream stream = cn.getOutputStream(); + OutputStreamWriter writer = new OutputStreamWriter(stream, "UTF-8"); + writer.write((String) content); + writer.close(); + } + } catch (IOException e) { + throw new RuntimeException(e.getMessage(), e); + } + + if (VERBOSE_REQUESTS) { + System.out.format("%s %s => ", method, url.toString()); + } + + // Execute the request + try { + cn.connect(); + } catch (IOException e) { + throw new RuntimeException(e.getMessage(), e); + } + + int status; + try { + status = cn.getResponseCode(); + } catch (IOException e) { + throw new RuntimeException(e.getMessage(), e); + } + + InputStream input = null; + try { + input = status >= 400 + ? cn.getErrorStream() + : cn.getInputStream(); + } catch (IOException e) { + assert (false); + } + + // Add cookies to cookie Store + Map<String, List<String>> headers = cn.getHeaderFields(); + if (headers.containsKey("Set-Cookie")) { + for (String cookieHeader : headers.get("Set-Cookie")) { + if (cookieHeader != null && cookieHeader.length() > 0) + cookieStore.add(cookieHeader); + } + } + + ResponseMessage response = new ResponseMessage(status, input); + + if (VERBOSE_REQUESTS) { + System.out.format("%d\n", status); + if (method.equals("POST")) { + System.out.println(" " + request.getContent()); + } + } + + if (status >= 400) + throw HttpException.create(response); + + return response; + } + + public static void setSSLSocketFactory(SSLSocketFactory sslSocketFactory) { + if (sslSocketFactory == null) + throw new IllegalArgumentException("The sslSocketFactory cannot be null."); + HttpService.sslSocketFactory = sslSocketFactory; + } + + public static SSLSocketFactory getSSLSocketFactory() { + return HttpService.sslSocketFactory; + } + + public static void setValidateCertificates(boolean validateCertificate) { + // update the SSL_SOCKET_FACTORY if validateCertificates flag is changed + if (validateCertificates != validateCertificate) { + validateCertificates = validateCertificate; + sslSocketFactory = createSSLFactory(); + } + } + + public static SSLSocketFactory createSSLFactory() { + + try { + SSLContext context; + if (sslSecurityProtocol != null) { + String contextStr = sslSecurityProtocol.toString().contains("SSL") ? "SSL" : "TLS"; + context = SSLContext.getInstance(contextStr); + } else if (System.getProperty("java.version").compareTo("1.8") >= 0) { + context = SSLContext.getInstance("TLS"); + } else { + context = SSLContext.getDefault(); + } + + if (validateCertificates) { + context.init(null, null, null); + // For now this check is set as null. + // TODO: Implementation logic for validating client certificate. + } else { + TrustManager[] trustAll = new TrustManager[]{ + new X509TrustManager() { + public X509Certificate[] getAcceptedIssuers() { + return null; + } + + public void checkClientTrusted(X509Certificate[] certs, String authType) { + } + + public void checkServerTrusted(X509Certificate[] certs, String authType) { + } + } + }; + context.init(null, trustAll, null); + } + + return context.getSocketFactory(); + } catch (Exception e) { + throw new RuntimeException("Error setting up SSL socket factory: " + e, e); + } + } + +} + diff --git a/splunk/src/main/java/com/splunk/IPv4Comparison.java b/splunk/src/main/java/com/splunk/IPv4Comparison.java new file mode 100644 index 00000000..f1ef9998 --- /dev/null +++ b/splunk/src/main/java/com/splunk/IPv4Comparison.java @@ -0,0 +1,43 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * Comparison operators that apply to IPv4 values in data models and pivots. + */ +public enum IPv4Comparison { + IS { + public String toString() { return "is"; } + }, + CONTAINS { + public String toString() { return "contains"; } + }, + IS_NOT { + public String toString() { return "isNot"; } + }, + DOES_NOT_CONTAIN { + public String toString() { return "doesNotContain"; } + }, + STARTS_WITH { + public String toString() { return "startsWith"; } + }, + IS_NULL { + public String toString() { return "isNull"; } + }, + IS_NOT_NULL { + public String toString() { return "isNotNull"; } + } +} diff --git a/splunk/src/main/java/com/splunk/IPv4PivotFilter.java b/splunk/src/main/java/com/splunk/IPv4PivotFilter.java new file mode 100644 index 00000000..9fe794d4 --- /dev/null +++ b/splunk/src/main/java/com/splunk/IPv4PivotFilter.java @@ -0,0 +1,55 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +import java.net.Inet4Address; + +/** + * Represents a filter on an IPv4 valued field in a pivot. + */ +public class IPv4PivotFilter extends PivotFilter { + private final IPv4Comparison comparison; + private final String comparisonValue; + + IPv4PivotFilter(DataModelObject dataModelObject, String field, IPv4Comparison comparison, String comparisonValue) { + super(dataModelObject, field); + if (dataModelObject.getField(field).getType() != FieldType.IPV4) { + throw new IllegalArgumentException("Field " + field + " on the data model object was of type " + + dataModelObject.getField(field).getType().toString() + ", expected ipv4."); + } + this.comparison = comparison; + this.comparisonValue = comparisonValue; + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + JsonObject filterRule = new JsonObject(); + filterRule.add("comparator", new JsonPrimitive(this.comparison.toString())); + filterRule.add("compareTo", new JsonPrimitive(this.comparisonValue)); + + root.add("rule", filterRule); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/Index.java b/splunk/src/main/java/com/splunk/Index.java new file mode 100644 index 00000000..f39dd2e7 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Index.java @@ -0,0 +1,1118 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.OutputStream; +import java.net.Socket; +import java.util.Date; + +/** + * The {@code Index} class represents an index. + */ +public class Index extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The index endpoint. + */ + Index(Service service, String path) { + super(service, path); + } + + /** + * Creates a writable socket to this index. + * + * @return The writable socket. + * @throws IOException Throws exception if fails to write socket. + */ + public Socket attach() throws IOException { + Receiver receiver = service.getReceiver(); + return receiver.attach(getName()); + } + + /** + * Writes events to this index, reusing the connection. + * This method passes an output stream connected to the index to the + * {@code run} method of the {@code ReceiverBehavior} object, then handles + * setting up and tearing down the socket. + * <p> + * For an example of how to use this method, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" target="_blank">How to + * get data into Splunk</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" + * target="_blank">dev.splunk.com</a>. + * + * @param behavior The body of a {@code try} block as an anonymous + * implementation of the {@code ReceiverBehavior} interface. + * @throws IOException The IOException class + */ + public void attachWith(ReceiverBehavior behavior) throws IOException { + Socket socket = null; + OutputStream output = null; + try { + socket = attach(); + output = socket.getOutputStream(); + behavior.run(output); + output.flush(); + } finally { + if (output != null) { output.close(); } + if (socket != null) { socket.close(); } + } + } + + /** + * Creates a writable socket to this index. + * + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @return The socket. + * @throws IOException The IOException class + */ + public Socket attach(Args args) throws IOException { + Receiver receiver = service.getReceiver(); + return receiver.attach(getName(), args); + } + + /** + * Cleans this index, which removes all events from it. + * + * @param maxSeconds The maximum number of seconds to wait before returning. + * A value of -1 means to wait forever. + * @throws SplunkException If cleaning timed out or + * if the thread was interrupted. + * @return This index. + */ + public Index clean(int maxSeconds) { + Args saved = new Args(); + saved.put("maxTotalDataSizeMB", getMaxTotalDataSizeMB()); + saved.put("frozenTimePeriodInSecs", getFrozenTimePeriodInSecs()); + try { + Args reset = new Args(); + reset.put("maxTotalDataSizeMB", "1"); + reset.put("frozenTimePeriodInSecs", "1"); + update(reset); + rollHotBuckets(); + + long startTime = System.currentTimeMillis(); + long endTime = startTime + (maxSeconds * 1000); + while (true) { + long timeLeft = endTime - System.currentTimeMillis(); + if (timeLeft <= 0) { + break; + } + Thread.sleep(Math.min(1000, timeLeft)); + + if (this.getTotalEventCount() == 0) { + return this; + } + refresh(); + } + + throw new SplunkException(SplunkException.TIMEOUT, + "Index cleaning timed out"); + } + catch (InterruptedException e) + { + SplunkException f = new SplunkException( + SplunkException.INTERRUPTED, + "Index cleaning interrupted."); + f.initCause(e); + throw f; + } + finally { + update(saved); + } + } + + /** + * Indicates whether the data retrieved from this index has been + * UTF8-encoded. + * + * @return {@code true} if the retrieved data is in UTF8, {@code false} if + * not. + */ + public boolean getAssureUTF8() { + return getBoolean("assureUTF8"); + } + + /** + * Returns the total size of all bloom filter files. + * + * @return The total size of all bloom filter files, in KB. + */ + public int getBloomfilterTotalSizeKB() { + return getInteger("bloomfilterTotalSizeKB", 0); + } + + /** + * Returns the suggested size of the .tsidx file for the bucket rebuild + * process. + * Valid values are: "auto", a positive integer, or a positive + * integer followed by "KB", "MB", or "GB". + * + * @return The suggested size of the .tsidx file for the bucket rebuild + * process. + */ + public String getBucketRebuildMemoryHint() { + return getString("bucketRebuildMemoryHint"); + } + + /** + * Returns the absolute file path to the cold database for this index. + * This value may contain shell expansion terms. + * + * @return The absolute file path to the cold database, or {@code null} if + * not specified. + */ + public String getColdPath() { + return getString("coldPath", null); + } + + /** + * Returns the expanded absolute file path to the cold database for this + * index. + * + * @return The expanded absolute file path to the cold database, or + * {@code null} if not specified. + */ + public String getColdPathExpanded() { + return getString("coldPath_expanded", null); + } + + /** + * Returns the frozen archive destination path for this index. + * + * @return The frozen archive destination path, or {@code null} if not + * specified. + */ + public String getColdToFrozenDir() { + return getString("coldToFrozenDir", null); + } + + /** + * Returns the path to the archiving script. + * <p>For more info about archiving scripts, see the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTindex#POST_data.2Findexes" + * target="_blank">POST data/indexes endpoint</a> in the REST API + * documentation. + * @see #getColdToFrozenDir + * + * @return The archiving script, or {@code null} if not specified. + */ + public String getColdToFrozenScript() { + return getString("coldToFrozenScript", null); + } + + /** + * Indicates whether raw data is compressed. + * + * @deprecated Splunk always compresses raw data. + * @return {@code true} if raw data is compressed, {@code false} if not. + */ + public boolean getCompressRawdata() { + return getBoolean("compressRawdata"); + } + + /** + * Returns the current size of this index. + * + * @return The current size of the index, in MB. + */ + public int getCurrentDBSizeMB() { + return getInteger("currentDBSizeMB"); + } + + /** + * Return the default index name of the Splunk instance. + * + * @return The default index name. + */ + public String getDefaultDatabase() { + return getString("defaultDatabase"); + } + + /** + * Returns whether asynchronous "online fsck" bucket repair is enabled. + * <p> + * When this feature is enabled, you don't have to wait for buckets to be + * repaired before starting Splunk, but you might notice a slight + * degradation in performance as a result. + * @return {@code true} if bucket repair is enabled, {@code false} if + * not. + */ + public boolean getEnableOnlineBucketRepair() { + + return getBoolean("enableOnlineBucketRepair"); + } + + /** + * Indicates whether real-time search is enabled for this index. + * + * @return {@code true} if real-time search is enabled, {@code false} if + * not. + */ + public boolean getEnableRealtimeSearch() { + return getBoolean("enableRealtimeSearch"); + } + + /** + * Returns the maximum age for a bucket, after which the data in this index + * rolls to frozen. If archiving is necessary for frozen data, see the + * {@code coldToFrozen} attributes. + * + * @return The maximum age, in seconds, after which data rolls to frozen. + */ + public int getFrozenTimePeriodInSecs() { + return getInteger("frozenTimePeriodInSecs"); + } + + /** + * Returns the absolute path to both hot and warm buckets for this index. + * This value may contain shell expansion terms. + * + * @return This index's absolute path to both hot and warm buckets, or + * {@code null} if not specified. + */ + public String getHomePath() { + return getString("homePath", null); + } + + /** + * Returns the expanded absolute path to both hot and warm buckets for this + * index. + * + * @return The expanded absolute path to both hot and warm buckets, or + * {@code null} if not specified. + */ + public String getHomePathExpanded() { + return getString("homePath_expanded", null); + } + + /** + * Returns the index thread for this index. + * + * @return The index thread. + */ + public String getIndexThreads() { + return getString("indexThreads"); + } + + /** + * Returns the last initialization time for this index. + * + * @return The last initialization time, or {@code null} if not specified. + */ + public String getLastInitTime() { + return getString("lastInitTime", null); + } + + /** + * Returns the time that indicates a bucket age. When a warm or cold bucket + * is older than this, Splunk does not create or rebuild its bloomfilter. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). For example, "30d" for 30 days. + * @return String value + */ + public String getMaxBloomBackfillBucketAge() { + return getString("maxBloomBackfillBucketAge", null); + } + + /** + * Returns the maximum number of concurrent optimize processes that + * can run against a hot bucket for this index. + * + * @return The maximum number of concurrent optimize processes. + */ + public int getMaxConcurrentOptimizes() { + return getInteger("maxConcurrentOptimizes"); + } + + /** + * Returns the maximum data size before triggering a roll from hot to warm + * buckets for this index. + * + * @return The maximum data size, in MB, or "auto" (which means 750MB), or + * "auto_high_volume" (which means 10GB on a 64-bit system, or 1GB on a + * 32-bit system). + * @see #setMaxDataSize + */ + public String getMaxDataSize() { + return getString("maxDataSize"); + } + + /** + * Returns the maximum number of hot buckets that can exist for this index. + * + * @return The maximum number of hot buckets or "auto" (which means 3). + */ + public String getMaxHotBuckets() { + return getString("maxHotBuckets"); + } + + /** + * Returns the maximum lifetime of a hot bucket for this index. + * If a hot bucket exceeds this value, Splunk rolls it to warm. + * A value of 0 means an infinite lifetime. + * + * @return The hot bucket's maximum lifetime, in seconds. + */ + public int getMaxHotIdleSecs() { + return getInteger("maxHotIdleSecs"); + } + + /** + * Returns the upper bound of the target maximum timespan of + * hot and warm buckets for this index. + * + * @return The upper bound of the target maximum timespan, in seconds. + */ + public int getMaxHotSpanSecs() { + return getInteger("maxHotSpanSecs"); + } + + /** + * Returns the amount of memory to allocate for buffering + * a single .tsidx file into memory before flushing to disk. + * + * @return The amount of memory, in MB. + */ + public int getMaxMemMB() { + return getInteger("maxMemMB"); + } + + /** + * Returns the maximum number of unique lines that are allowed + * in a bucket's .data files for this index. A value of 0 means infinite + * lines. + * + * @return The maximum number of unique lines. + */ + public int getMaxMetaEntries() { + return getInteger("maxMetaEntries"); + } + + /** + * Returns the maximum number of concurrent helper processes for this index. + * + * @return The maximum number of concurrent helper processes. + */ + public int getMaxRunningProcessGroups() { + return getInteger("maxRunningProcessGroups", 0); + } + + /** + * Returns the maximum time attribute for this index. + * + * @return The maximum time attribute, or {@code null} if not specified. + */ + public Date getMaxTime() { + return getDate("maxTime", null); + } + + /** + * Returns the maximum size of this index. If an index + * grows larger than this value, the oldest data is frozen. + * + * @return The maximum index size, in MB. + */ + public int getMaxTotalDataSizeMB() { + return getInteger("maxTotalDataSizeMB"); + } + + /** + * Returns the upper limit, in seconds, for how long an event can sit in a + * raw slice. This value applies only when replication is enabled for this + * index, and is ignored otherwise.<br> + * If there are any acknowledged events sharing this raw slice, the + * {@code MaxTimeUnreplicatedWithAcksparamater} applies instead. + * @see #getMaxTimeUnreplicatedWithAcks + * @return int value + */ + public int getMaxTimeUnreplicatedNoAcks() { + return getInteger("maxTimeUnreplicatedNoAcks"); + } + + /** + * Returns the upper limit, in seconds, for how long an event can sit + * unacknowledged in a raw slice. This value only applies when indexer + * acknowledgement is enabled on forwarders and replication is enabled with + * clustering. + * @return int value + */ + public int getMaxTimeUnreplicatedWithAcks() { + return getInteger("maxTimeUnreplicatedWithAcks"); + } + + /** + * Returns the maximum number of warm buckets for this index. If this + * value is exceeded, the warm buckets with the lowest value for their + * latest times are moved to cold. + * + * @return The maximum number of warm buckets. + */ + public int getMaxWarmDBCount() { + return getInteger("maxWarmDBCount"); + } + + /** + * Returns the memory pool for this index. + * + * @return The memory pool, in MB or "auto". + */ + public String getMemPoolMB() { + return getString("memPoolMB"); + } + + /** + * Returns the frequency at which Splunkd forces a filesystem sync while + * compressing journal slices for this index. + * <p> + * A value of "disable" disables this feature completely, while a value of 0 + * forces a file-system sync after completing compression of every journal + * slice. + * + * @return The file-system sync frequency, as an integer or "disable". + */ + public String getMinRawFileSyncSecs() { + return getString("minRawFileSyncSecs"); + } + + /** + * Returns the minimum time attribute for this index. + * + * @return The minimum time attribute, or {@code null} if not specified. + */ + public Date getMinTime() { + return getDate("minTime", null); + } + + /** + * Returns the number of hot buckets that were created for this index. + * + * @return The number of hot buckets. + */ + public int getNumHotBuckets() { + return getInteger("numHotBuckets", 0); + } + + /** + * Returns the number of warm buckets created for this index. + * + * @return The number of warm buckets. + */ + public int getNumWarmBuckets() { + return getInteger("numWarmBuckets", 0); + } + + /** + * Returns the number of bloom filters created for this index. + * + * @return The number of bloom filters. + */ + public int getNumBloomfilters() { + return getInteger("numBloomfilters", 0); + } + + /** + * Returns the frequency at which metadata is for partially synced (synced + * in-place) for this index. A value of 0 disables partial syncing, so + * metadata is only synced on the {@code ServiceMetaPeriod} interval. + * @see #getServiceMetaPeriod + * @see #setServiceMetaPeriod + * + * @return The metadata sync interval, in seconds. + */ + public int getPartialServiceMetaPeriod() { + return getInteger("partialServiceMetaPeriod"); + } + + /** + * Returns the future event-time quarantine for this index. Events + * that are newer than now plus this value are quarantined. + * + * @return The future event-time quarantine, in seconds. + */ + public int getQuarantineFutureSecs() { + return getInteger("quarantineFutureSecs"); + } + + /** + * Returns the past event-time quarantine for this index. Events + * that are older than now minus this value are quarantined. + * + * @return The past event-time quarantine, in seconds. + */ + public int getQuarantinePastSecs() { + return getInteger("quarantinePastSecs"); + } + + /** + * Returns the target uncompressed size of individual raw slices in the + * rawdata journal for this index. + * + * @return The target uncompressed size, in bytes. + */ + public int getRawChunkSizeBytes() { + return getInteger("rawChunkSizeBytes"); + } + + /** + * Returns the frequency to check for the need to create a new hot bucket + * and the need to roll or freeze any warm or cold buckets for this index. + * + * @return The check frequency, in seconds. + */ + public int getRotatePeriodInSecs() { + return getInteger("rotatePeriodInSecs"); + } + + /** + * Returns the frequency at which metadata is synced to disk for this index. + * + * @return The meta data sync frequency, in seconds. + */ + public int getServiceMetaPeriod() { + return getInteger("serviceMetaPeriod"); + } + + /** + * Returns a list of indexes that suppress "index missing" messages. + * + * @return A comma-separated list of indexes. + */ + public String getSuppressBannerList() { + return getString("suppressBannerList", null); + } + + /** + * Returns the number of events that trigger the indexer to sync events. + * This value is global, not a per-index value. + * + * @return The number of events that trigger the indexer to sync events. + */ + public int getSync() { + return getInteger("sync"); + } + + /** + * Indicates whether the sync operation is called before the file + * descriptor is closed on metadata updates. + * + * @return {@code true} if the sync operation is called before the file + * descriptor is closed on metadata updates, {@code false} if not. + */ + public boolean getSyncMeta() { + return getBoolean("syncMeta"); + } + + /** + * Returns the absolute path to the thawed index for this index. This value + * may contain shell expansion terms. + * + * @return The absolute path to the thawed index, or {@code null} if not + * specified. + */ + public String getThawedPath() { + return getString("thawedPath", null); + } + + /** + * Returns the expanded absolute path to the thawed index for this index. + * + * @return The expanded absolute path to the thawed index, or {@code null} + * if not specified. + */ + public String getThawedPathExpanded() { + return getString("thawedPath_expanded", null); + } + + /** + * Returns the frequency at which Splunk checks for an index throttling + * condition. + * + * @return The frequency of the throttling check, in seconds. + */ + public int getThrottleCheckPeriod() { + return getInteger("throttleCheckPeriod"); + } + + /** + * Returns the total event count for this index. + * + * @return The total event count. + */ + public int getTotalEventCount() { + return getInteger("totalEventCount"); + } + + /** + * Indicates whether this index is an internal index. + * + * @return {@code true} if this index is an internal index, {@code false} + * if not. + */ + public boolean isInternal() { + return getBoolean("isInternal"); + } + + /** + * Performs rolling hot buckets for this index. + */ + public void rollHotBuckets() { + ResponseMessage response = service.post(path + "/roll-hot-buckets"); + assert(response.getStatus() == 200); + } + + /** + * Sets whether the data retrieved from this index is UTF8-encoded. + * <p> + * <b>Note:</b> Indexing performance degrades when this parameter is set to + * {@code true}. + * + * In Splunk 5.0 and later, this is a global property and cannot be set on + * a per-index basis. + * + * @param assure {@code true} to ensure UTF8 encoding, {@code false} if not. + */ + public void setAssureUTF8(boolean assure) { + setCacheValue("assureUTF8", assure); + } + + /** + * Sets the number of events that make up a block for block signatures. A + * value of 100 is recommended. A value of 0 disables block signing for this + * index. + * + * @param value The event count for block signing. + */ + public void setBlockSignSize(int value) { + setCacheValue("blockSignSize", value); + } + + + /** + * Sets the suggested size of the .tsidx file for the bucket rebuild + * process. + * + * Valid values are: "auto", a positive integer, or a positive + * integer followed by "KB", "MB", or "GB". + * + * @param value The suggested size of the .tsidx file for the bucket rebuild + * process. + */ + public void setBucketRebuildMemoryHint(String value) { + setCacheValue("bucketRebuildMemoryHint", value); + } + + /** + * Sets the destination path for the frozen archive, where Splunk + * automatically puts frozen buckets. The bucket freezing policy is as + * follows: + * <ul><li><b>New-style buckets (4.2 and later):</b> All files are removed + * except the raw data. To thaw frozen buckets, run {@code Splunk rebuild + * <bucket dir>} on the bucket, then move the buckets to the thawed + * directory.</li> + * <li><b>Old-style buckets (4.1 and earlier):</b> gzip all the .data and + * .tsidx files. To thaw frozen buckets, gunzip the zipped files and move + * the buckets to the thawed directory.</li></ul> + * If both {@code coldToFrozenDir} and {@code coldToFrozenScript} are + * specified, {@code coldToFrozenDir} takes precedence. + * @see #setColdToFrozenScript + * @see #getColdToFrozenScript + * + * @param destination The destination path for the frozen archive. + */ + public void setColdToFrozenDir(String destination) { + setCacheValue("coldToFrozenDir", destination); + } + + /** + * Sets the path to the archiving script. + * <p>For more info about archiving scripts, see the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTindex#POST_data.2Findexes" + * target="_blank">POST data/indexes endpoint</a> in the REST API + * documentation. + * @see #setColdToFrozenDir + * @see #getColdToFrozenDir + * + * @param script The path to the archiving script. + */ + public void setColdToFrozenScript(String script) { + setCacheValue("coldToFrozenScript", script); + } + + /** + * Sets whether asynchronous "online fsck" bucket repair is enabled. + * <p> + * When this feature is enabled, you don't have to wait for buckets to be + * repaired before starting Splunk, but you might notice a slight + * degradation in performance as a result. + * + * @param value {@code true} to enable online bucket repair, {@code false} + * if not. + */ + public void setEnableOnlineBucketRepair(boolean value) { + setCacheValue("enableOnlineBucketRepair", value); + } + + /** + * Sets the maximum age for a bucket, after which the data in this index + * rolls to frozen. Freezing data removes it from the index. To archive + * data, see {@code coldToFrozenDir} and {@code coldToFrozenScript}. + * @see #setColdToFrozenDir + * @see #setColdToFrozenScript + * + * @param seconds The time, in seconds, after which indexed data rolls to + * frozen. + */ + public void setFrozenTimePeriodInSecs(int seconds) { + setCacheValue("frozenTimePeriodInSecs", seconds); + } + + /** + * Sets the time that indicates a bucket age. When a warm or cold bucket + * is older than this, Splunk does not create or rebuild its bloomfilter. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). For example, "30d" for 30 days. + * @param time The time that indicates a bucket age. + */ + public void setMaxBloomBackfillBucketAge(String time) { + setCacheValue("maxBloomBackfillBucketAge", time); + } + + /** + * Sets the number of concurrent optimize processes that can run against + * a hot bucket for this index. + * + * @param processes The number of concurrent optimize processes. + */ + public void setMaxConcurrentOptimizes(int processes) { + setCacheValue("maxConcurrentOptimizes", processes); + } + + /** + * Sets the maximum data size before triggering a roll from hot to warm + * buckets for this index. You can also specify a value to let Splunk + * autotune this parameter: use "auto_high_volume" for high-volume indexes + * (such as the main index, or one that gets over 10GB of data per day); + * otherwise, use "auto". + * @see #getMaxDataSize + * + * @param size The size in MB, or an autotune string. + */ + public void setMaxDataSize(String size) { + setCacheValue("maxDataSize", size); + } + + /** + * Sets the maximum number of hot buckets that can exist per index. + * <p> + * When {@code maxHotBuckets} is exceeded, Splunk rolls the least recently + * used (LRU) hot bucket to warm. Both normal hot buckets and quarantined + * hot buckets count towards this total. This setting operates independently + * of {@code MaxHotIdleSecs}, which can also cause hot buckets to roll. + * @see #setMaxHotIdleSecs + * @see #getMaxHotIdleSecs + * + * @param size The maximum number of hot buckets per index, or an 'auto' string. + */ + public void setMaxHotBuckets(String size) { + setCacheValue("maxHotBuckets", size); + } + + /** + * Sets the maximum lifetime of a hot bucket for this index. + * <p> + * If a hot bucket exceeds this value, Splunk rolls it to warm. + * This setting operates independently of {@code MaxHotBuckets}, which can + * also cause hot buckets to roll. + * @see #setMaxHotBuckets + * @see #getMaxHotBuckets + * + * @param seconds The hot bucket's maximum lifetime, in seconds. A value of + * 0 means an infinite lifetime. + */ + public void setMaxHotIdleSecs(int seconds) { + setCacheValue("maxHotIdleSecs", seconds); + } + + /** + * Sets the upper bound of the target maximum timespan of hot and warm + * buckets for this index. + * <p> + * <b>Note:</b> If you set this too small, you can get an explosion of + * hot and warm buckets in the file system. The system sets a lower bound + * implicitly for this parameter at 3600, but this advanced parameter should + * be set with care and understanding of the characteristics of your data. + * + * @param seconds The upper bound of the target maximum timespan, in + * seconds. + */ + public void setMaxHotSpanSecs(int seconds) { + setCacheValue("maxHotSpanSecs", seconds); + } + + /** + * Sets the amount of memory allocated for buffering a single .tsidx + * file before flushing to disk. + * + * @param memory The amount of memory, in MB. + */ + public void setMaxMemMB(int memory) { + setCacheValue("maxMemMB", memory); + } + + /** + * Sets the maximum number of unique lines in .data files in a bucket, which + * may help to reduce memory consumption. + * <p> + * If this value is exceeded, a hot bucket is rolled to prevent a further + * increase. If your buckets are rolling due to Strings.data hitting this + * limit, the culprit might be the "punct" field in your data. If you don't + * use that field, it might be better to just disable this (see the + * props.conf.spec in $SPLUNK_HOME/etc/system/README). + * + * @param entries The maximum number of unique lines. A value of 0 means + * infinite lines. + */ + public void setMaxMetaEntries(int entries) { + setCacheValue("maxMetaEntries", entries); + } + + + /** + * Sets the upper limit for how long an event can sit in a + * raw slice. This value applies only when replication is enabled for this + * index, and is ignored otherwise.<br> + * If there are any acknowledged events sharing this raw slice, the + * {@code MaxTimeUnreplicatedWithAcksparamater} applies instead. + * + * @param value The upper limit, in seconds. A value of 0 disables this + * setting. + */ + public void setMaxTimeUnreplicatedNoAcks(int value) { + setCacheValue("maxTimeUnreplicatedNoAcks", value); + } + + /** + * Sets the upper limit for how long an event can sit unacknowledged in a + * raw slice. This value only applies when indexer acknowledgement is + * enabled on forwarders and replication is enabled with clustering. + * <p> + * This number should not exceed the acknowledgement timeout configured on + * any forwarder. + * + * @param value The upper limit, in seconds. A value of 0 disables this + * setting (not recommended). + */ + public void setMaxTimeUnreplicatedWithAcks(int value) { + setCacheValue("maxTimeUnreplicatedWithAcks", value); + } + + /** + * Sets the maximum size for this index. If an index grows larger than this + * value, the oldest data is frozen. + * + * @param size The maximum index size, in MB. + */ + public void setMaxTotalDataSizeMB(int size) { + setCacheValue("maxTotalDataSizeMB", size); + } + + /** + * Sets the maximum number of warm buckets. If this number is exceeded, + * the warm buckets with the lowest value for their latest times will be + * moved to cold. + * + * @param buckets The maximum number of warm buckets. + */ + public void setMaxWarmDBCount(int buckets) { + setCacheValue("maxWarmDBCount", buckets); + } + + /** + * Sets the frequency at which Splunkd forces a file system sync while + * compressing journal slices for this index. A value of "disable" disables + * this feature completely, while a value of 0 forces a file-system sync + * after completing compression of every journal slice. + * + * @param frequency The file-system sync frequency, as an integer or + * "disable". + */ + public void setMinRawFileSyncSecs(String frequency) { + setCacheValue("minRawFileSyncSecs", frequency); + } + + /** + * Sets the frequency at which metadata is for partially synced (synced + * in-place) for this index. A value of 0 disables partial syncing, so + * metadata is only synced on the {@code ServiceMetaPeriod} interval. + * @see #setServiceMetaPeriod + * @see #getServiceMetaPeriod + * + * @param frequency The metadata sync interval, in seconds. + */ + public void setPartialServiceMetaPeriod(int frequency) { + setCacheValue("partialServiceMetaPeriod", frequency); + } + + /** + * Sets a quarantine for events that are timestamped in the future to help + * prevent main hot buckets from being polluted with fringe events. Events + * that are newer than "now" plus this value are quarantined. + * + * @param window The future event-time quarantine, in seconds. + */ + public void setQuarantineFutureSecs(int window) { + setCacheValue("quarantineFutureSecs", window); + } + + /** + * Sets a quarantine for events that are timestamped in the past to help + * prevent main hot buckets from being polluted with fringe events. Events + * that are older than "now" plus this value are quarantined. + * + * @param window The past event-time quarantine, in seconds. + */ + public void setQuarantinePastSecs(int window) { + setCacheValue("quarantinePastSecs", window); + } + + /** + * Sets the target uncompressed size of individual raw slices in the rawdata + * journal for this index. + * <p> + * This parameter only specifies a target chunk size. The actual chunk size + * might be slightly larger by an amount proportional to an individual event + * size. + * <blockquote> + * <b>WARNING:</b> This is an advanced parameter. Only change it if you are + * instructed to do so by Splunk Support. + * </blockquote> + * @param size The target uncompressed size, in bytes. (0 is not a valid + * value--if 0 is used, this parameter is set to the default value.) + */ + public void setRawChunkSizeBytes(int size) { + setCacheValue("rawChunkSizeBytes", size); + } + + /** + * Sets the frequency to check for the need to create a new hot bucket and + * the need to roll or freeze any warm or cold buckets for this index. + * + * @param frequency The check frequency, in seconds. + */ + public void setRotatePeriodInSecs(int frequency) { + setCacheValue("rotatePeriodInSecs", frequency); + } + + /** + * Sets the frequency at which metadata is synced to disk for this index. + * + * @param frequency The meta data sync frequency, in seconds. + */ + public void setServiceMetaPeriod(int frequency) { + setCacheValue("serviceMetaPeriod", frequency); + } + + /** + * Sets whether the sync operation is called before the file descriptor is + * closed on metadata updates. + * <p> + * This functionality improves the integrity of metadata files, especially + * with regard to operating system crashes and machine failures. + * <blockquote> + * <b>WARNING:</b> This is an advanced parameter. Only change it if you are + * instructed to do so by Splunk Support. + * </blockquote> + * @param sync {@code true} to call the sync operation before the file + * descriptor is closed on metadata updates, {@code false} if not. + */ + public void setSyncMeta(boolean sync) { + setCacheValue("syncMeta", sync); + } + + /** + * Sets the frequency at which Splunk checks for an index throttling + * condition. + * + * @param frequency The frequency of the throttling check, in seconds. + */ + public void setThrottleCheckPeriod(int frequency) { + setCacheValue("throttleCheckPeriod", frequency); + } + + /** + * Submits an event to this index through an HTTP POST request. + * + * @param data The event data to post. + */ + public void submit(String data) { + Receiver receiver = service.getReceiver(); + receiver.submit(getName(), data); + } + + /** + * Submits an event to this index through an HTTP POST request. + * + * @param args Optional arguments for this request. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @param data The event data to post. + */ + public void submit(Args args, String data) { + Receiver receiver = service.getReceiver(); + receiver.submit(getName(), args, data); + } + + /** + * Uploads a file to this index as an event stream. + * <p> + * <b>Note:</b> This file must be directly accessible by the Splunk server. + * + * @param filename The path and filename. + */ + public void upload(String filename) { + EntityCollection<Upload> uploads = service.getUploads(); + Args args = new Args("index", getName()); + uploads.create(filename, args); + } + + /** + * Uploads a file to this index as an event stream. + * <p> + * <b>Note:</b> This file must be directly accessible by the Splunk server. + * + * @param filename The path and filename. + * + * @param args Optional arguments for this request. Valid parameters are: + * "host", "sourcetype", "rename-source". More found at: + * http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#data.2Finputs.2Foneshot + * + */ + public void upload(String filename, Args args) { + EntityCollection<Upload> uploads = service.getUploads(); + if(args.containsKey("index")){ + throw new IllegalArgumentException("The 'index' parameter cannot be passed to an index's oneshot upload."); + } + args.add("index", getName()); + uploads.create(filename, args); + } +} + diff --git a/splunk/src/main/java/com/splunk/IndexCollection.java b/splunk/src/main/java/com/splunk/IndexCollection.java new file mode 100644 index 00000000..cf98d95a --- /dev/null +++ b/splunk/src/main/java/com/splunk/IndexCollection.java @@ -0,0 +1,55 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code IndexCollection} class represents a collection of indexes. + */ +public class IndexCollection extends EntityCollection<Index> { + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + IndexCollection(Service service) { + super(service, "data/indexes", Index.class); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link IndexCollectionArgs}). + */ + IndexCollection(Service service, Args args) { + super(service, "data/indexes", Index.class, args); + } + + /** + * {@inheritDoc} + */ + public Index remove(String key) { + if (this.service.versionCompare("5.0") < 0) { + throw new UnsupportedOperationException( + "Indexes cannot be deleted via the REST API in versions " + + "prior to 5.0"); + } else { + return (Index)super.remove(key); + } + } +} diff --git a/splunk/src/main/java/com/splunk/IndexCollectionArgs.java b/splunk/src/main/java/com/splunk/IndexCollectionArgs.java new file mode 100644 index 00000000..0b60d5c1 --- /dev/null +++ b/splunk/src/main/java/com/splunk/IndexCollectionArgs.java @@ -0,0 +1,54 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code IndexCollectionArgs} class contains arguments for retrieving + * indexes from a collection (see {@link Service#getIndexes}). + */ +public class IndexCollectionArgs extends CollectionArgs { + + /** + * Class constructor. + */ + public IndexCollectionArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the maximum number of entries to return. + * + * @param count + * The maximum number of entries to return. To return all entries, specify -1. + */ + public void setCount(int count) { + super.setCount(count); + } + + /** + * Sets whether to omits certain index details to provide a faster response. + * + * @param summarize + * {@code true} to omit index details for a faster response, + * {@code false} if not. + */ + public void setSummarize(boolean summarize) { + this.put("summarize", summarize); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/Input.java b/splunk/src/main/java/com/splunk/Input.java new file mode 100644 index 00000000..95ca6c8d --- /dev/null +++ b/splunk/src/main/java/com/splunk/Input.java @@ -0,0 +1,56 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code Input} class represents a data input. This class is the base for + * all typed {@code Input} classes and is also used when Splunk does not + * recognize an input kind. + */ +public class Input extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The input endpoint. + */ + Input(Service service, String path) { + super(service, path); + } + + /** + * Returns an {@code InputKind} representing this input's type. + * + * The input kind is inferred from the input's path. + * @return InputKind instance + */ + public InputKind getKind() { + String[] pathComponents = + Util.substringAfter(this.path, "/data/inputs/", null).split("/"); + + String kindPath; + if (pathComponents[0].equals("tcp")) { + kindPath = "tcp/" + pathComponents[1]; + } else { + kindPath = pathComponents[0]; + } + return InputKind.create(kindPath); + } +} diff --git a/splunk/src/main/java/com/splunk/InputCollection.java b/splunk/src/main/java/com/splunk/InputCollection.java new file mode 100644 index 00000000..0fcefa02 --- /dev/null +++ b/splunk/src/main/java/com/splunk/InputCollection.java @@ -0,0 +1,407 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.*; + +/** + * The {@code InputCollection} class represents a collection of inputs. The + * collection is heterogeneous and each member contains an {@code InputKind} + * value that indicates the specific type of input. + */ +public class InputCollection extends EntityCollection<Input> { + protected Set<InputKind> inputKinds = new HashSet<InputKind>(); + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + InputCollection(Service service) { + super(service, "data/inputs"); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + */ + InputCollection(Service service, Args args) { + super(service, "data/inputs", args); + } + + /** {@inheritDoc} */ + @Override public boolean containsKey(Object key) { + Input input = retrieveInput((String)key); + return (input != null); + } + + /** + * Creates a stub for a new data input. + * + * @param name Depending on the type of input, a string that contains: + * <ul><li>The filename or directory and path (for monitor and oneshot + * inputs)</li> + * <li> The script name (for script inputs)</li> + * <li> The port number (for TCP and UDP inputs)</li> + * <li> The collection name (for Windows Perfmon and WMI inputs)</li> + * <li> The stanza (for Windows Registry inputs)</li> + * <li> The name of the configuration (for Windows AD inputs)</li></ul> + * @return No return value. + * @throws UnsupportedOperationException The UnsupportedOperationException instance + */ + @Override public Input create(String name) { + throw new UnsupportedOperationException(); + } + + /** + * Creates a stub for a new data input based on additional arguments. + * + * @param name Depending on the type of data input, a string that contains: + * <ul><li>The filename or directory and path (for monitor and oneshot + * inputs)</li> + * <li> The script name (for script inputs)</li> + * <li> The port number (for TCP and UDP inputs)</li> + * <li> The collection name (for Windows Perfmon and WMI inputs)</li> + * <li> The stanza (for Windows Registry inputs)</li> + * <li> The name of the configuration (for Windows AD inputs)</li></ul> + * @param args Optional arguments to define the data input. For a list of + * the available parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2#inputparams" + * target="_blank">Input parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" + * target="_blank">dev.splunk.com</a>. + * @return No return value. + * @throws UnsupportedOperationException The UnsupportedOperationException instance + */ + @Override public Input create(String name, Map args) { + throw new UnsupportedOperationException(); + } + + /** + * Creates a new data input based on the input kind. + * + * @param name Depending on the type of data input, a string that contains: + * <ul><li>The filename or directory and path (for monitor and oneshot + * inputs)</li> + * <li> The script name (for script inputs)</li> + * <li> The port number (for TCP and UDP inputs)</li> + * <li> The collection name (for Windows Perfmon and WMI inputs)</li> + * <li> The stanza (for Windows Registry inputs)</li> + * <li> The name of the configuration (for Windows AD inputs)</li></ul> + * @param kind A member of {@code InputKind}, indicating the type of input. + * @param <T> The implicit type of the input. + * @return The {@code Input} that was created. + */ + public <T extends Input> T create(String name, InputKind kind) { + return (T)create(name, kind, (Map<String, Object>)null); + } + + /** + * Creates a new data input based on the input kind and additional + * arguments. + * + * @param name Depending on the type of data input, a string that contains: + * <ul><li>The filename or directory and path (for monitor and oneshot + * inputs)</li> + * <li> The script name (for script inputs)</li> + * <li> The port number (for TCP and UDP inputs)</li> + * <li> The collection name (for Windows Perfmon and WMI inputs)</li> + * <li> The stanza (for Windows Registry inputs)</li> + * <li> The name of the configuration (for Windows AD inputs)</li></ul> + * @param kind A member of {@code InputKind}, indicating the type of input. + * @param args Optional arguments to define the data input. For a list of + * the available parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2#inputparams" + * target="_blank">Input parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" + * target="_blank">dev.splunk.com</a>. + * @param <T> The implicit type of the input. + * @return The {@code Input} that was created. + */ + public <T extends Input> T + create(String name, InputKind kind, Map<String, Object> args) { + args = Args.create(args).add("name", name); + String path = this.path + "/" + kind.getRelativePath(); + service.post(path, args); + + invalidate(); + + return (T)get(name); + } + + /** + * Creates a new data input based on an Atom entry. + * + * @param entry The {@code AtomEntry} object describing the entry. + * @return The {@code Input} that was created. + */ + @Override + protected Input createItem(AtomEntry entry) { + String path = itemPath(entry); + InputKind kind = itemKind(path); + Class inputClass = kind.getInputClass(); + return createItem(inputClass, path, null); + } + + /** + * {@inheritDoc} + */ + @Override public Input get(Object key) { + return retrieveInput((String)key); + } + + /** + * Returns the value of a scoped, namespace-constrained key, if it + * exists within this collection. + * + * @param key The key to look up. + * @param namespace The namespace to constrain the search to. + * @return The value indexed by the key, or {@code null} if it doesn't + * exist. + */ + public Input get(Object key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + return retrieveInput((String)key, namespace); + } + + /** + * Returns the input kind for a given path. + * + * @param path The relative endpoint path (the path that follows + * data/inputs). + * @return A member of {@code InputKind}, indicating the type of input. + */ + protected InputKind itemKind(String path) { + String relpathWithInputName = Util.substringAfter(path, "/data/inputs/", null); + for (InputKind kind : inputKinds) { + if (relpathWithInputName.startsWith(kind.getRelativePath())) { + return kind; + } + } + + // Not good. This means that there is an input of an unknown kind. + return InputKind.Unknown; + } + + /** + * Return a set of all the input kinds recognized by the Splunk server. + * + * @return A set of {@code InputKind}s. + */ + public Set<InputKind> getInputKinds() { + return this.inputKinds; + } + + /** + * Indicates whether a given string matches the input name (string + * equality). For scripted inputs, which are listed by their full path, this + * method compares only the final component of the filename for a match. + * + * @param kind A member of {@code InputKind}, indicating the type of input. + * @param searchFor A string to search for. + * @param searchIn The string that contains the input name. + * @return {@code true} if the string matches the input name, {@code false} + * if not. + */ + protected static boolean matchesInputName(InputKind kind, String searchFor, String searchIn) { + if (kind == InputKind.Script) { + return searchIn.endsWith("/" + searchFor) || searchIn.endsWith("\\" + searchFor); + } else { + return searchFor.equals(searchIn); + } + } + + + /** + * Assembles a set of all the input kinds that are available on this Splunk + * instance. To list all inputs, pass an empty list to {@code subPath}. Or, + * specify a component of the path such as "tcp" to list all TCP inputs. + * + * @param subPath A list of strings containing the components of the + * endpoint path that follow data/inputs/. + * @return A set of available {@code InputKind}s. + */ + private Set<InputKind> assembleInputKindSet(List<String> subPath) { + Set<InputKind> kinds = new HashSet<InputKind>(); + ResponseMessage response = service.get(this.path + "/" + Util.join("/", subPath)); + AtomFeed feed = AtomFeed.parseStream(response.getContent()); + for (AtomEntry entry : feed.entries) { + String itemKeyName = itemKey(entry); + + boolean hasCreateLink = false; + for (String linkName : entry.links.keySet()) { + if (linkName.equals("create")) { + hasCreateLink = true; + } + } + + List<String> thisSubPath = new ArrayList<String>(subPath); + thisSubPath.add(itemKeyName); + + String relpath = Util.join("/", thisSubPath); + + if (relpath.equals("all") || relpath.equals("tcp/ssl")) { + // Skip these input types + continue; + } else if (hasCreateLink) { + // Found an InputKind leaf + InputKind newKind = InputKind.create(relpath); + kinds.add(newKind); + } else { + Set<InputKind> subKinds = assembleInputKindSet(thisSubPath); + kinds.addAll(subKinds); + } + } + return kinds; + } + + /** + * Refreshes the {@code inputKinds} field on this object. + */ + private void refreshInputKinds() { + Set<InputKind> kinds = assembleInputKindSet(new ArrayList<String>()); + + this.inputKinds.clear(); + this.inputKinds.addAll(kinds); + } + + /** + * Refreshes this input collection. + * + * @return The refreshed {@code InputCollection}. + */ + @Override public InputCollection refresh() { + // Populate this.inputKinds + refreshInputKinds(); + + items.clear(); + + // Iterate over all input kinds and collect all instances. + for (InputKind kind : this.inputKinds) { + if (service.versionIsAtLeast("6.0.0")) { + // In Splunk 6 and later, the registry endpoint has been deprecated in favor of the new + // WinRegMon modular input, but both now point to the same place. To avoid duplicates, we have + // to read only one of them. + if (kind.getKind().equals("registry")) { + continue; + } + } + String relpath = kind.getRelativePath(); + String inputs = String.format("%s/%s?count=-1", path, relpath); + ResponseMessage response; + try { + response = service.get(inputs); + } + catch (HttpException e) { + // On some platforms certain input endpoints don't exist, for + // example the Windows inputs endpoints don't exist on non- + // Windows platforms. + if (e.getStatus() == 404) continue; + throw e; + } + AtomFeed feed; + try { + feed = AtomFeed.parseStream(response.getContent()); + } catch (Exception e) { + throw new RuntimeException(e); + } + load(feed); + } + + return this; + } + + /** + * {@inheritDoc} + */ + @Override public Input remove(String key) { + Input input = retrieveInput(key); + if (input != null) { + input.remove(); + } + return input; + } + + /** + * {@inheritDoc} + */ + @Override public Input remove( + String key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + + Input input = retrieveInput(key, namespace); + if (input != null) { + input.remove(); + } + return input; + } + + private Input retrieveInput(String key) { + validate(); + + // Because scripted input names are not 1:1 with the original name + // (they are the absolute path on the Splunk instance followed by + // the original name), we will iterate over the entities in the list, + // and if we find one that matches, return it. + Set<Entry<String, LinkedList<Input>>> set = items.entrySet(); + for (Entry<String, LinkedList<Input>> entry: set) { + String entryKey = entry.getKey(); + LinkedList<Input> entryValue = entry.getValue(); + InputKind kind = entryValue.get(0).getKind(); + + if (InputCollection.matchesInputName(kind, key, entryKey)) { + if (entryValue.size() > 1) { + throw new SplunkException(SplunkException.AMBIGUOUS, + "Multiple inputs matched " + key + "; specify a namespace to disambiguate."); + } else { + return entryValue.get(0); + } + } + } + return null; + } + + private Input retrieveInput(String key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + validate(); + + // Because scripted input names are not 1:1 with the original name + // (they are the absolute path on the Splunk instance followed by + // the original name), we will iterate over the entities in the list, + // and if we find one that matches, return it. + String pathMatcher = service.fullpath("", namespace); + Set<Entry<String, LinkedList<Input>>> set = items.entrySet(); + for (Entry<String, LinkedList<Input>> entry: set) { + String entryKey = entry.getKey(); + LinkedList<Input> entryValue = entry.getValue(); + InputKind kind = entryValue.get(0).getKind(); + + if (InputCollection.matchesInputName(kind, key, entryKey)) { + for (Input entity: entryValue) { + if (entity.path.startsWith(pathMatcher)) { + return entity; + } + } + } + } + return null; + } +} + diff --git a/splunk/src/main/java/com/splunk/InputKind.java b/splunk/src/main/java/com/splunk/InputKind.java new file mode 100644 index 00000000..f3cd62b3 --- /dev/null +++ b/splunk/src/main/java/com/splunk/InputKind.java @@ -0,0 +1,136 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.HashMap; +import java.util.Map; + +/** + * The {@code InputKind} enumeration defines the different types of Splunk data + * inputs (<i>input kinds</i>). For example, a raw TCP input is + * {@code InputKind.Tcp}, and a cooked TCP input is {@code InputKind.TcpSplunk}. + * Each modular input kind shows up as a separate instance of {@code InputKind}. + */ +public class InputKind { + private String kind; + private String relpath; + private Class<? extends Input> inputClass; + + private static Map<String, InputKind> knownRelpaths = new HashMap<String, InputKind>(); + + /** Unknown type of input. */ + public static final InputKind Unknown = new InputKind(null, Input.class, "unknown"); + + /** Monitor input. */ + public static final InputKind Monitor = new InputKind("monitor", MonitorInput.class); + + /** Script input. */ + public static final InputKind Script = new InputKind("script", ScriptInput.class); + + /** Raw TCP input. */ + public static final InputKind Tcp = new InputKind("tcp/raw", TcpInput.class, "tcp"); + + /** Cooked TCP input. */ + public static final InputKind TcpSplunk = new InputKind("tcp/cooked", TcpSplunkInput.class); + + /** UDP input. */ + public static final InputKind Udp = new InputKind("udp", UdpInput.class); + + /** Windows Active Directory input. */ + public static final InputKind WindowsActiveDirectory = new InputKind("ad", WindowsActiveDirectoryInput.class); + + /** Windows event log input. */ + public static final InputKind WindowsEventLog = new InputKind("win-event-log-collections",WindowsEventLogInput.class); + // As of Splunk 6, "win-event-log-collections" has changed to "WinEventLog". + public static final InputKind WinEventLog = new InputKind("WinEventLog", WindowsEventLogInput.class); + + /** Windows performance monitor input. */ + public static final InputKind WindowsPerfmon = new InputKind("win-perfmon", WindowsPerfmonInput.class); + + /** Windows Registry input. */ + public static final InputKind WindowsRegistry = new InputKind("registry", WindowsRegistryInput.class); + // As of Splunk 6, "registry" has changed to "WinRegMon". + public static final InputKind WinRegMon = new InputKind("WinRegMon", WindowsRegistryInput.class); + + /** Windows Management Instrumentation (WMI) input. */ + public static final InputKind WindowsWmi = new InputKind("win-wmi-collections", WindowsWmiInput.class); + + private InputKind(String relpath, Class<? extends Input> inputClass, String kind) { + this.relpath = relpath; + this.inputClass = inputClass; + this.kind = kind; + + knownRelpaths.put(relpath, this); + } + + private InputKind(String relpath, Class<? extends Input> inputClass) { + this( + relpath, + inputClass, + relpath + ); + } + + /** + * @return A string that specifies the input kind, as it is + * represented in the Atom entry for an input entity. + */ + String getKind() { + return kind; + } + + /** + * @return A string that contains the relative endpoint path from the + * data/inputs/ endpoint to this input kind. + */ + String getRelativePath() { + return relpath; + } + + /** + * @return The class to use to create instances for this input kind. + */ + Class<? extends Input> getInputClass() { + return inputClass; + } + + /** + * Create an {@code InputKind} object from a {@code String} giving + * the relative path from data/inputs/ to the kind. For example, + * "tcp/raw" or "monitor". + * + * {@code InputKind}'s constructors are private. You should use this method + * to create an {@code InputKind}. + * + * @param relpath The relative path from data/inputs specifying the {@code InputKind} to create. + * @return An {@code InputKind} object. + */ + public static InputKind create(String relpath) { + if (knownRelpaths.containsKey(relpath)) { + return knownRelpaths.get(relpath); + } else { + return new InputKind(relpath, Input.class); + } + } + + /** + * @return Textual representation for debugging purposes. + */ + public String toString() { + return relpath; + } +} diff --git a/splunk/src/main/java/com/splunk/InsertRootElementFilterInputStream.java b/splunk/src/main/java/com/splunk/InsertRootElementFilterInputStream.java new file mode 100644 index 00000000..b668f850 --- /dev/null +++ b/splunk/src/main/java/com/splunk/InsertRootElementFilterInputStream.java @@ -0,0 +1,147 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.io.*; + +/** + * Takes an InputStream containing a UTF-8 encoded XML document containing one or more + * root 'results' elements, and wraps a 'doc' element around + * all of them so normal XML parsers can handle the stream. Multiple root 'results' + * elements occur when getting results from an export search. + * + * It works by finding the first instance of '<results' and inserting + * the string '<doc>' before it, and then returning '</doc>' after the end of the stream + * it is filtering. + */ +class InsertRootElementFilterInputStream extends FilterInputStream { + private static final int REREAD_BUFFER_SIZE = 512; + private static byte[] resultsTagBytes; + private final ByteArrayInputStream suffix = new ByteArrayInputStream("</doc>".getBytes("UTF-8")); + private ByteArrayInputStream beforeResultsBuffer; + private boolean wrotePrefix; + + private byte[] oneByte = new byte[1]; + + static { + try { + resultsTagBytes = "results".getBytes("UTF-8"); + } catch (UnsupportedEncodingException e) { + //should not be thrown because UTF-8 is supported + throw new RuntimeException(e); + } + } + + InsertRootElementFilterInputStream(InputStream in) throws IOException { + // Wrap in with a pushback stream so we can write our modified version back + // onto the beginning of it. + super(new PushbackInputStream(in, REREAD_BUFFER_SIZE)); + + PushbackInputStream pin = (PushbackInputStream)this.in; + + // Read bytes until we reach '>', then push everything we read, followed by "<doc>", + // back onto the stream. If we run out of input before we reach '>', then don't + // modify the stream. + ByteArrayOutputStream beforeResultsChars = new ByteArrayOutputStream(); + beforeResultsBuffer = new ByteArrayInputStream(new byte[0]); + + int ch; + while (true) { + ch = this.in.read(); + if (ch == -1) { + // Never found a results element to write after, don't touch the stream. + wrotePrefix = false; + pin.unread(beforeResultsChars.toByteArray()); + return; + } else if (ch == (int)'<') { + boolean resultsTag = isResultsTag(pin); + + if (resultsTag) { + // If we reach here, the extension succeeded, so we insert <doc>, unread everything, + // and return. + + // Unread the match. + pin.unread(InsertRootElementFilterInputStream.resultsTagBytes); + // Unread the opening '<' that led to our extension + pin.unread(ch); + // Add a '<doc>' element to our read characters + beforeResultsChars.write("<doc>".getBytes("UTF-8")); + beforeResultsBuffer = new ByteArrayInputStream(beforeResultsChars.toByteArray()); + wrotePrefix = true; + return; + } else { + // Extension didn't find a match. Put the byte on and continue. + beforeResultsChars.write(ch); + } + } else { + // Not a character of interest. Put it on the buffer and continue. + beforeResultsChars.write(ch); + } + } + } + + private boolean isResultsTag(PushbackInputStream pin) throws IOException { + // Try extending + ByteArrayOutputStream atResultsChars = new ByteArrayOutputStream(); + int ech; + boolean resultsTag = true; + for (byte b : resultsTagBytes) { + ech = this.in.read(); + atResultsChars.write(ech); + if (ech != b) { + // Extension failed. Put the bytes back on and search again. + pin.unread(atResultsChars.toByteArray()); + resultsTag = false; + break; + } + } + return resultsTag; + } + + @Override + public int read(byte[] buffer, int offset, int length) throws IOException { + // first we read from the buffer before the first results xml tag + int result = 0; + int availableFromBuffer = beforeResultsBuffer.available(); + if (offset < availableFromBuffer) { + result = beforeResultsBuffer.read(buffer, offset, length); + if (length <= result) { + return result; + } + } + + // then we read from the original input stream + result += in.read(buffer, offset+result, length-result); + if (result == -1 && wrotePrefix) { + // No more bytes to read from in, and we have written '<doc>' earlier in the stream + return suffix.read(buffer, offset, length); + } else { + // in still has data to return, so we return it. + return result; + } + } + + @Override + public int read() throws IOException { + // Override to dispatch to the other read method. The third overload of read in FilterInputStream + // already dispatches to read(byte[], int, int). + if (read(oneByte, 0, 1) == -1) { + return -1; + } else { + return oneByte[0]; + } + } +} diff --git a/splunk/src/main/java/com/splunk/Job.java b/splunk/src/main/java/com/splunk/Job.java new file mode 100644 index 00000000..354d413c --- /dev/null +++ b/splunk/src/main/java/com/splunk/Job.java @@ -0,0 +1,973 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.InputStream; +import java.util.Date; +import java.util.HashMap; +import java.util.Map; + +/** + * The {@code Job} class represents a job, which is an individual + * instance of a running or completed search or report, along with its related + * output. + */ +public class Job extends Entity { + + private boolean isReady = false; + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The search jobs endpoint. + * @param sid The sid of the job. + */ + Job(Service service, String path) { + super(service, path); + } + + /** + * Returns the action path. + * + * @param action The requested action. + * @return The action path. + */ + @Override protected String actionPath(String action) { + if (action.equals("control")) + return path + "/control"; + return super.actionPath(action); + } + + /** + * Performs the requested action on this job. Valid values are: "pause", + * "unpause", "finalize", "cancel", "touch", "setttl", "setpriority", + * "enablepreview", and "disablepreview". + * + * @param action The action to perform. + * @return The search job. + */ + public Job control(String action) { + return control(action, null); + } + + /** + * Performs the requested action on this job. Valid values are: "pause", + * "unpause", "finalize", "cancel", "touch", "setttl", "setpriority", + * "enablepreview", and "disablepreview". + * + * @param action The action to perform. + * @param args Optional arguments for this action ("ttl" and "priority"). + * @return The search job. + */ + public Job control(String action, Map args) { + args = Args.create(args).add("action", action); + service.post(actionPath("control"), args); + invalidate(); + return this; + } + + /** + * Stops the current search and deletes the result cache. + * + * @return The search job. + */ + public Job cancel() { + try { + return control("cancel"); + } catch (HttpException e) { + if (e.getStatus() == 404) { + // Already cancelled; cancel is a nop. + } else { + throw e; + } + } + return this; + } + + /** + * Checks whether the job is ready to be accessed, and throws an exception + * if it is not. + */ + private void checkReady() { + if (!isReady()) throw new SplunkException(SplunkException.JOB_NOTREADY, + "Job not yet scheduled by server"); + } + + /** + * Disables preview for this job. + * + * @return The search job. + */ + public Job disablePreview() { + return control("disablepreview"); + } + + /** + * Enables preview for this job (although it might slow search + * considerably). + * + * @return The search job. + */ + public Job enablePreview() { + return control("enablepreview"); + } + + /** + * Stops the job and provides intermediate results available for retrieval. + * + * @return The search job. + */ + public Job finish() { + return control("finalize"); + } + + /** + * Pauses the current search. + * + * @return The search job. + */ + public Job pause() { + return control("pause"); + } + + /** + * Returns the earliest time from which no events are later scanned. + * (Use this as a progress indicator.) + * @see #getLatestTime + * @see #getEarliestTime + * @see #getDoneProgress + * + * @return The earliest time. + */ + public Date getCursorTime() { + checkReady(); + return getDate("cursorTime"); + } + + /** + * Returns a value that indicates how jobs were started (such as the + * scheduler). + * + * @return The delegate, or {@code null} if not specified. + */ + public String getDelegate() { + checkReady(); + return getString("delegate", null); + } + + /** + * Returns the disk usage for this job. + * + * @return The disk usage, in bytes. + */ + public int getDiskUsage() { + checkReady(); + return getInteger("diskUsage"); + } + + /** + * Returns the dispatch state for this job. <br> + * Valid values are: QUEUED, PARSING, RUNNING, PAUSED, FINALIZING, FAILED, + * or DONE. + * + * @return This job's dispatch state. + */ + public String getDispatchState() { + checkReady(); + return getString("dispatchState"); + } + + /** + * Returns the approximate progress of the job, in the range of 0.0 to 1.0. + * <br> + * {@code doneProgress = (latestTime-cursorTime)/(latestTime-earliestTime)} + * @see #getLatestTime + * @see #getCursorTime + * @see #getEarliestTime + * + * @return This job's progress. + */ + public float getDoneProgress() { + checkReady(); + return getFloat("doneProgress"); + } + + /** + * Returns the number of possible events that were dropped due to the + * {@code rt_queue_size} (the number of events that the indexer should use + * for this search). For real-time searches only. + * + * @return The number of dropped events. + */ + public int getDropCount() { + checkReady(); + return getInteger("dropCount", 0); + } + + /** + * Returns the earliest time in the time range to search. + * @see #getLatestTime + * @see #getCursorTime + * @see #getDoneProgress + * + * @return The earliest time, in UTC format. + */ + public Date getEarliestTime() { + checkReady(); + return getDate("earliestTime"); + } + + /** + * Returns the count of events stored by search that are available to be + * retrieved from the events endpoint. + * + * @return The count of available events. + */ + public int getEventAvailableCount() { + checkReady(); + return getInteger("eventAvailableCount"); + } + + /** + * Returns the count of events (pre-transforming) that were generated. + * + * @return The number of events. + */ + public int getEventCount() { + checkReady(); + return getInteger("eventCount"); + } + + /** + * Returns the count of events (pre-transforming) that were generated as a long. + * + * @return The number of events. + */ + public long getEventCountLong() { + checkReady(); + return getLong("eventCount"); + } + + /** + * Returns the count of event fields. + * + * @return The number of event fields. + */ + public int getEventFieldCount() { + checkReady(); + return getInteger("eventFieldCount"); + } + + /** + * Indicates whether the events from this job are available by streaming. + * + * @return {@code true} if events can be streamed, {@code false} if not. + */ + public boolean getEventIsStreaming() { + checkReady(); + return getBoolean("eventIsStreaming"); + } + + /** + * Indicates whether any events from this job have not been stored. + * @return {@code true} if the event return is truncated, {@code false} if + * not. + */ + public boolean getEventIsTruncated() { + checkReady(); + return getBoolean("eventIsTruncated"); + } + + /** + * Returns the {@code InputStream} IO handle for this job's events. + * + * @return The event {@code InputStream} IO handle. + */ + public InputStream getEvents() { + checkReady(); + return getEvents(null); + } + + /** + * Returns the {@code InputStream} IO handle for this job's events. + * + * @param args Optional arguments. + * For a list of possible parameters, see the Request parameters for the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_id.7D.2Fevents" + * target="_blank">GET search/jobs/{search_id}/events</a> + * endpoint in the REST API documentation. + * + * @return The event {@code InputStream} IO handle. + */ + public InputStream getEvents(Map args) { + return getEventsMethod("/events", args); + } + + /** + * Returns the {@code InputStream} IO handle for this job's events. + * + * @param args Optional arguments (see {@link JobEventsArgs}). + * + * @return The event {@code InputStream} IO handle. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public InputStream getEvents(JobEventsArgs args) { + checkReady(); + return getEvents((Map<String, Object>) args); + } + + /** + * Returns the subset of the entire search that is before any transforming + * commands. The original search should be the "eventSearch" + + * "reportSearch". + * @see #getReportSearch + * @return The event search query. + */ + public String getEventSearch() { + checkReady(); + return getString("eventSearch", null); + } + + /** + * Returns a value that indicates how events are sorted. + * + * @return "asc" if events are sorted in time order (oldest first), + * "desc" if events are sorted in inverse time order (latest first), + * or "none" if events are not sorted. + */ + public String getEventSorting() { + checkReady(); + return getString("eventSorting"); + } + + private InputStream getEventsMethod(String methodPath, Map args) { + checkReady(); + + if (args == null) { + args = new HashMap<String, Object>(); + } + if (!args.containsKey("segmentation")) { + // By default, don't include notations in the results to highlight + // search terms (i.e., <sg> elements in XML output). + args.put("segmentation", "none"); + } + + // Splunk version pre-9.0 doesn't support v2 + // v1(GET), v2(POST) + String fullPath; + ResponseMessage response; + if (!service.enableV2SearchApi()) { + fullPath = path.replace(JobCollection.REST_PATH_V2, JobCollection.REST_PATH) + methodPath; + response = service.get(fullPath, args); + } + else { + fullPath = path.replace(JobCollection.REST_PATH, JobCollection.REST_PATH_V2) + methodPath; + response = service.post(fullPath, args); + } + + return response.getContent(); + } + + /** + * Returns all positive keywords used by this job. A positive keyword is + * a keyword that is not in a NOT clause. + * + * @return The search job keywords. + */ + public String getKeywords() { + checkReady(); + return getString("keywords", null); + } + + /** + * Returns this job's label. + * + * @return The search job label. + */ + public String getLabel() { + checkReady(); + return getString("label", null); + } + + /** + * Returns the latest time in the time range to search. + * @see #getCursorTime + * @see #getEarliestTime + * @see #getDoneProgress + * + * @return The latest time, in UTC format. + */ + public Date getLatestTime() { + checkReady(); + return getDate("latestTime"); + } + + /** + * Returns this job's name (its search ID). + * + * @return The search job name. + */ + @Override public String getName() { + checkReady(); + return getSid(); + } + + /** + * Returns the number of previews that have been generated so far for this + * job. + * + * @return The number of previews. + */ + public int getNumPreviews() { + checkReady(); + return getInteger("numPreviews"); + } + + /** + * Returns this job's priority in the range of 0-10. + * + * @return The search job priority. + */ + public int getPriority() { + checkReady(); + return getInteger("priority"); + } + + /** + * Sets this job's priority in the range of 0-10. + * + * @param value The new priority. + */ + public void setPriority(int value) { + checkReady(); + control("setpriority", new Args("priority", value)); + } + + /** + * Returns the search string that is sent to every search peer for this job. + * + * @return The remote search query string. + */ + public String getRemoteSearch() { + checkReady(); + return getString("remoteSearch", null); + } + + /** + * Returns the reporting subset of this search, which is the streaming part + * of the search that is send to remote providers if reporting commands are + * used. The original search should be the "eventSearch" + "reportSearch". + * @see #getEventSearch + * + * @return The reporting search query. + */ + public String getReportSearch() { + checkReady(); + return getString("reportSearch", null); + } + + /** + * Returns the total count of results returned for this search job. + * This is the subset of scanned events that actually matches the search + * terms. + * + * @return The number of results. + */ + public int getResultCount() { + checkReady(); + return getInteger("resultCount"); + } + + /** + * Returns the total count of results returned for this search job as a long. + * This is the subset of scanned events that actually matches the search + * terms. + * + * @return The number of results. + */ + public long getResultCountLong() { + checkReady(); + return getLong("resultCount"); + } + + /** + * Indicates whether the job's results are available by streaming. + * + * @return {@code true} if results can be streamed, {@code false} if not. + */ + public boolean getResultIsStreaming() { + checkReady(); + return getBoolean("resultIsStreaming"); + } + + /** + * Returns the number of result rows in the latest preview results for this + * job. + * + * @return The number of result rows. + */ + public int getResultPreviewCount() { + checkReady(); + return getInteger("resultPreviewCount"); + } + + /** + * Returns the {@code InputStream} IO handle for the results from this job. + * + * @return The results {@code InputStream} IO handle. + */ + public InputStream getResults() { + checkReady(); + return getResults(null); + } + + /** + * Returns the {@code InputStream} IO handle for the results from this job. + * + * @param args Optional arguments. + * For a list of possible parameters, see the Request parameters for the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_id.7D.2Fresults" + * target="_blank">GET search/jobs/{search_id}/results</a> + * endpoint in the REST API documentation. + * @return The results {@code InputStream} IO handle. + */ + public InputStream getResults(Map args) { + return getEventsMethod("/results", args); + } + + /** + * Returns the {@code InputStream} IO handle for the results from this job. + * + * @param args Optional arguments (see {@link JobResultsArgs}). + * @return The results {@code InputStream} IO handle. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public InputStream getResults(JobResultsArgs args) { + checkReady(); + return getResults((Map<String, Object>) args); + } + + /** + * Returns the {@code InputStream} IO handle for the preview results from + * this job. + * + * @return The preview results {@code InputStream} IO handle. + */ + public InputStream getResultsPreview() { + checkReady(); + return getResultsPreview(null); + } + + /** + * Returns the {@code InputStream} IO handle for the preview results from + * this job. + * + * @param args Optional arguments. + * For a list of possible parameters, see the Request parameters for the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_id.7D.2Fresults_preview" + * target="_blank">GET search/jobs/{search_id}/results_preview</a> + * endpoint in the REST API documentation. + * @return The preview results {@code InputStream} IO handle. + */ + public InputStream getResultsPreview(Map args) { + return getEventsMethod("/results_preview", args); + } + + /** + * Returns the {@code InputStream} IO handle for the preview results from + * this job. + * + * @param args Optional arguments (see {@link JobResultsPreviewArgs}). + * @return The preview results {@code InputStream} IO handle. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public InputStream getResultsPreview(JobResultsPreviewArgs args) { + checkReady(); + return getResultsPreview((Map<String, Object>) args); + } + + /** + * Returns the time that the search job took to complete. + * + * @return The run-time duration, in seconds. + */ + public float getRunDuration() { + checkReady(); + return getFloat("runDuration"); + } + + /** + * Returns the number of events that are scanned or read off disk. + * + * @return The number of events. + */ + public int getScanCount() { + checkReady(); + return getInteger("scanCount"); + } + + /** + * Returns the number of events that are scanned or read off disk + * as a long. + * + * @return The number of events. + */ + public long getScanCountLong() { + checkReady(); + return getLong("scanCount"); + } + + /** + * Returns this job's search title. + * + * @return The search title. + */ + public String getSearch() { + checkReady(); + return getTitle(); + } + + /** + * Returns the earliest time in the time range to search. + * @see #getLatestTime + * @see #getCursorTime + * @see #getDoneProgress + * + * @return This earliest search time, in epoch format. + */ + public String getSearchEarliestTime() { + checkReady(); + return getString("searchEarliestTime", null); + } + + /** + * Returns the latest time in the time range to search. + * @see #getEarliestTime + * @see #getCursorTime + * @see #getDoneProgress + * + * @return The latest search time, in epoch format. + */ + public String getSearchLatestTime() { + checkReady(); + return getString("searchLatestTime", null); + } + + /** + * Returns the {@code InputStream} IO handle to the search log for this job. + * + * @return The search log {@code InputStream} IO handle. + */ + public InputStream getSearchLog() { + checkReady(); + return getSearchLog(null); + } + + /** + * Returns the {@code InputStream} IO handle to the search log for this job. + * + * @param args Optional argument ("attachment"). + * @return The search log {@code InputStream} IO handle. + */ + public InputStream getSearchLog(Map args) { + checkReady(); + ResponseMessage response = service.get(path + "/search.log", args); + return response.getContent(); + } + + /** + * Returns a list of search peers that were contacted for this search. + * + * @return The search peers. + */ + public String[] getSearchProviders() { + checkReady(); + return getStringArray("searchProviders", null); + } + /** + * Returns the unique search identifier (SID) for this job. + * + * @return The job's SID. + */ + public String getSid() { + return getString("sid"); + } + + /** + * Returns this job's search ID from within a response message. + * + * @param response The response message. + * @return This job's SID. + */ + static String getSid(ResponseMessage response) { + return Xml.parse(response.getContent()) + .getElementsByTagName("sid") + .item(0) + .getTextContent(); + } + + /** + * Returns the {@code InputStream} IO handle for the summary for this job. + * + * @return The summary {@code InputStream} IO handle. + */ + public InputStream getSummary() { + checkReady(); + return getSummary(null); + } + + /** + * Returns the {@code InputStream} IO handle for the summary for this job. + * + * @param args Optional arguments. + * For a list of possible parameters, see the Request parameters for the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_id.7D.2Fsummary" + * target="_blank">GET search/jobs/{search_id}/summary</a> + * endpoint in the REST API documentation. + * @return The summary {@code InputStream} IO handle. + */ + public InputStream getSummary(Map args) { + checkReady(); + ResponseMessage response = service.get(path + "/summary", args); + return response.getContent(); + } + + /** + * Returns the {@code InputStream} IO handle for the summary for this job. + * + * @param args Optional arguments (see {@link JobSummaryArgs}). + * @return The summary {@code InputStream} IO handle. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public InputStream getSummary(JobSummaryArgs args) { + checkReady(); + return getSummary((Map<String, Object>) args); + } + + /** + * Returns the maximum number of timeline buckets for this job. + * + * @return The number of timeline buckets. + */ + public int getStatusBuckets() { + checkReady(); + return getInteger("statusBuckets"); + } + + /** + * Returns the {@code InputStream} IO handle for the timeline for this job. + * + * @return The timeline {@code InputStream} IO handle. + */ + public InputStream getTimeline() { + checkReady(); + return getTimeline(null); + } + + /** + * Returns the {@code InputStream} IO handle for the timeline for this job. + * + * @param args Optional arguments ("output_time_format" and "time_format"). + * @return The timeline {@code InputStream} IO handle. + */ + public InputStream getTimeline(Map args) { + checkReady(); + ResponseMessage response = service.get(path + "/timeline", args); + return response.getContent(); + } + + /** + * Returns this job's time to live--that is, the time + * before the search job expires and is still available. + * If this value is 0, it means the job has expired. + * + * @return The time to live, in seconds. + */ + public int getTtl() { + checkReady(); + return getInteger("ttl"); + } + + /** + * Indicates whether the job is done. + * + * @return {@code true} if the job is done, {@code false} if not. + */ + public boolean isDone() { + if (!isReady()) + return false; + if (!getBoolean("isDone")) { + this.refresh(); + } + return getBoolean("isDone"); + } + + /** + * Indicates whether the job failed. + * + * @return {@code true} if the job failed, {@code false} if not. + */ + public boolean isFailed() { + checkReady(); + return getBoolean("isFailed"); + } + + /** + * Indicates whether the job is finalized (forced to finish). + * + * @return {@code true} if the job is finalized, {@code false} if not. + */ + public boolean isFinalized() { + checkReady(); + return getBoolean("isFinalized"); + } + + /** + * Indicates whether the job is paused. + * + * @return {@code true} if the job is paused, {@code false} if not. + */ + public boolean isPaused() { + checkReady(); + return getBoolean("isPaused"); + } + + /** + * Indicates whether preview for the job is enabled. + * + * @return {@code true} if preview is enabled, {@code false} if not. + */ + public boolean isPreviewEnabled() { + checkReady(); + return getBoolean("isPreviewEnabled"); + } + + /** + * Indicates whether the job has been scheduled and is ready to + * return data. + * + * @return {@code true} if the job is ready to return data, {@code false} if + * not. + */ + public boolean isReady() { + if (!isReady) { + this.refresh(); + } + return isReady; + } + + /** + * Indicates whether the job is a real-time search. + * + * @return {@code true} if the job is a real-time search, {@code false} if + * not. + */ + public boolean isRealTimeSearch() { + checkReady(); + return getBoolean("isRealTimeSearch"); + } + + /** + * Indicates whether the job has a remote timeline component. + * + * @return {@code true} if the job has a remote timeline component, + * {@code false} if not. + */ + public boolean isRemoteTimeline() { + checkReady(); + return getBoolean("isRemoteTimeline"); + } + + /** + * Indicates whether the job is to be saved indefinitely. + * + * @return {@code true} if the job has been saved, {@code false} if not. + */ + public boolean isSaved() { + checkReady(); + return getBoolean("isSaved"); + } + + /** + * Indicates whether this job was run as a saved search (via scheduler). + * + * @return {@code true} if the job is from a saved search, {@code false} + * if not. + */ + public boolean isSavedSearch() { + checkReady(); + return getBoolean("isSavedSearch"); + } + + /** + * Indicates whether the process running the search is dead but with the + * search not finished. + * + * @return {@code true} if the job is a zombie, {@code false} if not. + */ + public boolean isZombie() { + checkReady(); + return getBoolean("isZombie"); + } + + // Job "entities" don't return an AtomFeed, only an AtomEntry. + + /** + * Refreshes this job. + * + * @return The search job. + */ + @Override public Job refresh() { + update(); + ResponseMessage response = service.get(path); + if (response.getStatus() == 204) { + isReady = false; + return this; + } + + AtomEntry entry; + try { + entry = AtomEntry.parseStream(response.getContent()); + } catch (Exception e) { + throw new RuntimeException(e); + } + load(entry); + + if (getString("dispatchState").equals("QUEUED") || getString("dispatchState").equals("PARSING")) { + isReady = false; + } else { + isReady = true; + } + + + return this; + } + + /** + * Unsupported. Removes this job. This method is unsupported and will throw + * an exception. + */ + public void remove() { + throw new UnsupportedOperationException(); + } +} + diff --git a/splunk/src/main/java/com/splunk/JobArgs.java b/splunk/src/main/java/com/splunk/JobArgs.java new file mode 100644 index 00000000..d0f5eaf4 --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobArgs.java @@ -0,0 +1,391 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code JobArgs} class contains arguments for creating a {@link Job}. + */ +public class JobArgs extends Args { + + /** + * Specifies how to create a job using the {@link JobCollection#create} + * method. + */ + public static enum ExecutionMode { + /** Runs a search asynchronously and returns a search job immediately.*/ + NORMAL("normal"), + /** Runs a search synchronously and does not return a search job until + * the search has finished. */ + BLOCKING("blocking"), + /** Runs a blocking search that is scheduled to run immediately, then + * returns the results of the search once completed. */ + ONESHOT("oneshot"); + + private String value; + + private ExecutionMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Specifies how to create a job using the {@link JobCollection#create} + * method. + */ + public static enum SearchMode { + /** + * Searches historical data. + */ + NORMAL("normal"), + /** + * Searches live data. A real-time search may also be specified by + * setting the "earliest_time" and "latest_time" parameters to begin + * with "rt", even if the search_mode is set to "normal" or is not set. + * <p> + * If both the "earliest_time" and "latest_time" parameters are set to + * "rt", the search represents all appropriate live data that was + * received since the start of the search. + * <p> + * If both the "earliest_time" and "latest_time" parameters are set to + * "rt" followed by a relative time specifier, a sliding window is used + * where the time bounds of the window are determined by the relative + * time specifiers and are continuously updated based on current time. + */ + REALTIME("realtime"); + + private String value; + + private SearchMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public JobArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. + * + * @param autoCancel + * The number of seconds after which to cancel a job. + */ + public void setAutoCancel(int autoCancel) { + this.put("auto_cancel", autoCancel); + } + + /** + * Sets the number of events to process after which to auto-finalize the search. A value of 0 means no limit. + * + * @param autoFinalizeEventCount + * The number of events. + */ + public void setAutoFinalizeEventCount(int autoFinalizeEventCount) { + this.put("auto_finalize_ec", autoFinalizeEventCount); + } + + /** + * Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. + * + * @param autoPause + * The number of seconds after which to pause. + */ + public void setAutoPause(int autoPause) { + this.put("auto_pause", autoPause); + } + + /** + * Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param earliestTime + * The earliest time. + */ + public void setEarliestTime(String earliestTime) { + this.put("earliest_time", earliestTime); + } + + /** + * Indicates whether to enable lookups for this search. Enabling lookups might slow searches significantly depending on the nature of the lookups. + * + * @param enableLookups + * {@code true} to enable lookups, {@code false} if not. + */ + public void setEnableLookups(boolean enableLookups) { + this.put("enable_lookups", enableLookups); + } + + /** + * Sets the type of search to run ("blocking", "oneshot", or "normal"). + * + * @param executionMode + * The search type. + */ + public void setExecutionMode(ExecutionMode executionMode) { + this.put("exec_mode", executionMode); + } + + /** + * Specifies whether this search should cause (and wait depending on the value of {@code setSynchronizeBundleReplication}) bundle synchronization with all search peers. + * + * @param forceBundleReplication + * {@code true} if this search should cause bundle synchronization, + * {@code false} if not. + */ + public void setForceBundleReplication(boolean forceBundleReplication) { + this.put("force_bundle_replication", forceBundleReplication); + } + + /** + * Sets a search ID (SID). If unspecified, a random ID is generated. + * + * @param id + * The search ID. + */ + public void setId(String id) { + this.put("id", id); + } + + /** + * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param latestTime + * The latest time. + */ + public void setLatestTime(String latestTime) { + this.put("latest_time", latestTime); + } + + /** + * Sets the number of events that can be accessible in any given status bucket. Also, in transforming mode, this sets the maximum number of results to store. Specifically, in all calls, {@code codeoffset + count <= max_count}. + * + * @param maximumCount + * The maximum count of events. + */ + public void setMaximumCount(int maximumCount) { + this.put("max_count", maximumCount); + } + + /** + * Sets the maximum number of seconds to run this search before finalizing. Specify 0 to never finalize. + * + * @param maximumTime + * The maximum time, in seconds. + */ + public void setMaximumTime(int maximumTime) { + this.put("max_time", maximumTime); + } + + /** + * Specifies the application namespace to which to restrict searches. + * + * @param namespace + * The namespace. + */ + public void setNamespace(String namespace) { + this.put("namespace", namespace); + } + + /** + * Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.<p>You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.<p>For information about relative time modifiers, see <a href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers" target="_blank">Time modifiers for search</a> in the Search Reference. + * + * @param now + * The time string. + */ + public void setNow(String now) { + this.put("now", now); + } + + /** + * Sets the time to wait between running the MapReduce phase on accumulated + * map values. + * + * @param reduceFrequency + * The time to wait, in seconds. + */ + public void setReduceFrequency(int reduceFrequency) { + this.put("reduce_freq", reduceFrequency); + } + + /** + * Indicates whether to reload macro definitions from the macros.conf configuration file. + * + * @param reloadMacros + * {@code true} to reload macro definitions, {@code false} if not. + */ + public void setReloadMacros(boolean reloadMacros) { + this.put("reload_macros", reloadMacros); + } + + /** + * Sets a list of (possibly wildcarded) servers from which to pull raw events. This same server list is used in subsearches. + * + * @param remoteServerList + * The list of servers. + */ + public void setRemoteServerList(String[] remoteServerList) { + StringBuilder csv = new StringBuilder(); + for (int i = 0, n = remoteServerList.length; i < n; i++) { + if (i != 0) { + csv.append(","); + } + csv.append(remoteServerList[i]); + } + + this.put("remote_server_list", String.valueOf(csv)); + } + + /** + * Sets one or more required fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. + * + * @param requiredFieldList + * The list of fields. + */ + public void setRequiredFieldList(String[] requiredFieldList) { + this.put("rf", requiredFieldList); + } + + /** + * Indicates whether the indexer blocks if the queue for this search is + * full. Only applies to real-time searches. + * + * @param realtimeBlocking + * {@code true} to block the indexer for a full queue, {@code false} if not. + */ + public void setRealtimeBlocking(boolean realtimeBlocking) { + this.put("rt_blocking", realtimeBlocking); + } + + /** + * Indicates whether the indexer pre-filters events. Only applies to real-time searches. + * + * @param realtimeIndexFilter + * {@code true} to pre-filter events, {@code false} if not. + */ + public void setRealtimeIndexFilter(boolean realtimeIndexFilter) { + this.put("rt_indexfilter", realtimeIndexFilter); + } + + /** + * Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. + * + * @param realtimeMaximumBlockSeconds + * The maximum time to block, in seconds. + */ + public void setRealtimeMaximumBlockSeconds(int realtimeMaximumBlockSeconds) { + this.put("rt_maxblocksecs", realtimeMaximumBlockSeconds); + } + + /** + * Sets the number indicating the queue size (in events) that the indexer + * should use for this search. Only applies to real-time searches. + * + * @param realtimeQueueSize + * The queue size, in events. + */ + public void setRealtimeQueueSize(int realtimeQueueSize) { + this.put("rt_queue_size", realtimeQueueSize); + } + + /** + * Sets a string that registers a search state listener with the search. Use the format: {@code search_state;results_condition;http_method;uri;}<p>For example:<p>{@code search_listener=onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;} + * + * @param searchListener + * The search listener string. + */ + public void setSearchListener(String searchListener) { + this.put("search_listener", searchListener); + } + + /** + * Sets the search mode ("normal" or "realtime"). + * + * @param searchMode + * The search mode. + */ + public void setSearchMode(SearchMode searchMode) { + this.put("search_mode", searchMode); + } + + /** + * Indicates whether the search should run in a separate spawned process. Searches against indexes must run in a separate process. + * + * @param spawnProcess + * {@code true} to run the search in a separate process, {@code false} if not. + */ + public void setSpawnProcess(boolean spawnProcess) { + this.put("spawn_process", spawnProcess); + } + + /** + * Sets the maximum number of status buckets to generate. A value of 0 means to not generate timeline information. + * + * @param statusBuckets + * The maximum number of buckets. + */ + public void setStatusBuckets(int statusBuckets) { + this.put("status_buckets", statusBuckets); + } + + /** + * Indicates whether this search should wait for bundle replication to complete. + * + * @param synchronizeBundleReplication + * {@code true} to wait for bundle replication, {@code false} if not. + */ + public void setSynchronizeBundleReplication(boolean synchronizeBundleReplication) { + this.put("sync_bundle_replication", synchronizeBundleReplication); + } + + /** + * Sets the format for converting a formatted time string from {start,end}_time into UTC seconds. The default value is ISO-8601. + * + * @param timeFormat + * The time format string. + */ + public void setTimeFormat(String timeFormat) { + this.put("time_format", timeFormat); + } + + /** + * Sets the number of seconds to keep this search after processing has stopped. + * + * @param timeout + * The timeout, in seconds. + */ + public void setTimeout(int timeout) { + this.put("timeout", timeout); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/JobCollection.java b/splunk/src/main/java/com/splunk/JobCollection.java new file mode 100644 index 00000000..661e21ff --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobCollection.java @@ -0,0 +1,132 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code JobCollection} class represents a collection of jobs. A job + * is an individual instance of a running or completed search or report, along + * with its related output. + */ +public class JobCollection extends EntityCollection<Job> { + static String oneShotNotAllowed = String.format( + "Oneshot not allowed, use service oneshot search method"); + static final String REST_PATH = "search/jobs"; + static final String REST_PATH_V2 = "search/v2/jobs"; + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + JobCollection(Service service) { + super(service, service.enableV2SearchApi() ? REST_PATH_V2 : REST_PATH, Job.class); + this.refreshArgs.put("count", "0"); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + JobCollection(Service service, Args args) { + super(service, service.enableV2SearchApi() ? REST_PATH_V2 : REST_PATH, Job.class); + this.refreshArgs.put("count", "0"); + } + + /** + * Creates a search with a UTF8 pre-encoded search request. + * <p> + * <b>Note:</b> You can't create a "oneshot" search using this method. + * Instead, use the {@link Service#oneshotSearch} method. + * + * @param query The search query. + * @return The unique search identifier (SID). + */ + public Job create(String query) { + return create(query, (Map)null); + } + + /** + * Creates a search. + * <p> + * <b>Note:</b> You can't create a "oneshot" search using this method. + * Instead, use the {@link Service#oneshotSearch} method. + * + * @param query The search query. + * @param args Additional arguments for this job (see {@link JobArgs}). + * @return The unique search identifier (SID). + */ + public Job create(String query, Map args) { + if (args != null && args.containsKey("exec_mode")) { + if (args.get("exec_mode").equals("oneshot")) + throw new RuntimeException(oneShotNotAllowed); + } + args = Args.create(args).add("search", query); + ResponseMessage response = service.post(path, args); + assert(response.getStatus() == 201); + + String sid = Xml.parse(response.getContent()) + .getElementsByTagName("sid") + .item(0) + .getTextContent(); + + String path = service.enableV2SearchApi() ? REST_PATH_V2 : REST_PATH; + Job job = new Job(service, path + "/" + sid); + job.refresh(); + + return job; + } + + /** + * Creates a search. + * <p> + * <b>Note:</b> You can't create a "oneshot" search using this method. + * Instead, use the {@link Service#oneshotSearch} method. + * + * @param query The search query. + * @param args Additional arguments for this job (see {@link JobArgs}). + * @return The unique search identifier (SID) for the job. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public Job create(String query, JobArgs args) { + return this.create(query, (Map<String, Object>) args); + } + + /** + * Returns the job's response. + * + * @return The job's response. + */ + @Override public ResponseMessage list() { + return service.get(path, this.refreshArgs); + } + + /** + * Returns the job's unique search identifier (SID), which is used as this + * item's key. + * + * @param entry The {@code AtomEntry} response. + * @return This job's SID. + */ + @Override protected String itemKey(AtomEntry entry) { + return (String)entry.content.get("sid"); + } +} diff --git a/splunk/src/main/java/com/splunk/JobEventsArgs.java b/splunk/src/main/java/com/splunk/JobEventsArgs.java new file mode 100644 index 00000000..233e3c1b --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobEventsArgs.java @@ -0,0 +1,210 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code JobEventsArgs} class contains arguments for getting events using + * the {@link Job#getEvents} method. + */ +public class JobEventsArgs extends Args { + + /** + * Specifies the format for the returned output. + */ + public static enum OutputMode { + /** Returns output in Atom format. */ + ATOM("atom"), + /** Returns output in CSV format. */ + CSV("csv"), + /** Returns output in JSON format. */ + JSON("json"), + /** Returns output in JSON_COLS format. */ + JSON_COLS("json_cols"), + /** Returns output in JSON_ROWS format. */ + JSON_ROWS("json_rows"), + /** Returns output in raw format. */ + RAW("raw"), + /** Returns output in XML format. */ + XML("xml"); + + private String value; + + private OutputMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Specifies how to truncate lines to achieve the value in + * {@link #setMaximumLines}. + */ + public static enum TruncationMode { + /** Use the "abstract" truncation mode.*/ + ABSTRACT("abstract"), + /** Use the "truncate" truncation mode.*/ + TRUNCATE("truncate"); + + private String value; + + private TruncationMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public JobEventsArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the maximum number of results to return. To return all available results, specify 0. The default value is 100. + * + * @param count + * The maximum number of results. + */ + public void setCount(int count) { + this.put("count", count); + } + + /** + * Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param earliestTime + * The earliest time. + */ + public void setEarliestTime(String earliestTime) { + this.put("earliest_time", earliestTime); + } + + /** + * Sets a list of fields to return for the event set. + * + * @param fieldList + * A list of fields. + */ + public void setFieldList(String[] fieldList) { + this.put("f", fieldList); + } + + /** + * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param latestTime + * The latest time. + */ + public void setLatestTime(String latestTime) { + this.put("latest_time", latestTime); + } + + /** + * Sets the maximum number of lines that any single event's <b>_raw</b> field should contain. + * + * @param maximumLines + * The maximum number of lines. For no limit, specify 0. + */ + public void setMaximumLines(int maximumLines) { + this.put("max_lines", maximumLines); + } + + /** + * Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.<p>In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. + * + * @param offset + * The index of the first result to return. + */ + public void setOffset(int offset) { + this.put("offset", offset); + } + + /** + * Sets the format of the output. + * + * @param outputMode + * The output format. + */ + public void setOutputMode(OutputMode outputMode) { + this.put("output_mode", outputMode); + } + + /** + * Sets a UTC time format. + * + * @param outputTimeFormat + * A UTC time format. + */ + public void setOutputTimeFormat(String outputTimeFormat) { + this.put("output_time_format", outputTimeFormat); + } + + /** + * Sets the post-processing search to apply to results. + * + * @param search + * The post-processing search query. + */ + public void setSearch(String search) { + this.put("search", search); + } + + /** + * Sets the type of segmentation to perform on the data, including an option to perform k/v segmentation. + * + * @param segmentation + * The segmentation type. + */ + public void setSegmentation(String segmentation) { + this.put("segmentation", segmentation); + } + + /** + * Specifies an expression to convert a formatted time string from {start,end}_time into UTC seconds. The default format is "%m/%d/%Y:%H:%M:%S". + * + * @param timeFormat + * The time format. + */ + public void setTimeFormat(String timeFormat) { + this.put("time_format", timeFormat); + } + + /** + * Specifies how to truncate lines to achieve the value in {@link #setMaximumLines}. + * + * @param truncationMode + * The truncation mode. + */ + public void setTruncationMode(TruncationMode truncationMode) { + this.put("truncation_mode", truncationMode); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/JobExportArgs.java b/splunk/src/main/java/com/splunk/JobExportArgs.java new file mode 100644 index 00000000..5d5f8930 --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobExportArgs.java @@ -0,0 +1,447 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code JobExportArgs} class contains arguments for exporting events using + * the {@link Service#export} method. + */ +public class JobExportArgs extends Args { + + /** + * Specifies the format for the returned output. + */ + public static enum OutputMode { + /** Returns output in Atom format. */ + ATOM("atom"), + /** Returns output in CSV format. */ + CSV("csv"), + /** Returns output in JSON format. */ + JSON("json"), + /** Returns output in JSON_COLS format. */ + JSON_COLS("json_cols"), + /** Returns output in JSON_ROWS format. */ + JSON_ROWS("json_rows"), + /** Returns output in raw format. */ + RAW("raw"), + /** Returns output in XML format. */ + XML("xml"); + + private String value; + + private OutputMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Specifies how to create a job using the {@link JobCollection#create} + * method. + */ + public static enum SearchMode { + /** + * Searches historical data. + */ + NORMAL("normal"), + /** + * Searches live data. A real-time search may also be specified by + * setting the "earliest_time" and "latest_time" parameters to begin + * with "rt", even if the search_mode is set to "normal" or is not set. + * <p> + * If both the "earliest_time" and "latest_time" parameters are set to + * "rt", the search represents all appropriate live data that was + * received since the start of the search. + * <p> + * If both the "earliest_time" and "latest_time" parameters are set to + * "rt" followed by a relative time specifier, a sliding window is used + * where the time bounds of the window are determined by the relative + * time specifiers and are continuously updated based on current time. + */ + REALTIME("realtime"); + + private String value; + + private SearchMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Specifies how to truncate lines to achieve the value in + * {@link #setMaximumLines}. + */ + public static enum TruncationMode { + /** Use the "abstract" truncation mode.*/ + ABSTRACT("abstract"), + /** Use the "truncate" truncation mode.*/ + TRUNCATE("truncate"); + + private String value; + + private TruncationMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public JobExportArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Specifies the earliest time in the time range to search, based on the index time. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param indexEarliest + * The earliest time. + */ + public void setIndexEarliest(String indexEarliest) { + this.put("index_earliest", indexEarliest); + } + + /** + * Specifies the latest time in the time range to search, based on the index time. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param indexLatest + * The latest time. + */ + public void setIndexLatest(String indexLatest) { + this.put("index_latest", indexLatest); + } + + /** + * Sets the format of the output. + * + * @param outputMode + * The output format. + */ + public void setOutputMode(OutputMode outputMode) { + this.put("output_mode", outputMode); + } + + /** + * Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. + * + * @param autoCancel + * The number of seconds after which to cancel a job. + */ + public void setAutoCancel(int autoCancel) { + this.put("auto_cancel", autoCancel); + } + + /** + * Sets the number of events to process after which to auto-finalize the search. A value of 0 means no limit. + * + * @param autoFinalizeEventCount + * The number of events. + */ + public void setAutoFinalizeEventCount(int autoFinalizeEventCount) { + this.put("auto_finalize_ec", autoFinalizeEventCount); + } + + /** + * Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. + * + * @param autoPause + * The number of seconds after which to pause. + */ + public void setAutoPause(int autoPause) { + this.put("auto_pause", autoPause); + } + + /** + * Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param earliestTime + * The earliest time. + */ + public void setEarliestTime(String earliestTime) { + this.put("earliest_time", earliestTime); + } + + /** + * Indicates whether to enable lookups for this search. Enabling lookups might slow searches significantly depending on the nature of the lookups. + * + * @param enableLookups + * {@code true} to enable lookups, {@code false} if not. + */ + public void setEnableLookups(boolean enableLookups) { + this.put("enable_lookups", enableLookups); + } + + /** + * Specifies whether this search should cause (and wait depending on the value of {@code setSynchronizeBundleReplication}) bundle synchronization with all search peers. + * + * @param forceBundleReplication + * {@code true} if this search should cause bundle synchronization, {@code false} if not. + */ + public void setForceBundleReplication(boolean forceBundleReplication) { + this.put("force_bundle_replication", forceBundleReplication); + } + + /** + * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param latestTime + * The latest time. + */ + public void setLatestTime(String latestTime) { + this.put("latest_time", latestTime); + } + + /** + * Sets the number of seconds to run this search before finalizing. Specify 0 to never finalize. + * + * @param maximumTime + * The maximum time, in seconds. + */ + public void setMaximumTime(int maximumTime) { + this.put("max_time", maximumTime); + } + + /** + * Specifies the application namespace in which to restrict searches. + * + * @param namespace + * The namespace. + */ + public void setNamespace(String namespace) { + this.put("namespace", namespace); + } + + /** + * Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.<p> You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.<p>For information about relative time modifiers, see <a href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers" target="_blank">Time modifiers for search</a> in the Search Reference. + * + * @param now + * A time string. + */ + public void setNow(String now) { + this.put("now", now); + } + + /** + * Sets the time to wait between running the MapReduce phase on accumulated map values. + * + * @param reduceFrequency + * The time to wait, in seconds. + */ + public void setReduceFrequency(int reduceFrequency) { + this.put("reduce_freq", reduceFrequency); + } + + /** + * Indicates whether to reload macro definitions from the macros.conf configuration file. + * + * @param reloadMacros + * {@code true} to reload macro definitions, {@code false} if not. + */ + public void setReloadMacros(boolean reloadMacros) { + this.put("reload_macros", reloadMacros); + } + + /** + * Sets a list of (possibly wildcarded) servers from which to pull raw events. This same server list is used in subsearches. + * + * @param remoteServerList + * A list of servers. + */ + public void setRemoteServerList(String[] remoteServerList) { + StringBuilder csv = new StringBuilder(); + for (int i = 0, n = remoteServerList.length; i < n; i++) { + if (i != 0) { + csv.append(","); + } + csv.append(remoteServerList[i]); + } + + this.put("remote_server_list", String.valueOf(csv)); + } + + /** + * Sets one or more fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. + * + * @param fieldList + * The list of fields. + */ + public void setFieldList(String[] fieldList) { + this.put("f", fieldList); + } + + /** + * Sets one or more required fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. + * + * @param requiredFieldList + * The list of required fields. + */ + public void setRequiredFieldList(String[] requiredFieldList) { + this.put("rf", requiredFieldList); + } + + /** + * Indicates whether the indexer blocks if the queue for this search is full. Only applies to real-time searches. + * + * @param realtimeBlocking + * {@code true} to block the indexer for a full queue, {@code false} if not. + */ + public void setRealtimeBlocking(boolean realtimeBlocking) { + this.put("rt_blocking", realtimeBlocking); + } + + /** + * Indicates whether the indexer pre-filters events. Only applies to real-time searches. + * + * @param realtimeIndexFilter + * {@code true} to pre-filter events, {@code false} if not. + */ + public void setRealtimeIndexFilter(boolean realtimeIndexFilter) { + this.put("rt_indexfilter", realtimeIndexFilter); + } + + /** + * Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. + * + * @param realtimeMaximumBlockSeconds + * The maximum time to block, in seconds. + */ + public void setRealtimeMaximumBlockSeconds(int realtimeMaximumBlockSeconds) { + this.put("rt_maxblocksecs", realtimeMaximumBlockSeconds); + } + + /** + * Sets the number indicating the queue size (in events) that the indexer should use for this search. Only applies to real-time searches. + * + * @param realtimeQueueSize + * The queue size, in events. + */ + public void setRealtimeQueueSize(int realtimeQueueSize) { + this.put("rt_queue_size", realtimeQueueSize); + } + + /** + * Sets a string that registers a search state listener with the search. Use the format: {@code search_state;results_condition;http_method;uri;}<p>For example:<p>{@code search_listener=onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;} + * + * @param searchListener + * The search listener string. + */ + public void setSearchListener(String searchListener) { + this.put("search_listener", searchListener); + } + + /** + * Sets the search mode ("normal" or "realtime"). + * + * @param searchMode + * The search mode. + */ + public void setSearchMode(SearchMode searchMode) { + this.put("search_mode", searchMode); + } + + /** + * Indicates whether this search should wait for bundle replication to complete. + * + * @param synchronizeBundleReplication + * {@code true} to wait for bundle replication, {@code false} if not. + */ + public void setSynchronizeBundleReplication(boolean synchronizeBundleReplication) { + this.put("sync_bundle_replication", synchronizeBundleReplication); + } + + /** + * Sets the format for converting a formatted time string from {start,end}_time into UTC seconds. The default value is ISO-8601. + * + * @param timeFormat + * The time format string. + */ + public void setTimeFormat(String timeFormat) { + this.put("time_format", timeFormat); + } + + /** + * Sets the number of seconds to keep this search after processing has stopped. + * + * @param timeout + * The timeout, in seconds. + */ + public void setTimeout(int timeout) { + this.put("timeout", timeout); + } + + /** + * Sets the maximum number of lines that any single event's <b>_raw</b> field should contain. + * + * @param maximumLines + * The maximum number of lines. For no limit, specify 0. + */ + public void setMaximumLines(int maximumLines) { + this.put("max_lines", maximumLines); + } + + /** + * Sets a UTC time format. + * + * @param outputTimeFormat + * A UTC time format. + */ + public void setOutputTimeFormat(String outputTimeFormat) { + this.put("output_time_format", outputTimeFormat); + } + + /** + * Sets the type of segmentation to perform on the data, including an option to perform k/v segmentation. + * + * @param segmentation + * The segmentation type. + */ + public void setSegmentation(String segmentation) { + this.put("segmentation", segmentation); + } + + /** + * Specifies how to truncate lines to achieve the value in {@link #setMaximumLines}. + * + * @param truncationMode + * The truncation mode. + */ + public void setTruncationMode(TruncationMode truncationMode) { + this.put("truncation_mode", truncationMode); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/JobResultsArgs.java b/splunk/src/main/java/com/splunk/JobResultsArgs.java new file mode 100644 index 00000000..a35bbd8b --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobResultsArgs.java @@ -0,0 +1,116 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code JobResultsArgs} class contains arguments for getting job results + * using the {@link Job#getResults} method. + */ +public class JobResultsArgs extends Args { + + /** + * Specifies the format for the returned output. + */ + public static enum OutputMode { + /** Returns output in Atom format. */ + ATOM("atom"), + /** Returns output in CSV format. */ + CSV("csv"), + /** Returns output in JSON format. */ + JSON("json"), + /** Returns output in JSON_COLS format. */ + JSON_COLS("json_cols"), + /** Returns output in JSON_ROWS format. */ + JSON_ROWS("json_rows"), + /** Returns output in raw format. */ + RAW("raw"), + /** Returns output in XML format. */ + XML("xml"); + + private String value; + + private OutputMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public JobResultsArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the maximum number of results to return. + * + * @param count + * The maximum number of results. To return all available results, specify 0. + */ + public void setCount(int count) { + this.put("count", count); + } + + /** + * Sets a list of fields to return for the event set. + * + * @param fieldList + * A list of fields. + */ + public void setFieldList(String[] fieldList) { + this.put("f", fieldList); + } + + /** + * Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.<p>In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. + * + * @param offset + * The index of the first result to return. + */ + public void setOffset(int offset) { + this.put("offset", offset); + } + + /** + * Sets the format of the output. + * + * @param outputMode + * The output format. + */ + public void setOutputMode(OutputMode outputMode) { + this.put("output_mode", outputMode); + } + + /** + * Sets the post-processing search to apply to results. + * + * @param search + * The post-processing search query. + */ + public void setSearch(String search) { + this.put("search", search); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/JobResultsPreviewArgs.java b/splunk/src/main/java/com/splunk/JobResultsPreviewArgs.java new file mode 100644 index 00000000..d929f010 --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobResultsPreviewArgs.java @@ -0,0 +1,116 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code JobResultsPreviewArgs} class contains arguments for getting job + * results previews using the {@link Job#getResultsPreview} method. + */ +public class JobResultsPreviewArgs extends Args { + + /** + * Specifies the format for the returned output. + */ + public static enum OutputMode { + /** Returns output in Atom format. */ + ATOM("atom"), + /** Returns output in CSV format. */ + CSV("csv"), + /** Returns output in JSON format. */ + JSON("json"), + /** Returns output in JSON_COLS format. */ + JSON_COLS("json_cols"), + /** Returns output in JSON_ROWS format. */ + JSON_ROWS("json_rows"), + /** Returns output in raw format. */ + RAW("raw"), + /** Returns output in XML format. */ + XML("xml"); + + private String value; + + private OutputMode(String value) { + this.value = value; + } + + /** + * @return The REST API value for this enumerated constant. + */ + public String toString() { + return this.value; + } + } + + /** + * Class constructor. + */ + public JobResultsPreviewArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the maximum number of results to return. + * + * @param count + * The maximum number of results. To return all available results, specify 0. + */ + public void setCount(int count) { + this.put("count", count); + } + + /** + * Sets a list of fields to return for the event set. + * + * @param fieldList + * A list of fields. + */ + public void setFieldList(String[] fieldList) { + this.put("f", fieldList); + } + + /** + * Specifies the index of the first result (inclusive) from which to begin returning data. This value is 0-indexed.<p>In Splunk 4.1+, negative offsets are allowed and are added to the count to compute the absolute offset (for example, offset=-1 is the last available offset). Offsets in the results are always absolute and never negative. The default value is 0. + * + * @param offset + * The index of the first result to return. + */ + public void setOffset(int offset) { + this.put("offset", offset); + } + + /** + * Sets the format of the output. + * + * @param outputMode + * The output format. + */ + public void setOutputMode(OutputMode outputMode) { + this.put("output_mode", outputMode); + } + + /** + * Sets the post-processing search to apply to results. + * + * @param search + * The post-processing search query. + */ + public void setSearch(String search) { + this.put("search", search); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/JobSummaryArgs.java b/splunk/src/main/java/com/splunk/JobSummaryArgs.java new file mode 100644 index 00000000..ff7eff7e --- /dev/null +++ b/splunk/src/main/java/com/splunk/JobSummaryArgs.java @@ -0,0 +1,122 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; +/** + * The {@code JobSummaryArgs} class contains arguments for getting a job summary + * using the {@link Job#getSummary} method. + */ +public class JobSummaryArgs extends Args { + + /** + * Class constructor. + */ + public JobSummaryArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param earliestTime + * The earliest time. + */ + public void setEarliestTime(String earliestTime) { + this.put("earliest_time", earliestTime); + } + + /** + * Sets a list of fields to return for the event set. + * + * @param fieldList + * A list of fields. + */ + public void setFieldList(String[] fieldList) { + this.put("f", fieldList); + } + + /** + * Indicates whether to add histogram data to the summary output. + * + * @param histogram + * {@code true} to add histogram data, {@code false} if not. + */ + public void setHistogram(boolean histogram) { + this.put("histogram", histogram); + } + + /** + * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. + * + * @param latestTime + * The latest time. + */ + public void setLatestTime(String latestTime) { + this.put("latest_time", latestTime); + } + + /** + * Sets the fraction of results for each key that this key must occur in to be displayed. + * + * @param minimumFrequency + * The frequency, as a fraction (a value between 0 and 1). + */ + public void setMinimumFrequency(double minimumFrequency) { + this.put("min_freq", minimumFrequency); + } + + /** + * Sets a UTC time format. + * + * @param outputTimeFormat + * A UTC time format. + */ + public void setOutputTimeFormat(String outputTimeFormat) { + this.put("output_time_format", outputTimeFormat); + } + + /** + * Sets a search query to filter the response. The response matches field values against the search query. For example, "foo" matches any object that has "foo" as a substring in a field, and "field_name=field_value" restricts the match to a single field. + * + * @param search + * A search substring. + */ + public void setSearch(String search) { + this.put("search", search); + } + + /** + * Specifies an expression to convert a formatted time string from {start,end}_time into UTC seconds. The default format is "%m/%d/%Y:%H:%M:%S". + * + * @param timeFormat + * The time format. + */ + public void setTimeFormat(String timeFormat) { + this.put("time_format", timeFormat); + } + + /** + * Sets for each key how many of the most frequent items to return. + * + * @param topCount + * The number of items to return. + */ + public void setTopCount(int topCount) { + this.put("top_count", topCount); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/License.java b/splunk/src/main/java/com/splunk/License.java new file mode 100644 index 00000000..0961c3c0 --- /dev/null +++ b/splunk/src/main/java/com/splunk/License.java @@ -0,0 +1,164 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; + +/** + * The {@code License} class represents a license, providing access to the + * licenses for this Splunk instance. Splunk licenses specify how much data + * you can index per calendar day (from midnight to midnight by the clock on + * the license master). + */ +public class License extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The license endpoint. + */ + License(Service service, String path) { + super(service, path); + } + + /** + * Returns the time and date the license was created. + * + * @return The creation time and date. + */ + public Date getCreationTime() { + return getDate("creation_time"); + } + + /** + * Returns the time and date this license expires. + * + * @return The expiration time and date. + */ + public Date getExpirationTime() { + return getDate("expiration_time"); + } + + /** + * Returns a list of enabled features for this license. + * + * @return The feature list. + */ + public String[] getFeatures() { + return getStringArray("features"); + } + + /** + * Returns the group ID for this license. + * + * @return The license group ID, or {@code null} if not available. + */ + public String getGroupId() { + return getString("group_id", null); + } + + /** + * Returns the label for this license. + * + * @return This license label, or {@code null} if not available. + */ + public String getLabel() { + return getString("label", null); + } + + /** + * Returns the hash value for this license. + * + * @return The license hash value. + */ + public String getLicenseHash() { + return getString("license_hash"); + } + + /** + * Returns the maximum number of violations allowed for this license. + * A violation occurs when you exceed the maximum indexing volume allowed + * for your license. Exceeding the maximum violations will disable search. + * + * @return The maximum number of license violations. + */ + public int getMaxViolations() { + return getInteger("max_violations"); + } + + /** + * Returns the daily indexing quota, which is the maximum bytes per day + * of indexing volume for this license. + * + * @return The daily indexing quota, in bytes. + */ + public long getQuota() { + return getByteCount("quota"); + } + + /** + * Returns the source types that, when indexed, count against the indexing + * volume for this license. All source types are allowed if none + * are explicitly specified. + * + * @return The license source types, or {@code null} if not specified. + */ + public String[] getSourceTypes() { + return getStringArray("sourcetypes", null); + } + + /** + * Returns the stack ID for this license. + * + * @return The license stack ID. + */ + public String getStackId() { + return getString("stack_id"); + } + + /** + * Returns the status of this license. + * + * @return The license status. + */ + public String getStatus() { + return getString("status"); + } + + /** + * Returns the license type. + * + * @return The license type. + */ + public String getType() { + return getString("type"); + } + + /** + * Returns the number of days remaining in the rolling time window + * for this license. A license violation occurs when you have + * exceeded the number of allowed warnings within this period of + * time. + * + * @return The number of days in the rolling window. + */ + public int getWindowPeriod() { + return getInteger("window_period"); + } +} + diff --git a/splunk/com/splunk/LicenseGroup.java b/splunk/src/main/java/com/splunk/LicenseGroup.java similarity index 52% rename from splunk/com/splunk/LicenseGroup.java rename to splunk/src/main/java/com/splunk/LicenseGroup.java index 78c1b25c..c0473b7a 100644 --- a/splunk/com/splunk/LicenseGroup.java +++ b/splunk/src/main/java/com/splunk/LicenseGroup.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,15 @@ package com.splunk; /** - * Representation of a License Group. - */ +* The {@code LicenseGroup} class represents a license group, which is a +* collection of one or more license stacks. +*/ public class LicenseGroup extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The license group endpoint. */ LicenseGroup(Service service, String path) { @@ -32,20 +33,31 @@ public class LicenseGroup extends Entity { } /** - * Returns this license group's stack ID, or null if not specified. + * Returns the stack IDs of the license stacks in this license group. * - * @return This license group's stack ID. + * @return The stack IDs, or {@code null} if not specified. */ public String[] getStackIds() { - return getStringArray("stack_ids", null); + return getStringArray("stack_ids", new String[]{""}); } /** - * Returns whether or not this license group is active. + * Indicates whether this license group is active. * - * @return Whether or not this license group is active. + * @return {@code true} if this license group is active, {@code false} + * if not. */ public boolean isActive() { return getBoolean("is_active"); } + + /** + * Sets whether this license group is active. + * + * @param value {@code true} to set this license group as active, + * {@code false} for inactive. + */ + public void setActive(boolean value) { + setCacheValue("is_active", value); + } } diff --git a/splunk/com/splunk/LicenseMessage.java b/splunk/src/main/java/com/splunk/LicenseMessage.java similarity index 56% rename from splunk/com/splunk/LicenseMessage.java rename to splunk/src/main/java/com/splunk/LicenseMessage.java index ab9337b4..8c1fe21b 100644 --- a/splunk/com/splunk/LicenseMessage.java +++ b/splunk/src/main/java/com/splunk/LicenseMessage.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -19,14 +19,17 @@ import java.util.Date; /** - * Representation of a license message. + * The {@code LicenseMessage} class represents a license message. + * Messages may range from helpful warnings about being close to violations + * or licenses expiring, to more severe alerts regarding overages and exceeding + * the daily indexing volume limit. */ public class LicenseMessage extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The license group endpoint. */ LicenseMessage(Service service, String path) { @@ -34,63 +37,63 @@ public class LicenseMessage extends Entity { } /** - * Returns this license message's category. + * Returns the category of this license message. * - * @return This license message's category. + * @return The category. */ public String getCategory() { return getString("category"); } /** - * Returns this license message's creation time. + * Returns the time and date that this license message was created. * - * @return This license message's creation time. + * @return The creation time and date. */ public Date getCreationTime() { - return getDateFromEpoch("create_time"); + return getDate("create_time"); } /** - * Returns this license message's description,, or null if not specified. + * Returns the description of this license message. * - * @return This license message's description. + * @return The description, or {@code null} if not specified. */ public String getDescription() { return getString("description", null); } /** - * Returns this license message's pool ID, or null if not specified. + * Returns the pool ID of this license message. * - * @return This license message's pool ID. + * @return The pool ID, or {@code null} if not specified. */ public String getPoolId() { return getString("pool_id", null); } /** - * Returns this license message's severity, or null if not specified. + * Returns the severity of this license message. * - * @return This license message's severity. + * @return The severity, or {@code null} if not specified. */ public String getSeverity() { return getString("severity", null); } /** - * Returns this license message's slave ID, or null if not specified. + * Returns the slave ID of this license message. * - * @return this license message's slave ID. + * @return The slave ID, or {@code null} if not specified. */ public String getSlaveId() { return getString("slave_id", null); } /** - * Returns this license message's stack ID, or null if not specified. + * Returns the stack ID of this license message. * - * @return This license message's stack ID. + * @return The stack ID, or {@code null} if not specified. */ public String getStackId() { return getString("stack_id", null); diff --git a/splunk/src/main/java/com/splunk/LicensePool.java b/splunk/src/main/java/com/splunk/LicensePool.java new file mode 100644 index 00000000..613fcaac --- /dev/null +++ b/splunk/src/main/java/com/splunk/LicensePool.java @@ -0,0 +1,173 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +/** +* The {@code LicensePool} class represents a license pool, which is made up +* of a single license master and zero or more license slave instances of Splunk +* that are configured to use the licensing volume from a set license or license + * stack. + */ +public class LicensePool extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The license pool endpoint. + */ + LicensePool(Service service, String path) { + super(service, path); + } + + /** + * Returns the description of this license pool. + * + * @return The description, or {@code null} if not specified. + */ + public String getDescription() { + return getString("description", null); + } + + /** + * Returns the indexing quota for this license pool. + * + * @return A string containing the indexing quota in bytes, or "MAX" to + * indicate the maximum amount that is allowed. + */ + public String getQuota() { + return getString("quota", "0"); + } + + /** + * Returns the list of slaves for this license pool. + * + * @return A comma-separated list of slaves by ID, or {@code null} if not + * specified. + */ + public String[] getSlaves() { + if (toUpdate.containsKey("slaves")) { + String value = (String)toUpdate.get("slaves"); + return value.split(","); + } + else { + return getStringArray("slaves", null); + } + } + + /** + * Returns the usage of indexing volume by slave licenses in this license + * pool. + * + * @return A map from each slave GUID to the number of bytes it is using. + */ + public Map<String, Long> getSlavesUsageBytes() { + @SuppressWarnings("unchecked") + HashMap<String, Object> values = (HashMap<String, Object>)get("slaves_usage_bytes"); + if (values == null) { + values = new HashMap<String, Object>(); + } + + HashMap<String, Long> usageBytes = new HashMap<String, Long>(); + + for(String key : values.keySet()) { + String value = (String)values.get(key); + usageBytes.put(key, Long.parseLong(value)); + } + + return usageBytes; + } + + /** + * Returns the stack ID for this license pool. Valid values are: + * <ul> + * <li>"download-trial"</li> + * <li>"enterprise"</li> + * <li>"forwarder"</li> + * <li>"free"</li></ul> + * + * @return The license pool stack ID, or {@code null} if not specified. + */ + public String getStackId() { + return getString("stack_id", null); + } + + /** + * Returns the usage of indexing volume for this license pool. + * + * @return This license pool's usage, in bytes. + */ + public long getUsedBytes() { + return getLong("used_bytes", 0); + } + + /** + * Sets whether to append or overwrite slaves to this license pool. + * + * @param appendSlaves {@code true} to append slaves, {@code false} to + * overwrite slaves. + */ + public void setAppendSlaves(boolean appendSlaves) { + setCacheValue("append_slaves", appendSlaves); + } + + /** + * Sets the description of this license pool. + * + * @param description The description. + */ + public void setDescription(String description) { + setCacheValue("description", description); + } + + /** + * Sets the byte quota of this license pool. + * + * @param quota The indexing quota of this license pool, specified as: + * <ul><li><i>number</i></li> + * <li><i>number</i> followed by "MB" or "GB" (for example, "10GB")</li> + * <li>"MAX" (Only one license pool can have "MAX" size in a stack.)</li> + * </ul> + */ + public void setQuota(String quota) { + setCacheValue("quota", quota); + } + + /** + * Sets the list of slaves that are members of this license pool. + * + * @param slaves The comma-separated list of slaves. Use an asterisk ("*") + * to accept all slaves. + */ + public void setSlaves(String slaves) { + setCacheValue("slaves", slaves); + } + + /** + * Sets the list of slaves that are members of this license pool. + * + * @param slaves The array of slaves. To accept all slaves, use an + * array with a single asterisk element ("*"). + */ + public void setSlaves(String[] slaves) { + setSlaves(Util.join(",", slaves)); + } +} diff --git a/splunk/src/main/java/com/splunk/LicensePoolCollection.java b/splunk/src/main/java/com/splunk/LicensePoolCollection.java new file mode 100644 index 00000000..85668dfa --- /dev/null +++ b/splunk/src/main/java/com/splunk/LicensePoolCollection.java @@ -0,0 +1,83 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code LicensePoolCollection} class represents a collection of license + * pools. + */ +public class LicensePoolCollection extends EntityCollection<LicensePool> { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + LicensePoolCollection(Service service) { + super(service, "licenser/pools", LicensePool.class); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + */ + LicensePoolCollection(Service service, Args args) { + super(service, "licenser/pools", LicensePool.class, args); + } + + /** + * Creates a license pool. + * + * @param name The name of the new license pool. + * @param quota The indexing quota of this license pool, specified as: + * <ul><li><i>number</i></li> + * <li><i>number</i> followed by "MB" or "GB" (for example, "10GB")</li> + * <li>"MAX" (Only one license pool can have "MAX" size in a stack.)</li> + * </ul> + * @param stackId The stack ID corresponding to this license pool. + * @return The new license pool. + */ + public LicensePool create(String name, String quota, String stackId) { + return create(name, quota, stackId, null); + } + + /** + * Creates a license pool. + * + * @param name The name of the new license pool. + * @param quota The indexing quota of this license pool, specified as: + * <ul><li><i>number</i></li> + * <li><i>number</i> followed by "MB" or "GB" (for example, "10GB")</li> + * <li>"MAX" (Only one license pool can have "MAX" size in a stack.)</li> + * </ul> + * @param stackId The stack ID corresponding to this license pool. + * @param args Optional arguments ("description" and "slaves"). + * @return The new license pool. + */ + public LicensePool + create(String name, String quota, String stackId, Map args) { + args = Args.create(args); + args.put("quota", quota); + args.put("stack_id", stackId); + return create(name, args); + } +} diff --git a/splunk/com/splunk/LicenseSlave.java b/splunk/src/main/java/com/splunk/LicenseSlave.java similarity index 64% rename from splunk/com/splunk/LicenseSlave.java rename to splunk/src/main/java/com/splunk/LicenseSlave.java index ec45f182..38175ed4 100644 --- a/splunk/com/splunk/LicenseSlave.java +++ b/splunk/src/main/java/com/splunk/LicenseSlave.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,16 @@ package com.splunk; /** - * Representation of a license slave. + * The {@code LicenseSlave} class represents a license slave, which is a member + * of one or more license pools. The access a license slave has to license + * volume is controlled by its license master. */ public class LicenseSlave extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The license slave endpoint. */ LicenseSlave(Service service, String path) { @@ -32,27 +34,27 @@ public class LicenseSlave extends Entity { } /** - * Returns this license slave's label, or null if not specified. + * Returns the label for this license slave. * - * @return This license slave's label. + * @return The label, or {@code null} if not specified. */ public String getLabel() { return getString("label", null); } /** - * Returns this license slave's list of pool IDs. + * Returns a list of pool IDs for this license slave. * - * @return This license slave's list of pool IDs. + * @return The list of pool IDs. */ public String[] getPoolIds() { return getStringArray("pool_ids"); } /** - * Returns this license slave's list of stack IDs. + * Returns a list of stack IDs for this license pool. * - * @return This license slave's list of stack IDs. + * @return The list of stack IDs. */ public String[] getStackIds() { return getStringArray("stack_ids"); diff --git a/splunk/com/splunk/LicenseStack.java b/splunk/src/main/java/com/splunk/LicenseStack.java similarity index 63% rename from splunk/com/splunk/LicenseStack.java rename to splunk/src/main/java/com/splunk/LicenseStack.java index b572e3b0..3420b329 100644 --- a/splunk/com/splunk/LicenseStack.java +++ b/splunk/src/main/java/com/splunk/LicenseStack.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,15 @@ package com.splunk; /** - * Representation of a license stack. + * The {@code LicenseStack} class represents a license stack, which is + * a collection of licenses of the same type. */ public class LicenseStack extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The license stack endpoint. */ LicenseStack(Service service, String path) { @@ -32,27 +33,28 @@ public class LicenseStack extends Entity { } /** - * Returns this license stack's label, or null if not specified. + * Returns the label of this license stack. * - * @return This license stack's label. + * @return This license stack's label, or {@code null} if not specified. */ public String getLabel() { return getString("label", null); } /** - * Returns this license stack's daily indexing quota. + * Returns the combined daily indexing quota for all of the licenses + * in this license stack. * - * @return This license stack's daily indexing quota. + * @return The daily indexing quota, in bytes. */ public long getQuota() { return getByteCount("quota", 0); } /** - * Returns this license stack's type. + * Returns the license type of the licenses in this license stack. * - * @return This license stack's type. + * @return The license type. */ public String getType() { return getString("type"); diff --git a/splunk/src/main/java/com/splunk/LimitPivotFilter.java b/splunk/src/main/java/com/splunk/LimitPivotFilter.java new file mode 100644 index 00000000..dd4b89a0 --- /dev/null +++ b/splunk/src/main/java/com/splunk/LimitPivotFilter.java @@ -0,0 +1,111 @@ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Represents a limit on the events shown in a pivot by sorting them according to some field, then taking + * the specified number from the beginning or end of the list. + */ +public class LimitPivotFilter extends PivotFilter { + private final StatsFunction statsFunction; + private final String sortAttribute; + private final int limit; + private final SortDirection sortDirection; + + /** + * Throws IllegalArgumentException if statsFunction is not one of + * - COUNT, DISTINCT_COUNT (for fields of type string) + * - COUNT, DISTINCT_COUNT, SUM, AVERAGE (for fields of type number) + * - COUNT (for fields of type object count) + */ + LimitPivotFilter(DataModelObject dataModelObject, String fieldName, String sortAttribute, + SortDirection sortDirection, int limit, + StatsFunction statsFunction) { + super(dataModelObject, fieldName); + FieldType type = dataModelObject.getField(fieldName).getType(); + if (type != FieldType.NUMBER && type != FieldType.STRING && type != FieldType.OBJECTCOUNT) { + throw new IllegalArgumentException("Field " + fieldName + " on the data model object was of type " + + dataModelObject.getField(fieldName).getType().toString() + ", expected number, string, " + + "or object count."); + } + this.sortAttribute = sortAttribute; + this.sortDirection = sortDirection; + this.limit = limit; + + if (type == FieldType.STRING && statsFunction != StatsFunction.COUNT && + statsFunction != StatsFunction.DISTINCT_COUNT) { + throw new IllegalArgumentException("Stats function for fields of type string must be COUNT or " + + "DISTINCT_COUNT; found " + statsFunction.toString()); + } + if (type == FieldType.NUMBER && statsFunction != StatsFunction.COUNT && + statsFunction != StatsFunction.DISTINCT_COUNT && statsFunction != StatsFunction.SUM && + statsFunction != StatsFunction.AVERAGE) { + throw new IllegalArgumentException("Stats function for fields of type number must be one of COUNT, " + + "DISTINCT_COUNT, SUM, or AVERAGE; found " + statsFunction.toString()); + } + if (type == FieldType.OBJECTCOUNT && statsFunction != StatsFunction.COUNT) { + throw new IllegalArgumentException("Stats function for fields of type object count must be COUNT; " + + "found " + statsFunction.toString()); + } + this.statsFunction = statsFunction; + } + + /** + * Return the name of the field to use for sorting. + * @return String value + */ + public String getAttributeName() { + return this.sortAttribute; + } + + /** + * @return a list of the names of DataModelObjects from the most remote ancestor that is + * not a built-in parent to this data model object. + */ + public String[] getAttributeOwnerLineage() { + return this.dataModelObject.getField(this.sortAttribute).getOwnerLineage(); + } + + /** + * @return whether the limit takes the lowest (SortDirection.ASCENDING) or highest (SortDirection.DESCENDING) + * values from the sorted list. + */ + public SortDirection getSortDirection() { + return this.sortDirection; + } + + /** + * @return The number of values from the sorted list to allow through this filter. + */ + public int getLimit() { + return this.limit; + } + + /** + * @return The stats function to use for aggregation before sorting. + */ + public StatsFunction getStatsFunction() { + return this.statsFunction; + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + root.add("attributeName", new JsonPrimitive(this.getAttributeName())); + root.add("attributeOwner", new JsonPrimitive(Util.join(".", this.getAttributeOwnerLineage()))); + if (sortDirection == SortDirection.ASCENDING) { + root.add("limitType", new JsonPrimitive("lowest")); + } else if (sortDirection == SortDirection.DESCENDING) { + root.add("limitType", new JsonPrimitive("highest")); + } + root.add("limitAmount", new JsonPrimitive(this.limit)); + root.add("statsFn", new JsonPrimitive(this.statsFunction.toString())); + + return root; + } +} diff --git a/splunk/com/splunk/Logger.java b/splunk/src/main/java/com/splunk/Logger.java similarity index 58% rename from splunk/com/splunk/Logger.java rename to splunk/src/main/java/com/splunk/Logger.java index 35228011..4adf097f 100644 --- a/splunk/com/splunk/Logger.java +++ b/splunk/src/main/java/com/splunk/Logger.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,14 @@ package com.splunk; /** - * Representation of a logger. + * The {@code Logger} class represents a specific Splunkd logging category. */ public class Logger extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The logger endpoint. */ Logger(Service service, String path) { @@ -32,13 +32,23 @@ public class Logger extends Entity { } /** - * Returns this logger's logging level. Valid values are in the set FATAL, - * CRIT, WARN, INFO, and DEBUG. + * Returns the logging level of this logger. Valid values are: "FATAL", + * "CRIT", "WARN", "INFO", and "DEBUG". * - * @return This logger's logging level. + * @return The logging level. */ public String getLevel() { return getString("level"); } + + /** + * Sets the logging level of this logger. Valid values are: "FATAL", + * "CRIT", "WARN", "INFO", and "DEBUG". + * + * @param level The logging level. + */ + public void setLevel(String level) { + setCacheValue("level", level); + } } diff --git a/splunk/src/main/java/com/splunk/LookupDataModelCalculation.java b/splunk/src/main/java/com/splunk/LookupDataModelCalculation.java new file mode 100644 index 00000000..6aec4a86 --- /dev/null +++ b/splunk/src/main/java/com/splunk/LookupDataModelCalculation.java @@ -0,0 +1,57 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Collections; +import java.util.List; +import java.util.Map; + +/** + * Represents a lookup calculation on a data model object. + * + * A lookup calculation takes the value of an input field and uses it to + * look up new values for the output fields in a lookup. + */ +public class LookupDataModelCalculation extends DataModelCalculation { + private final List<LookupFieldMapping> inputFieldMappings; + private final String lookupName; + + public static class LookupFieldMapping { + public String inputField; + public String lookupField; + } + + LookupDataModelCalculation(String[] ownerLineage, String calculationID, + Map<String, DataModelField> generatedFields, String comment, + boolean editable, String lookupName, + List<LookupFieldMapping> inputFieldMappings) { + super(ownerLineage, calculationID, generatedFields, comment, editable); + this.lookupName = lookupName; + this.inputFieldMappings = inputFieldMappings; + } + + /** + * @return the name of the lookup to use + */ + public String getLookupName() { return this.lookupName; } + + /** + * @return the mappings from fields in the events to fields in the lookup + */ + public List<LookupFieldMapping> getInputFieldMappings() { + return Collections.unmodifiableList(this.inputFieldMappings); + } +} diff --git a/splunk/com/splunk/Message.java b/splunk/src/main/java/com/splunk/Message.java similarity index 66% rename from splunk/com/splunk/Message.java rename to splunk/src/main/java/com/splunk/Message.java index 838e5651..656a85ed 100644 --- a/splunk/com/splunk/Message.java +++ b/splunk/src/main/java/com/splunk/Message.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,16 @@ package com.splunk; /** - * Representation of a message. + * The {@code Message} class represents a message. Most messages are created by + * Splunkd to inform the user of system problems, such as license quotas, + * license expirations, misconfigured indexes, and disk space. */ public class Message extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The message endpoint. */ Message(Service service, String path) { @@ -32,18 +34,18 @@ public class Message extends Entity { } /** - * Returns this message's title. + * Returns the title of this message. * - * @return This message's title. + * @return The message title. */ public String getKey() { return getTitle(); } /** - * Returns this message's value. + * Returns the content of this message. * - * @return This message's value. + * @return The message text. */ public String getValue() { return getString(getKey()); diff --git a/splunk/com/splunk/MessageCollection.java b/splunk/src/main/java/com/splunk/MessageCollection.java similarity index 52% rename from splunk/com/splunk/MessageCollection.java rename to splunk/src/main/java/com/splunk/MessageCollection.java index 36efa66a..db8c1267 100644 --- a/splunk/com/splunk/MessageCollection.java +++ b/splunk/src/main/java/com/splunk/MessageCollection.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,25 +17,38 @@ package com.splunk; /** - * Representation of a collection of messages. + * The {@code MessageCollection} class represents a collection of messages, + * providing access to Splunk system messages. Most messages are created by + * Splunkd to inform the user of system problems. */ public class MessageCollection extends EntityCollection<Message> { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. */ MessageCollection(Service service) { super(service, "messages", Message.class); } /** - * Create a new message. + * Class constructor. * - * @param name The name of the new message. - * @param value The value of the message. - * @return The created message. + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + */ + MessageCollection(Service service, Args args) { + super(service, "messages", Message.class, args); + } + + /** + * Creates a new message. + * + * @param name The name (primary key) of the new message. + * @param value The message text. + * @return The new message. */ public Message create(String name, String value) { Args args = new Args("value", value); diff --git a/splunk/src/main/java/com/splunk/ModularInputKind.java b/splunk/src/main/java/com/splunk/ModularInputKind.java new file mode 100644 index 00000000..5cc6f2a5 --- /dev/null +++ b/splunk/src/main/java/com/splunk/ModularInputKind.java @@ -0,0 +1,111 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.HashMap; +import java.util.Map; +import java.util.List; + +/** + * The {@code ModularInputKind} class represents a particular modular input. + * The actual inputs of this kind can be accessed from the + * {@code InputCollection} object. + */ +public class ModularInputKind extends Entity { + protected Map<String, Map<String,String>> args; + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The entity's endpoint. + */ + ModularInputKind(Service service, String path) { + super(service, path); + Map<String, Map<String, Map<String,String>>> endpoint = + (Map<String, Map<String, Map<String,String>>>)get("endpoint"); + this.args = endpoint.get("args"); + } + + /** + * Returns an argument map that contains the argument names as keys, and the + * {@code ModularInputKindArgument}s as corresponding values. + * + * @return A {@code Map} containing the argument key-value pairs. + */ + public Map<String, ModularInputKindArgument> getArguments() { + Map<String, ModularInputKindArgument> arguments = new HashMap<String, ModularInputKindArgument>(); + for (String argumentName : args.keySet()) { + arguments.put(argumentName, getArgument(argumentName)); + } + return arguments; + } + + /** + * Returns the streaming mode of this modular input kind. + * + * @return The streaming mode ("xml" or "simple"). + */ + public String getStreamingMode() { + String mode = getString("streaming_mode"); + return mode; + } + + /** + * Returns a map-like object representing a particular argument of this + * modular input kind. + * + * @param argumentName The name of the argument to retrieve. + * @return A {@code ModularInputKindArgument} object representing the given + * argument, or {@code null} if the argument does not exist. + */ + public ModularInputKindArgument getArgument(String argumentName) { + if (this.args.get(argumentName) != null) { + return new ModularInputKindArgument(this.args.get(argumentName)); + } else { + return null; + } + } + + /** + * Returns the description of this modular input kind. + * + * @return A string containing the description. + */ + public String getDescription() { + return getString("description", null); + } + + /** + * Returns the title of this modular input kind, which is also displayed in + * Splunk Web (rather than the name used in the REST API). + * + * @return A string containing the title. + */ + public String getTitle() { + return getString("title", null); + } + + /** + * Indicates whether this modular input kind has a given argument. + * + * @param argumentName The argument to look up. + * @return {@code true} if the argument exists, {@code false} if not. + */ + public boolean hasArgument(String argumentName) { + return this.args.containsKey(argumentName); + } +} diff --git a/splunk/src/main/java/com/splunk/ModularInputKindArgument.java b/splunk/src/main/java/com/splunk/ModularInputKindArgument.java new file mode 100644 index 00000000..6f42de3d --- /dev/null +++ b/splunk/src/main/java/com/splunk/ModularInputKindArgument.java @@ -0,0 +1,88 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.HashMap; +import java.util.Map; + +/** + * The {@code ModularInputKindArgument} class is a map-like object that is + * specialized to represent arguments for modular input kinds. + */ +public class ModularInputKindArgument extends HashMap<String,String> { + public enum Type { NUMBER, STRING, BOOLEAN }; + + /** + * Class constructor. + * + * @param template A {@code Map<String,String>} that is copied into + * the new object. + */ + ModularInputKindArgument(Map<String,String> template) { + super(); + putAll(template); + } + + /** + * Returns the description of this field. + * + * @return The description. + */ + public String getDescription() { + return get("description"); + } + + /** + * Indicates whether this argument is required when creating a modular input + * of this kind. + * + * @return {@code true} if this argument is required for creating an input, + * {@code false} if not. + */ + public boolean getRequiredOnCreate() { + return Value.toBoolean(get("required_on_create")); + } + + /** + * Indicates whether this argument is required when editing a modular input + * of this kind. + * + * @return {@code true} if this argument is required for editing, + * {@code false} if not. + */ + public boolean getRequiredOnEdit() { + return Value.toBoolean(get("required_on_edit")); + } + + /** + * Returns the type of this argument to the modular input. + * + * @return A member of the {@code ModularInputKindArgumentType} enumeration + * ({@code Number}, {@code Boolean}, or {@code String}). + */ + public Type getType() { + String type = get("data_type"); + if (type.equals("number")) { + return Type.NUMBER; + } else if (type.equals("boolean")) { + return Type.BOOLEAN; + } else if (type.equals("string")) { + return Type.STRING; + } else { + throw new IllegalStateException("Invalid data_type value: " + type); + } + } +} diff --git a/splunk/src/main/java/com/splunk/MonitorInput.java b/splunk/src/main/java/com/splunk/MonitorInput.java new file mode 100644 index 00000000..3027b6c6 --- /dev/null +++ b/splunk/src/main/java/com/splunk/MonitorInput.java @@ -0,0 +1,356 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; +/** + * The {@code MonitorInput} class represents a monitor input, which is a file, + * directory, script, or network port that is monitored for new data. + */ +public class MonitorInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The monitor input endpoint. + */ + MonitorInput(Service service, String path) { + super(service, path); + } + + /** + * Returns a regular expression for a file path that when matched is not + * indexed. + * + * @return The regex for a file path. + */ + public String getBlacklist() { + return getString("blacklist", null); + } + + /** + * Returns a string that is used to force Splunk to index files that have a + * matching cyclic redundancy check (CRC). + * + * When set, this string is added to the CRC. If the string is + * "{@code <SOURCE>}", the full source path is added to the CRC, ensuring + * that each file being monitored has a unique CRC. For more info, see the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf" + * target="_blank">Edit inputs.conf</a> + * topic in the Getting Data In manual. + * + * @return The string that is added to the CRC, or {@code null} if not set. + */ + public String getCrcSalt() { + return getString("crcSalt", null); + } + + /** + * Returns the file count of this monitor input. + * + * @return The file count. + */ + public int getFileCount() { + return getInteger("filecount", -1); + } + + /** + * Indicates whether files that are seen for the first time will be read + * from the end. + * + * @return {@code true} if new files are read from the end, {@code false} if + * not. + */ + public boolean getFollowTail() { + return getBoolean("followTail", false); + } + + /** + * Returns the host for this monitor input. + * + * @return The host, or {@code null} if not specified. + */ + public String getHost() { + return getString("host", null); + } + + /** + * Returns the regular expression for a file path to determine the host. + * If the path for a file matches this regular expression, the captured + * value is used to populate the <b>host</b> field for events from this + * monitor input. The regular expression must have one capture group. + * + * @return The regular expression for a file path. + */ + public String getHostRegex() { + return getString("host_regex", null); + } + + /** + * Returns a time value that defines a rolling time window for monitoring + * files. If the modification time of a file being monitored falls outside + * of this rolling time window, the file is no longer being monitored. + * + * @return The time value. + */ + public String getIgnoreOlderThan() { + return getString("ignoreOlderThan", null); + } + + /** + * Gets the index where events from this monitor input are stored. + * + * @return The index name. + */ + public String getIndex() { + return getString("index"); + } + + /** + * Returns the type of monitor input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.Monitor; + } + + /** + * Returns the queue for this monitor input. Valid values are "parsingQueue" + * and "indexQueue". + * + * @return The queue, or {@code null} if not specified. + */ + public String getQueue() { + return getString("queue", null); + } + + /** + * Indicates whether sub-directories are monitored within this monitor + * input. + * + * @return {@code true} if sub-directories are monitored, {@code false} if + * not. + */ + public boolean getRecursive() { + return getBoolean("recursive", false); + } + + /** + * @deprecated Returns the value of the {@code _rcvbuf} attribute for this + * monitor input. + * + * @return The {@code _rcvbuf} value. + */ + public int getRcvBuf() { + return getInteger("_rcvbuf"); + } + + /** + * Returns the source of events from this monitor input. + * + * @return The source name. + */ + public String getSource() { + return getString("source", null); + } + + /** + * Returns the source type of events from this monitor input. + * + * @return The source type. + */ + public String getSourceType() { + return getString("sourcetype", null); + } + + /** + * Returns the time period for keeping a file open. + * + * @return The time to keep a file open, in seconds. + */ + public int getTimeBeforeClose() { + return getInteger("time_before_close", -1); + } + + /** + * Returns a regular expression for a file path that, when matched, is + * indexed. + * + * @return The regular expression for a file path. + */ + public String getWhitelist() { + return getString("whitelist", null); + } + + /** + * Sets a regular expression for a file path that, when matched, is not + * indexed. + * + * @param blacklist The regular expression for a file path. + */ + public void setBlacklist(String blacklist) { + setCacheValue("blacklist", blacklist); + } + + /** + * Sets whether the {@code index} value is checked to ensure that it is the + * name of a valid index. + * + * @param index {@code true} to verify {@code index}, {@code false} if not. + */ + public void setCheckIndex(boolean index) { + setCacheValue("check-index", index); + } + + /** + * Sets whether the {@code name} value is checked to ensure that it exists. + * + * @param path {@code true} to verify {@code name}, {@code false} if not. + */ + public void setCheckPath(boolean path) { + setCacheValue("check-path", path); + } + + /** + * Sets a string that is used to force Splunk to index files that have a + * matching cyclic redundancy check (CRC). + * + * When set, this string is added to the CRC. If the string is + * "{@code <SOURCE>}", the full source path is added to the CRC, ensuring + * that each file being monitored has a unique CRC. For more info, see the + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf" + * target="_blank">Edit inputs.conf</a> + * topic in the Getting Data In manual. + * + * @param salt The string that is added to the CRC. + */ + public void setCrcSalt(String salt) { + setCacheValue("crc-salt", salt); + } + + /** + * Sets whether files that are seen for the first time will be read from + * the end. + * + * @param followTail {@code true} to read new files from the end, + * {@code false} if not. + */ + public void setFollowTail(boolean followTail) { + setCacheValue("followTail", followTail); + } + + /** + * Sets the value to populate in the <b>host</b> field for events from this + * monitor input. + * + * @param host The value for the <b>host</b> field. + */ + public void setHost(String host) { + setCacheValue("host", host); + } + + /** + * Set the regular expression for a file path to determine the host. + * If the path for a file matches this regular expression, the captured + * value is used to populate the <b>host</b> field for events from this + * monitor input. The regular expression must have one capture group. + * + * @param regex The regular expression for a file path. + */ + public void setHostRegex(String regex) { + setCacheValue("host_regex", regex); + } + + /** + * Sets the specified slash-separate segment of the file path as the + * <b>host</b> field value. + * + * @param segment The slash-separate segment. + */ + public void setHostSegment(String segment) { + setCacheValue("host_segment", segment); + } + + /** + * Sets a time value that defines a rolling time window for monitoring + * files. If the modification time of a file being monitored falls outside + * of this rolling time window, the file is no longer being monitored. + * + * @param time The time value. + */ + public void setIgnoreOlderThan(String time) { + setCacheValue("ignore-older-than", time); + } + + /** + * Sets the index where events from this monitor input are stored. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets whether to monitor sub-directories within this monitor input. + * + * @param recursive {@code true} to monitor sub-directories, {@code false} + * if not. + */ + public void setRecursive(boolean recursive) { + setCacheValue("recursive", recursive); + } + + /** + * Sets the name to populate in the <b>source</b> field for events + * from this monitor input. The same source name should not be used for + * multiple data inputs. + * + * @param name The source name. + */ + public void setRenameSource(String name) { + setCacheValue("rename-source", name); + } + + /** + * Sets the source type to populate in the <b>sourcetype</b> field for + * events from this monitor input. + * + * @param sourcetype The source type. + */ + public void setSourcetype(String sourcetype) { + setCacheValue("sourcetype", sourcetype); + } + + /** + * Sets the time period for keeping a file open. + * + * @param period The time to keep a file open, in seconds. + */ + public void setTimeBeforeClose(int period) { + setCacheValue("time-before-close", period); + } + + /** + * Sets a regular expression for a file path that, when matched, is indexed. + * + * @param whitelist The regular expression for the file path. + */ + public void setWhitelist(String whitelist) { + setCacheValue("whitelist", whitelist); + } +} diff --git a/splunk/src/main/java/com/splunk/MultiResultsReader.java b/splunk/src/main/java/com/splunk/MultiResultsReader.java new file mode 100644 index 00000000..cc57b97f --- /dev/null +++ b/splunk/src/main/java/com/splunk/MultiResultsReader.java @@ -0,0 +1,63 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.util.Iterator; + +/** + * The {@code MultiResultsReader} class represents a streaming reader + * for Splunk search results. Using {@code <T extends ResultsReader>} allows + * specialization of {@code T} in subclasses of {@code MultiResultsReader}, such + * as {@link MultiResultsReaderXml} and {@link MultiResultsReaderJson}. + */ +public class MultiResultsReader<T extends ResultsReader> + extends StreamIterableBase<SearchResults> { + private T resultsReader; + + MultiResultsReader(T resultsReader) throws IOException { + this.resultsReader = resultsReader; + } + + /** + * Returns an iterator over the sets of results from this reader. + * @return An iterator. + */ + @Override + public final Iterator<SearchResults> iterator() { + return super.iterator(); + } + + /** + * Closes the reader and releases resources. + * @throws IOException If reader is not closed. + */ + public final void close() throws IOException { + resultsReader.close(); + } + + protected final T getNextElement() { + try { + if (!resultsReader.resetIteratorToNextSet()) { + return null; + } + return resultsReader; + } catch (IOException e) { + throw new RuntimeException(e); + } + } +} \ No newline at end of file diff --git a/splunk/src/main/java/com/splunk/MultiResultsReaderJson.java b/splunk/src/main/java/com/splunk/MultiResultsReaderJson.java new file mode 100644 index 00000000..77a2c9f6 --- /dev/null +++ b/splunk/src/main/java/com/splunk/MultiResultsReaderJson.java @@ -0,0 +1,42 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.InputStream; + +/** + * The {@code MultiResultsReaderJson} class represents a streaming JSON reader + * for Splunk search results. This reader supports streams from export searches, + * which might return one of more previews before returning final results. + */ +public class MultiResultsReaderJson + extends MultiResultsReader<ResultsReaderJson> { + /** + * Class constructor. + * + * Constructs a streaming JSON reader for the event stream. You should only + * attempt to parse a JSON stream with this reader. Unpredictable results + * may occur if you try to parse a stream with a different format. + * + * @param inputStream The JSON stream to parse. + * @throws IOException The IOException instance + */ + public MultiResultsReaderJson(InputStream inputStream) throws IOException { + super(new ResultsReaderJson(inputStream, true)); + } +} \ No newline at end of file diff --git a/splunk/src/main/java/com/splunk/MultiResultsReaderXml.java b/splunk/src/main/java/com/splunk/MultiResultsReaderXml.java new file mode 100644 index 00000000..53088389 --- /dev/null +++ b/splunk/src/main/java/com/splunk/MultiResultsReaderXml.java @@ -0,0 +1,42 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.InputStream; + +/** + * The {@code MultiResultsReaderXml} class represents a streaming XML reader for + * Splunk search results. This reader supports streams from export searches, + * which might return one of more previews before returning final results. + */ +public class MultiResultsReaderXml + extends MultiResultsReader<ResultsReaderXml> { + /** + * Class constructor. + * + * Constructs a streaming XML reader for the event stream. You should only + * attempt to parse an XML stream with this reader. Unpredictable results + * may occur if you try to parse a stream with a different format. + * + * @param inputStream The XML stream to parse. + * @throws IOException The IOException instance + */ + public MultiResultsReaderXml(InputStream inputStream) throws IOException { + super(new ResultsReaderXml(inputStream, true)); + } +} diff --git a/splunk/src/main/java/com/splunk/NumberComparison.java b/splunk/src/main/java/com/splunk/NumberComparison.java new file mode 100644 index 00000000..c58b48db --- /dev/null +++ b/splunk/src/main/java/com/splunk/NumberComparison.java @@ -0,0 +1,46 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * Comparison operators on numeric fields. + */ +public enum NumberComparison { + EQUALS { + public String toString() { return "="; } + }, + NOT_EQUALS { + public String toString() { return "!="; } + }, + LESS_THAN { + public String toString() { return "<"; } + }, + AT_MOST { + public String toString() { return "<="; } + }, + GREATHER_THAN { + public String toString() { return ">"; } + }, + AT_LEAST { + public String toString() { return ">="; } + }, + IS_NULL { + public String toString() { return "isNull"; } + }, + IS_NOT_NULL { + public String toString() { return "isNotNull"; } + } +} diff --git a/splunk/src/main/java/com/splunk/NumberPivotFilter.java b/splunk/src/main/java/com/splunk/NumberPivotFilter.java new file mode 100644 index 00000000..6b0a42f3 --- /dev/null +++ b/splunk/src/main/java/com/splunk/NumberPivotFilter.java @@ -0,0 +1,54 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Specifies a filter in a pivot on a numeric field. + */ +public class NumberPivotFilter extends PivotFilter { + private final NumberComparison comparison; + private final double comparisonValue; + + NumberPivotFilter(DataModelObject dataModelObject, String field, + NumberComparison comparison, double comparisonValue) { + super(dataModelObject, field); + if (dataModelObject.getField(field).getType() != FieldType.NUMBER) { + throw new IllegalArgumentException("Field " + field + " on the data model object was of type " + + dataModelObject.getField(field).getType().toString() + ", expected number."); + } + this.comparison = comparison; + this.comparisonValue = comparisonValue; + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + JsonObject filterRule = new JsonObject(); + filterRule.add("comparator", new JsonPrimitive(this.comparison.toString())); + filterRule.add("compareTo", new JsonPrimitive(this.comparisonValue)); + + root.add("rule", filterRule); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/NumberPivotRowSplit.java b/splunk/src/main/java/com/splunk/NumberPivotRowSplit.java new file mode 100644 index 00000000..69118602 --- /dev/null +++ b/splunk/src/main/java/com/splunk/NumberPivotRowSplit.java @@ -0,0 +1,41 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Specifies a row split in a pivot on a numeric field. + * + * Each value of the field will be split into a different row. + */ +public class NumberPivotRowSplit extends PivotRowSplit { + NumberPivotRowSplit(DataModelObject owner, String field, String label) { + super(owner, field, label); + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + root.add("display", new JsonPrimitive("all")); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/NumericPivotColumnSplit.java b/splunk/src/main/java/com/splunk/NumericPivotColumnSplit.java new file mode 100644 index 00000000..61aade19 --- /dev/null +++ b/splunk/src/main/java/com/splunk/NumericPivotColumnSplit.java @@ -0,0 +1,35 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +public class NumericPivotColumnSplit extends PivotColumnSplit { + NumericPivotColumnSplit(DataModelObject dataModelObject, String field) { + super(dataModelObject, field); + } + + @Override + JsonObject toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + root.add("display", new JsonPrimitive("all")); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/OutputDefault.java b/splunk/src/main/java/com/splunk/OutputDefault.java new file mode 100644 index 00000000..abd9733f --- /dev/null +++ b/splunk/src/main/java/com/splunk/OutputDefault.java @@ -0,0 +1,319 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code OutputDefault} class represents the default TCP output + * configuration, providing access to global TCP output properties. + */ +public class OutputDefault extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + OutputDefault(Service service) { + super(service, "data/outputs/tcp/default"); + } + + /** + * Indicates whether this forwarder performs automatic load balancing. + * When {@code true}, this forwarder selects a new indexer using the + * frequency specified by {@code autoLBFrequency}, or immediately when an + * open connection to an indexer is lost. + * + * @see #getAutoLBFrequency + * + * @return {@code true} if this forwarder performs automatic load balancing, + * {@code false} if not. + */ + public boolean getAutoLB() { + return getBoolean("autoLB", false); + } + + /** + * Indicates whether this forwarder blocks when the output queue is full. + * Blocking causes further blocking up the processing chain--if any target + * group's queue is blocked, no more data reaches any other target group. + * When {@code false}, events are dropped when indexers in the group + * can't be reached. + * + * @return {@code true} if this forwarder will block, {@code false} if not. + */ + public boolean blockOnQueueFull() { + return getBoolean("blockOnQueueFull", true); + } + + /** + * Returns the frequency of automatic load balancing. + * + * @return The automatic load-balancing frequency in seconds, or -1 if not + * specified. + */ + public int getAutoLBFrequency() { + return getInteger("autoLBFrequency", -1); + } + + /** + * Returns the amount of time this forwarder waits before dropping + * events if the output queue is full. A setting of 0 or -1 causes this + * forwarder to block. + * + * @return The wait time, in seconds. + */ + public int getDropEventsOnQueueFull() { + return getInteger("dropEventsOnQueueFull", -1); + } + + /** + * Returns the inclusive set of indexes (whitelist 0) for this forwarder. + * This is an ordered list of whitelists and blacklists, which together + * decide if events should be forwarded to an index. + * + * @return The inclusive set of indexes. + */ + public String getForwardedIndex0Whitelist() { + return getString("forwardedindex.0.whitelist"); + } + + /** + * Returns the exclusive set of indexes (blacklist 1) for this forwarder. + * This is an ordered list of whitelists and blacklists, which together + * decide if events should be forwarded to an index. + * + * @return The exclusive set of indexes. + */ + public String getForwardedIndex1Blacklist() { + return getString("forwardedindex.1.blacklist"); + } + + /** + * Returns the inclusive set of indexes (whitelist 2) for this forwarder. + * This is an ordered list of whitelists and blacklists, which together + * decide if events should be forwarded to an index. + * + * @return The inclusive set of indexes. + */ + public String getForwardedIndex2Whitelist() { + return getString("forwardedindex.2.whitelist"); + } + + /** + * Returns the frequency that specifies how often to send a heartbeat packet + * to the receiving server. + * <p> + * <b>Note:</b> This field is only used when {@code SendCookedData} is + * {@code true}. + * + * @see #getSendCookedData + * @see #setSendCookedData + * @return The heartbeat frequency, in seconds. + */ + public int getHeartbeatFrequency() { + return getInteger("heartbeatFrequency", 30); + } + + /** + * Returns the maximum size of the output queue for this forwarder. + * The maximum size of the wait queue is set to three times this value. + * + * @return The maximum size of the output queue. The string maybe "auto" or a number followed by one of the suffixes + * "B", "KB", "MB", or "GB" (for bytes, kilobytes, megabytes, and gigabytes, respectively). + */ + public String getMaxQueueSize() { + return getString("maxQueueSize"); + } + + /** + * Indicates whether Splunk has processed ("cooked") the event data. + * + * @return {@code true} if the event data has been processed, {@code false} + * if not. + */ + public boolean getSendCookedData() { + return getBoolean("sendCookedData", true); + } + + /** + * Indicates whether to index data locally in addition to forwarding it. + * <p> + * <b>Note:</b> This setting is not available for light forwarders. + * + * @return {@code true} if data is indexed locally and forwarded, + * {@code false} if not. + */ + public boolean indexAndForward() { + return getBoolean("indexAndForward", false); + } + + /** + * Indicates whether this forwarder sends compressed data. + * + * @return {@code true} if this forwarder sends compressed data, + * {@code false} if not. + */ + public boolean isCompressed() { + return getBoolean("compressed", false); + } + + @Override + protected boolean isNameChangeAllowed() { + // The "name" property is actually required by the underlying POST + // request that update() uses + return true; + } + + /** + * Indicates whether the index filter for this forwarder is disabled. + * + * @return {@code true} if the index filter is disabled, {@code false} + * if events are raw and untouched before sending. + */ + public boolean isForwardedIndexFilterDisable() { + return getBoolean("forwardedindex.filter.disable"); + } + + /** + * Sets how long to wait before throwing out all new events until the output + * queue has space. The default value is -1, which means to not drop events. + * <blockquote> + * <b>Caution:</b> Do not set this value to a positive integer if you are + * monitoring files. + * </blockquote><p> + * Setting this to -1 or 0 causes the output queue to block when it gets + * full, which causes further blocking up the processing chain. If any + * target group's queue is blocked, no more data reaches any other target + * group.</p> + * <p> + * Using auto load-balancing is the best way to minimize this condition, + * because, in that case, multiple receivers must be down or jammed before + * queue blocking can occur.</p> + * @see #getAutoLB + * + * @param dropEventsOnQueueFull The time to wait before throwing out events, + * in seconds, or -1 to not drop events. + */ + public void setDropEventsOnQueueFull(int dropEventsOnQueueFull) { + setCacheValue("dropEventsOnQueueFull", dropEventsOnQueueFull); + } + + /** + * Sets the frequency between heartbeat packets that are sent to the + * receiving server. + * <p> + * <b>Note:</b> Heartbeats are only sent when {@code SendCookedData} is + * {@code true}. + * @see #getSendCookedData + * @see #setSendCookedData + * + * @param frequency The frequency, in seconds. + */ + public void setHeartbeatFrequency(int frequency) { + setCacheValue("heartbeatFrequency", frequency); + } + + /** + * Sets whether to index all data locally, in addition to forwarding it. + * + * This configuration is known as "index-and-forward". This attribute is + * only available for heavy forwarders, at the top-level {@code [tcpout]} + * stanza in outputs.conf. It cannot be overridden in a target group. + * + * @param indexAndForward {@code true} to index and forward data, + * {@code false} to forward only. + */ + public void setIndexAndForward(boolean indexAndForward) { + setCacheValue("indexAndForward", indexAndForward); + } + + /** + * Sets the maximum size of the forwarder's output queue. This value also + * sets the maximum size of the wait queue to three times this + * value, if you have enabled indexer acknowledgment (the {@code useACK} + * attribute is set to {@code true} in the forwarder's outputs.conf). + * <p> + * Although the wait queue and the output queues are both configured by + * this attribute, they are separate queues. The setting determines the + * maximum size of the queue's in-memory (RAM) buffer. + * <p> + * For heavy forwarders that send parsed data, {@code maxQueueSize} is the + * maximum number of events. Because events are typically much shorter than + * data blocks, the memory consumed by the queue on a parsing forwarder will + * likely be much smaller than on a non-parsing forwarder, if you use this + * version of the setting. + * <p> + * If you specify an integer (for example, "100"), {@code maxQueueSize} + * indicates the maximum number of queued events (for parsed data) or blocks + * of data (for unparsed data). A block of data is approximately 64KB. For + * non-parsing forwarders that send unparsed data, such as universal + * forwarders, {@code maxQueueSize} is the maximum number of data blocks. + * <p> + * If specified as an integer followed by "KB", MB", or "GB" (for example, + * "100MB"), {@code maxQueueSize} indicates the maximum RAM allocated + * to the queue buffer. The default is 500KB (which means a maximum size of + * 500KB for the output queue and 1500KB for the wait queue, if any). + * + * @param maxQueueSize The maximum queue size as a number, or a number + * followed by "KB", MB", or "GB". + */ + public void setMaxQueueSize(String maxQueueSize) { + setCacheValue("maxQueueSize", maxQueueSize); + } + + /** + * Sets the name. Only "tcpout" is valid. + */ + public void setName() { + setCacheValue("name", "tcpout"); + } + + /** + * Sets whether to forward cooked data. + * + * @param sendCookedData {@code true} for Splunk to process events before + * sending them, {@code false} to send raw and untouched events. + */ + public void setSendCookedData(boolean sendCookedData) { + setCacheValue("sendCookedData", sendCookedData); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("name")) { + args = Args.create(args).add("name", "tcpout"); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("name")) { + setCacheValue("name", "tcpout"); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/OutputGroup.java b/splunk/src/main/java/com/splunk/OutputGroup.java new file mode 100644 index 00000000..66f8653c --- /dev/null +++ b/splunk/src/main/java/com/splunk/OutputGroup.java @@ -0,0 +1,226 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code OutputGroup} class represents an output group, providing + * access to the configuration of a group of one or more data-forwarding + * destinations. + */ +public class OutputGroup extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The output group endpoint. + */ + OutputGroup(Service service, String path) { + super(service, path); + } + + /** + * Indicates whether this forwarder performs automatic load balancing. + * + * @return {@code true} if the forwarder performs automatic load balancing, + * {@code false} if not. + */ + public boolean getAutoLB() { + return getBoolean("autoLB", false); + } + + /** + * Returns the type of output processor for this forwarder group. + * Valid values are: "tcpout", "syslog", and "httpout". + * + * @return The output processor type, or {@code null} if not specified. + */ + public String getMethod() { + return getString("method", null); + } + + /** + * Returns the list of servers for this forwarder group. + * + * @return The server list. + */ + public String[] getServers() { + return getString("servers").split(","); + } + + /** + * Sets the list of servers included in this group. + * + * @param servers A comma-separated list of servers. + */ + public void setServers(String servers) { + setCacheValue("servers", servers); + } + + /** + * Sets whether this forwarder performs automatic load balancing. + * + * If set to {@code true}, the forwarder performs automatic load balancing. + * In automatic mode, the forwarder selects a new indexer every + * {@code autoLBFrequency} seconds. If the connection to the current + * indexer is lost, the forwarder selects a new live indexer to forward + * data to. + * + * Do not change the default setting, unless you have some overriding need + * to use round-robin load balancing. Round-robin load balancing + * ({@code autoLB} is {@code false}) was previously the default + * load-balancing method. Starting with release 4.2, however, round-robin + * load balancing has been deprecated, and the default has been changed to + * automatic load balancing ({@code autoLB} is {@code true}). + * @see #getAutoLB + * @see OutputDefault#getAutoLBFrequency + * + * @param autoLB {@code true} to perform automatic load balancing on this + * forwarder, {@code false} if not. + */ + public void setAutoLB(boolean autoLB) { + setCacheValue("autoLB", autoLB); + } + + /** + * Sets whether this forwarder sends compressed data. The receiver port must + * also have compression enabled for this to work. + * + * @param compressed {@code true} for this forwarder to send compressed + * data, {@code false} if not. + */ + public void setCompressed(boolean compressed) { + setCacheValue("compressed", compressed); + } + + /** + * Sets how long to wait before throwing out all new events until the output + * queue has space. The default value is -1, which means to not drop events. + * <blockquote> + * <b>Caution:</b> Do not set this value to a positive integer if you are + * monitoring files. + * </blockquote><p> + * Setting this to -1 or 0 causes the output queue to block when it gets + * full, which causes further blocking up the processing chain. If any + * target group's queue is blocked, no more data reaches any other target + * group.</p> + * <p> + * Using auto load-balancing is the best way to minimize this condition, + * because, in that case, multiple receivers must be down or jammed before + * queue blocking can occur.</p> + * @see #getAutoLB + * + * @param dropEventsOnQueueFull The time to wait before throwing out events, + * in seconds, or -1 to not drop events. + */ + public void setDropEventsOnQueueFull(int dropEventsOnQueueFull) { + setCacheValue("dropEventsOnQueueFull", dropEventsOnQueueFull); + } + + /** + * Sets the frequency between heartbeat packets that are sent to the + * receiving server. + * <p> + * <b>Note:</b> Heartbeats are only sent when {@code SendCookedData} is + * {@code true}. + * @see OutputDefault#getSendCookedData + * + * @param frequency The frequency, in seconds. + */ + public void setHeartbeatFrequency(int frequency) { + setCacheValue("heartbeatFrequency", frequency); + } + + /** + * Sets the maximum size of the forwarder's output queue. This value also + * sets the maximum size of the wait queue to three times this + * value, if you have enabled indexer acknowledgment (the {@code useACK} + * attribute is set to {@code true} in the forwarder's outputs.conf). + * <p> + * Although the wait queue and the output queues are both configured by + * this attribute, they are separate queues. The setting determines the + * maximum size of the queue's in-memory (RAM) buffer. + * <p> + * For heavy forwarders that send parsed data, {@code maxQueueSize} is the + * maximum number of events. Because events are typically much shorter than + * data blocks, the memory consumed by the queue on a parsing forwarder will + * likely be much smaller than on a non-parsing forwarder, if you use this + * version of the setting. + * <p> + * If you specify an integer (for example, "100"), {@code maxQueueSize} + * indicates the maximum number of queued events (for parsed data) or blocks + * of data (for unparsed data). A block of data is approximately 64KB. For + * non-parsing forwarders that send unparsed data, such as universal + * forwarders, {@code maxQueueSize} is the maximum number of data blocks. + * <p> + * If specified as an integer followed by "KB", MB", or "GB" (for example, + * "100MB"), {@code maxQueueSize} indicates the maximum RAM allocated + * to the queue buffer. The default is 500KB (which means a maximum size of + * 500KB for the output queue and 1500KB for the wait queue, if any). + * + * @param maxQueueSize The maximum queue size as a number, or a number + * followed by "KB", MB", or "GB". + */ + public void setMaxQueueSize(String maxQueueSize) { + setCacheValue("maxQueueSize", maxQueueSize); + } + + /** + * Sets the type of output processor. Valid values are "tcpout" and + * "syslog". + * + * @param method The output processor type. + */ + public void setMethod(String method) { + setCacheValue("method", method); + } + + /** + * Sets whether to forward cooked data. + * + * @param sendCookedData {@code true} for Splunk to process events before + * sending them, {@code false} to send raw and untouched events. + */ + public void setSendCookedData(boolean sendCookedData) { + setCacheValue("sendCookedData", sendCookedData); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("servers")) { + args = Args.create(args).add("servers", getString("servers")); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("servers")) { + setCacheValue("servers", getString("servers")); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/OutputServer.java b/splunk/src/main/java/com/splunk/OutputServer.java new file mode 100644 index 00000000..cafec3f6 --- /dev/null +++ b/splunk/src/main/java/com/splunk/OutputServer.java @@ -0,0 +1,203 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code OutputServer} class represents an output server, providing access + * to data-forwarding configurations. + */ +public class OutputServer extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The output server endpoint. + */ + OutputServer(Service service, String path) { + super(service, path); + } + + /** + * Returns the DNS name of the destination server for this connection. + * + * @return The destination host name. + */ + public String getDestHost() { + return getString("destHost", null); + } + + /** + * Returns the IP address of the destination server for this connection. + * + * @return The IP address of the destination server. + */ + public String getDestIp() { + return getString("destIp", null); + } + + /** + * Return the port on which the destination server is listening. + * + * @return The destination port. + */ + public int getDestPort() { + return getInteger("destPort", 0); + } + + /** + * Returns the data distribution method used when two or more servers exist + * in the same forwarder group. Valid values are: "clone", "balance", and + * "autobalance". + * + * @return The data distribution method. + */ + public String getMethod() { + return getString("method"); + } + + /** + * Returns the port on the destination server where data is forwarded. + * + * @return The source port. + */ + public int getSourcePort() { + return getInteger("sourcePort", 0); + } + + /** + * Returns the server connection status (usually "connect_done", + * "connect_fail", or "connect_try"). + * + * @return The connection status. + */ + public String getStatus() { + return getString("status", null); + } + + /** + * Returns client certificate path. + * + * @return Path of client certificate. + */ + public String getClientCert() { + return getString("clientCert", ""); + } + + /** + * Sets the type of data distribution method when two or more servers + * exist in the same forwarder group. Valid values are: "clone", "balance", + * and "autobalance". + * + * @param method The data distribution method. + */ + public void setMethod(String method) { + setCacheValue("method", method); + } + + /** + * Sets the alternate name to match in the remote server's SSL certificate. + * + * @param sslAltNameToCheck The alternate name. + */ + public void setSslAltNameToCheck(String sslAltNameToCheck) { + setCacheValue("sslAltNameToCheck", sslAltNameToCheck); + } + + /** + * Sets the path to the client certificate. If a path is specified, the + * connection uses SSL. + * + * @param sslCertPath The path to the client certificate. + */ + public void setSslCertPath(String sslCertPath) { + setCacheValue("sslCertPath", sslCertPath); + } + + /** + * Sets the SSL cipher in the form: + * {@code ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM} + * + * @param sslCipher The SSL cipher. + */ + public void setSslCipher(String sslCipher) { + setCacheValue("sslCipher", sslCipher); + } + + /** + * Sets the name against which to check the common name of the server's + * certificate. If there is no match, you can assume that Splunk is not + * authenticated against this server. You must set a value for this + * parameter if {@code SslVerifyServerCert} is {@code true}. + * @see #setSslVerifyServerCert + * + * @param sslCommonNameToCheck The SSL common name. + */ + public void setSslCommonNameToCheck(String sslCommonNameToCheck) { + setCacheValue("sslCommonNameToCheck", sslCommonNameToCheck); + } + + /** + * Sets the password associated with the PEM file store. + * + * @param sslPassword The password. + */ + public void setSslPassword(String sslPassword) { + setCacheValue("sslPassword", sslPassword); + } + + /** + * Sets the path to the root certificate authority file. + * + * @param sslRootCAPath The path to the root certificate authority file. + */ + public void setSslRootCAPath(String sslRootCAPath) { + setCacheValue("sslRootCAPath", sslRootCAPath); + } + + /** + * Sets whether the server being connected to is authenticated. + * Both the common name and the alternate name of the server are checked + * for a match. + * + * @param sslVerifyServerCert {@code true} to determine whether the server + * is authenticated, {@code false} if not. + */ + public void setSslVerifyServerCert(boolean sslVerifyServerCert) { + setCacheValue("sslVerifyServerCert", sslVerifyServerCert); + } + + /** + * Sets the client certificate path which is being supported in recent versions. + * + * @param clientCert The path for client certificate. + */ + public void setClientCert(String clientCert) { + setCacheValue("clientCert", clientCert); + } + + /** + * Returns an object that contains all current connections to the output + * server. + * + * @return The {@code OutputServerAllConnections} object. + */ + public OutputServerAllConnections allConnections() { + return new OutputServerAllConnections( + service, path + "/allconnections"); + } +} diff --git a/splunk/com/splunk/OutputServerAllConnections.java b/splunk/src/main/java/com/splunk/OutputServerAllConnections.java similarity index 64% rename from splunk/com/splunk/OutputServerAllConnections.java rename to splunk/src/main/java/com/splunk/OutputServerAllConnections.java index d61806b5..6d1a6aca 100644 --- a/splunk/com/splunk/OutputServerAllConnections.java +++ b/splunk/src/main/java/com/splunk/OutputServerAllConnections.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,15 @@ package com.splunk; /** - * Representation of an output server's connections. + * The {@code OutputServerAllConnections} class represents all the connections + * of an output server. */ public class OutputServerAllConnections extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The output server all-connections endpoint. */ OutputServerAllConnections(Service service, String path) { @@ -32,45 +33,45 @@ public class OutputServerAllConnections extends Entity { } /** - * Returns this connection's destination host name. + * Returns the DNS name of the destination server. * - * @return This connection's destination host name. + * @return The destination host name. */ public String getDestHost() { return getString("destHost"); } /** - * Returns this connection's destination host IP address. + * Returns the IP address of the destination server for this connection. * - * @return This connection's destination host IP address. + * @return The IP address of the destination server. */ public String getDestIp() { return getString("destIp"); } /** - * Return this connection's destination port. + * Return the port on which the destination server is listening. * - * @return This connection's destination port. + * @return The destination port. */ public int getDestPort() { return getInteger("destPort"); } /** - * Returns this connection's source port. + * Returns the port on the destination server where data is forwarded. * - * @return This connection's source port. + * @return The source port. */ public int getSourcePort() { return getInteger("sourcePort"); } /** - * Returns this connection's status. + * Returns the status of this connection. * - * @return This connection's status. + * @return The status. */ public String getStatus() { return getString("status"); diff --git a/splunk/src/main/java/com/splunk/OutputSyslog.java b/splunk/src/main/java/com/splunk/OutputSyslog.java new file mode 100644 index 00000000..81eef76c --- /dev/null +++ b/splunk/src/main/java/com/splunk/OutputSyslog.java @@ -0,0 +1,96 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code OutputSyslog} class represents a syslog output, providing access + * to properties of a forwarding server that provides data in standard syslog + * format. + */ +public class OutputSyslog extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The output syslog endpoint. + */ + OutputSyslog(Service service, String path) { + super(service, path); + } + + /** + * Returns the destination {@code host:port} of this server. + * + * @return The destination {@code host:port}. + */ + public String getServer() { + return getString("server"); + } + + /** + * Returns the connection type of this server. + * + * @return The connection type. + */ + public String getType() { + return getString("type"); + } + + /** + * Sets the syslog priority. For more information about the correct values + * and format, see + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf" + * target="_blank">outputs.conf</a> in the Admin Manual. + * + * @param priority The syslog priority. + */ + public void setPriority(int priority) { + setCacheValue("priority", priority); + } + + /** + * Sets the {@code host:port} where the syslog data is sent. + * + * @param server The destination {@code host:port}. + */ + public void setServer(String server) { + setCacheValue("server", server); + } + + /** + * Sets the timestamp format that precedes each event that is sent. For more + * information about this format, see + * <a href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf" + * target="_blank">outputs.conf</a> in the Admin Manual. + * + * @param timestampformat The timestamp format. + */ + public void setTimestampFormat(String timestampformat) { + setCacheValue("timestampformat", timestampformat); + } + + /** + * Sets the protocol to use to send syslog data. Valid values are "tcp" and + * "udp". + * + * @param type The protocol type. + */ + public void setType(String type) { + setCacheValue("type", type); + } +} diff --git a/splunk/com/splunk/Password.java b/splunk/src/main/java/com/splunk/Password.java similarity index 60% rename from splunk/com/splunk/Password.java rename to splunk/src/main/java/com/splunk/Password.java index 19465eb8..66510ede 100644 --- a/splunk/com/splunk/Password.java +++ b/splunk/src/main/java/com/splunk/Password.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,14 +17,14 @@ package com.splunk; /** - * Represenration of saved credential. + * The {@code Password} class represents a saved credential. */ public class Password extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. + * @param service The connected {@code Service} instance. * @param path The password endpoint. */ Password(Service service, String path) { @@ -32,56 +32,66 @@ public class Password extends Entity { } /** - * Returns this credential's clear-text password. + * Returns the clear-text password for this credential. * - * @return This credential's clear-text password. + * @return The clear-text password. */ public String getClearPassword() { return getString("clear_password"); } /** - * Returns this credential's encrypted password. + * Returns the encrypted password for this credential. * - * @return This credential's encrypted password. + * @return The encrypted password. */ public String getEncryptedPassword() { return getString("encr_password"); } /** - * Returns this credentials username. + * Returns the username for this credential. * - * @return This credentials username. + * @return The username. */ @Override public String getName() { return getUsername(); } /** - * Returns this credentials displayable password string. + * Returns the displayable password string for this credential. * - * @return This credentials displayable password string. + * @return The displayable password string, as asterisks. */ public String getPassword() { return getString("password"); } /** - * Returns this credentials realm. + * Returns the credential realm. * - * @return This credentials realm. + * @return The realm. */ public String getRealm() { return getString("realm", null); } /** - * Returns this credentials username. + * Returns the username for this credential. * - * @return This credentials username. + * @return The username. */ public String getUsername() { return getString("username"); } + + + /** + * Sets the password for this credential. + * + * @param password The password. + */ + public void setPassword(String password) { + setCacheValue("password", password); + } } diff --git a/splunk/src/main/java/com/splunk/PasswordCollection.java b/splunk/src/main/java/com/splunk/PasswordCollection.java new file mode 100644 index 00000000..47a50a22 --- /dev/null +++ b/splunk/src/main/java/com/splunk/PasswordCollection.java @@ -0,0 +1,152 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code PasswordCollection} class represents a collection of credentials. + */ +public class PasswordCollection extends EntityCollection<Password> { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + PasswordCollection(Service service) { + super(service, service.passwordEndPoint, Password.class); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + */ + PasswordCollection(Service service, Args args) { + super(service, service.passwordEndPoint, Password.class, args); + } + + /** + * Creates a credential with a username and password. + * + * @param name The username. + * @param password The password. + * + * @return The new credential. + */ + public Password create(String name, String password) { + if(checkForWildcards()){ + throw new IllegalArgumentException("While creating StoragePasswords, namespace cannot have wildcards."); + } + Args args = new Args("password", password); + return create(name, args); + } + + /** + * Creates a credential with a username, password, and realm. + * + * @param name The username. + * @param password The password. + * @param realm The credential realm. + * @return The new credential. + */ + public Password create(String name, String password, String realm) { + if(checkForWildcards()){ + throw new IllegalArgumentException("While creating StoragePasswords, namespace cannot have wildcards."); + } + Args args = new Args(); + args.put("password", password); + args.put("realm", realm); + return create(name, args); + } + + /** + * Get a credential with realm and name. + * + * @param realm The credential realm. + * @param name The username. + * @return The credential, or null if not found. + */ + public Password get(String realm, String name) { + return super.get(String.format("%s:%s:", realm, name)); + } + + @Override + public Password get(Object key) { + // Make it compatible with the old way (low-efficient) + if (key instanceof String && !((String) key).contains(":")) { + return getByUsername((String) key); + } + return super.get(key); + } + + /** + * Remove a credential with realm and name. + * + * @param realm The credential realm. + * @param name The username. + * @return The removed credential, or null if not found. + */ + public Password remove(String realm, String name) { + if(checkForWildcards()){ + throw new IllegalArgumentException("app context must be specified when removing a password."); + } + return super.remove(String.format("%s:%s:", realm, name)); + } + + @Override + public Password remove(String key) { + if(checkForWildcards()){ + throw new IllegalArgumentException("app context must be specified when removing a password."); + } + // Make it compatible with the old way (low-efficient) + if (!key.contains(":")) { + Password password = getByUsername((String) key); + validate(); + if (password == null) return null; + password.remove(); + // by invalidating any access to items will get refreshed + invalidate(); + return password; + } + return super.remove(key); + } + + @Override + public boolean containsKey(Object key) { + if (key instanceof String && !((String) key).contains(":")) { + return getByUsername((String) key) != null; + } + return super.containsKey(key); + } + + private Password getByUsername(String name) { + for (Password password : this.values()) { + if (password.getUsername().equals(name)) return password; + } + return null; + } + + private boolean checkForWildcards(){ + boolean isWildCard = false; + if(("-").equals(service.getOwner()) || ("-").equals(service.getApp())){ + isWildCard = true; + } + return isWildCard; + } +} diff --git a/splunk/src/main/java/com/splunk/Pivot.java b/splunk/src/main/java/com/splunk/Pivot.java new file mode 100644 index 00000000..d59943a8 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Pivot.java @@ -0,0 +1,103 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.io.InputStream; + +/** + * A call of pivot on a PivotSpecification object queries splunkd to get the queries corresponding to that + * pivot, which will be returned as an instance of the Pivot class. Pivot is a container for the various + * queries for different purposes returned by the server. + */ +public class Pivot { + private final String openInSearch; + private final String drilldownSearch; + private final String pivotSearch; + private final String tstatsSearch; + private final Service service; + private final String search; + + private Pivot(Service service, AtomEntry entry) { + this.service = service; + this.openInSearch = entry.content.getString("open_in_search"); + this.drilldownSearch = entry.content.getString("drilldown_search"); + this.pivotSearch = entry.content.getString("pivot_search"); + this.search = entry.content.getString("search"); + this.tstatsSearch = entry.content.getString("tstats_search", null); + } + + /** + * @return a SPL query using the pivot search command to implement this pivot. + */ + public String getPivotQuery() { return this.pivotSearch; } + + /** + * @return an SPL query that uses tstats and a tsidx namespace to implement an accelerated + * version of this pivot. If there is no acceleration available, it returns null. + */ + public String getAcceleratedQuery() { return this.tstatsSearch; } + + /** + * @return an SPL query implementing this pivot that is appropriate for use when implementing + * drilldown interfaces. + */ + public String getQueryForDrilldown() { return this.drilldownSearch; } + + /** + * @return a readable version of the SPL query implementing this pivot. + */ + public String getPrettyQuery() { return this.openInSearch; } + + /** + * @return an SPL query implementing this pivot with no reference to the pivot command. + */ + public String getRawQuery() { return this.search; } + + /** + * @return a Job object running this pivot, accelerated if possible. + */ + public Job run() { + return run(new JobArgs()); + } + + /** + * @param args options for creating a Job + * @return a Job object running this pivot, accelerated if possible. + */ + public Job run(JobArgs args) { + if (this.getAcceleratedQuery() == null) { + return service.search(this.getPivotQuery(), args); + } else { + return service.search(this.getAcceleratedQuery(), args); + } + } + + /** + * Parse a pivot from a response from splunkd. + * + * @param service The HTTP service this pivot operates on. + * @param content an InputStream returned by an HTTP response. + * @return a Pivot object. + */ + static Pivot parseStream(Service service, InputStream content) { + AtomFeed feed = AtomFeed.parseStream(content); + if (feed.entries.size() != 1) { + throw new IllegalStateException("Expected one Atom entry; found " + feed.entries.size()); + } + AtomEntry entry = feed.entries.get(0); + return new Pivot(service, entry); + } +} diff --git a/splunk/src/main/java/com/splunk/PivotCellValue.java b/splunk/src/main/java/com/splunk/PivotCellValue.java new file mode 100644 index 00000000..3964c159 --- /dev/null +++ b/splunk/src/main/java/com/splunk/PivotCellValue.java @@ -0,0 +1,122 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; + +/** + * Represents an aggregate value to appear in the cells of a pivot. + */ +public class PivotCellValue { + private final String fieldName; + private final DataModelObject dataModelObject; + private final String label; + private final StatsFunction statsFunction; + + PivotCellValue(DataModelObject dataModelObject, String fieldName, String label, StatsFunction statsFunction) { + this.fieldName = fieldName; + this.dataModelObject = dataModelObject; + this.label = label; + this.statsFunction = statsFunction; + + if (!dataModelObject.containsField(fieldName)) { + throw new IllegalArgumentException("No such field named " + fieldName + " on data model object."); + } + + FieldType t = dataModelObject.getField(fieldName).getType(); + + if ((t == FieldType.STRING || t == FieldType.IPV4) && + statsFunction != StatsFunction.LIST && + statsFunction != StatsFunction.DISTINCT_VALUES && + statsFunction != StatsFunction.FIRST && + statsFunction != StatsFunction.LAST && + statsFunction != StatsFunction.COUNT && + statsFunction != StatsFunction.DISTINCT_COUNT) { + throw new IllegalArgumentException("Stats function on string and IPv4 field must be one of " + + "list, distinct_values, first, last, count, or distinct_count; found " + + statsFunction.toString() + ); + } else if (t == FieldType.NUMBER && + statsFunction != StatsFunction.SUM && + statsFunction != StatsFunction.COUNT && + statsFunction != StatsFunction.AVERAGE && + statsFunction != StatsFunction.MAX && + statsFunction != StatsFunction.MIN && + statsFunction != StatsFunction.STDEV && + statsFunction != StatsFunction.LIST && + statsFunction != StatsFunction.DISTINCT_VALUES) { + throw new IllegalArgumentException("Stats function on number field must be one of " + + "sum, count, average, max, min, stdev, list, or distinct_values; found " + + statsFunction.toString() + ); + } else if (t == FieldType.TIMESTAMP && + statsFunction != StatsFunction.DURATION && + statsFunction != StatsFunction.EARLIEST && + statsFunction != StatsFunction.LATEST && + statsFunction != StatsFunction.LIST && + statsFunction != StatsFunction.DISTINCT_VALUES) { + throw new IllegalArgumentException("Stats function on timestamp field must be one of " + + "duration, earliest, latest, list, or distinct_values; found " + + statsFunction.toString() + ); + } else if ((t == FieldType.CHILDCOUNT || t == FieldType.OBJECTCOUNT) && + statsFunction != StatsFunction.COUNT) { + throw new IllegalArgumentException("Stats function on childcount and objectcount fields must be count; " + + "; found " + statsFunction.toString() + ); + } else if (t == FieldType.BOOLEAN) { + throw new IllegalArgumentException("Cannot use boolean valued fields as cell values."); + } + } + + /** + * @return the name of the field to aggregate on. + */ + public String getFieldName() { return this.fieldName; } + + /** + * @return the data model object this pivot is operating on. + */ + public DataModelObject getOwner() { return this.dataModelObject; } + + /** + * @return a human readable name for this aggregate. + */ + public String getLabel() { return this.label; } + + /** + * @return the function used for aggregation. + */ + public StatsFunction getStatsFunction() { return this.statsFunction; } + + /** + * @return a JSON serialization of this object. + */ + JsonObject toJson() { + JsonObject root = new JsonObject(); + + DataModelField f = this.dataModelObject.getField(fieldName); + + root.addProperty("fieldName", this.fieldName); + root.addProperty("owner", Util.join(".", f.getOwnerLineage())); + root.addProperty("type", f.getType().toString()); + root.addProperty("label", this.label); + root.addProperty("sparkline", false); // Not properly implemented in core yet. + root.addProperty("value", this.statsFunction.toString()); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/PivotColumnSplit.java b/splunk/src/main/java/com/splunk/PivotColumnSplit.java new file mode 100644 index 00000000..838439da --- /dev/null +++ b/splunk/src/main/java/com/splunk/PivotColumnSplit.java @@ -0,0 +1,42 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; + +public abstract class PivotColumnSplit { + private final String fieldName; + private final DataModelObject owner; + + PivotColumnSplit(DataModelObject owner, String fieldName) { + this.fieldName = fieldName; + this.owner = owner; + } + + public String getFieldName() { return this.fieldName; } + + public DataModelObject getOwner() { return this.owner; } + + protected void addCommonFields(JsonObject obj) { + DataModelField field = this.owner.getField(this.fieldName); + + obj.addProperty("fieldName", this.fieldName); + obj.addProperty("owner", Util.join(".", field.getOwnerLineage())); + obj.addProperty("type", field.getType().toString()); + } + + abstract JsonObject toJson(); +} diff --git a/splunk/src/main/java/com/splunk/PivotFilter.java b/splunk/src/main/java/com/splunk/PivotFilter.java new file mode 100644 index 00000000..21645ef3 --- /dev/null +++ b/splunk/src/main/java/com/splunk/PivotFilter.java @@ -0,0 +1,79 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +import java.util.ArrayList; + +/** + * Base class representing filters in pivots. + */ +public abstract class PivotFilter { + protected final DataModelObject dataModelObject; + protected final String fieldName; + + PivotFilter(DataModelObject dataModelObject, String fieldName) { + this.dataModelObject = dataModelObject; + if (!dataModelObject.containsField(fieldName)) { + throw new IllegalArgumentException("No such field " + fieldName + " on specified data model object."); + } + this.fieldName = fieldName; + } + + /** + * @return the name of the data model object this filter's field is defined on. + */ + public String getOwnerName() { return this.dataModelObject.getField(this.fieldName).getOwnerName(); } + + /** + * @return return the lineage, most remote ancestor first, of the data model object his filter's field is + * defined on. + */ + public String[] getOwnerLineage() { return this.dataModelObject.getField(this.fieldName).getOwnerLineage(); } + + /** + * @return the name of the field to filter on. + */ + public String getFieldName() { + return this.fieldName; + } + + /** + * @return the type of the field we are filtering on. + */ + public FieldType getType() { + return this.dataModelObject.getField(fieldName).getType(); + } + + /** + * @return a JSON serialization of this object. + */ + abstract JsonElement toJson(); + + /** + * Called by subclasses to add the fields common to all subclasses to JSON serializations. + * + * @param root a JsonObject instance representing a serialization of this object. + */ + protected void addCommonFields(JsonObject root) { + root.addProperty("fieldName", this.fieldName); + root.addProperty("owner", Util.join(".", this.dataModelObject.getField(fieldName).getOwnerLineage())); + root.addProperty("type", this.getType().toString()); + } +} diff --git a/splunk/src/main/java/com/splunk/PivotRowSplit.java b/splunk/src/main/java/com/splunk/PivotRowSplit.java new file mode 100644 index 00000000..0fda18b7 --- /dev/null +++ b/splunk/src/main/java/com/splunk/PivotRowSplit.java @@ -0,0 +1,73 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Base class representing row splits in a pivot. + */ +public abstract class PivotRowSplit { + private final String fieldName; + private final DataModelObject dataModelObject; + private final String label; + + PivotRowSplit(DataModelObject dataModelObject, String fieldName, String label) { + this.fieldName = fieldName; + this.dataModelObject = dataModelObject; + this.label = label; + } + + /** + * @return the name of the field to split on. + */ + public String getFieldName() { return this.fieldName; } + + /** + * @return the name of the data model object on which this split's field is defined. + */ + public String getOwnerName() { return this.dataModelObject.getField(fieldName).getOwnerName(); } + + /** + * @return the lineage, most remote ancestor first, on which the split's field is defined. + */ + public String[] getOwnerLineage() { return this.dataModelObject.getField(fieldName).getOwnerLineage(); } + + /** + * @return a human readable label for this split. + */ + public String getLabel() { return this.label; } + + /** + * Add keys common to all row splits to a JSON serialization. + * + * @param obj JSON serialization to modify. + */ + protected void addCommonFields(JsonObject obj) { + DataModelField field = this.dataModelObject.getField(this.fieldName); + + obj.addProperty("fieldName", this.fieldName); + obj.addProperty("owner", Util.join(".", field.getOwnerLineage())); + obj.addProperty("type", field.getType().toString()); + obj.addProperty("label", this.label); + } + + /** + * @return a JSON serialization of this object. + */ + abstract JsonElement toJson(); +} diff --git a/splunk/src/main/java/com/splunk/PivotSpecification.java b/splunk/src/main/java/com/splunk/PivotSpecification.java new file mode 100644 index 00000000..1aa154a9 --- /dev/null +++ b/splunk/src/main/java/com/splunk/PivotSpecification.java @@ -0,0 +1,491 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.*; + +import java.util.*; + +/** + * PivotSpecification represents a pivot to be done on a particular data model object. The user creates a + * PivotSpecification on some data model object, adds filters, row splits, column splits, and cell values, + * then calls the pivot method to query splunkd and get a set of SPL queries corresponding to this specification. + */ +public class PivotSpecification { + private static GsonBuilder gson = new GsonBuilder(); + + private DataModelObject dataModelObject; + private String accelerationNamespace = null; + + private List<PivotColumnSplit> columns = new ArrayList<PivotColumnSplit>(); + private List<PivotFilter> filters = new ArrayList<PivotFilter>(); + private List<PivotCellValue> cells = new ArrayList<PivotCellValue>(); + private List<PivotRowSplit> rows = new ArrayList<PivotRowSplit>(); + + PivotSpecification(DataModelObject dataModelObject) { + this.dataModelObject = dataModelObject; + if (dataModelObject.getDataModel().isAccelerated()) { + this.accelerationNamespace = dataModelObject.getDataModel().getName(); + } else { + this.accelerationNamespace = null; + } + } + + /** + * Set the namespace to use for this acceleration, usually the name of a data model. A value of null will set no + * namespace for acceleration. + * + * @param namespace a string specifying a namespace. + * @return PivotSpecification instance + */ + public PivotSpecification setAccelerationNamespace(String namespace) { + this.accelerationNamespace = namespace; + return this; + } + + /** + * Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a + * DataModelObject instance, as the acceleration cache for this pivot. + * + * @param sid the SID of a job. + * @return PivotSpecification instance + */ + public PivotSpecification setAccelerationJob(String sid) { + if (sid == null) { + throw new IllegalArgumentException("Sid to use for acceleration must not be null."); + } else { + this.accelerationNamespace = "sid=" + sid; + } + return this; + } + + /** + * Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a + * DataModelObject instance, as the acceleration cache for this pivot. + * + * @param job a Job object. + * @return PivotSpecification instance + */ + public PivotSpecification setAccelerationJob(Job job) { + setAccelerationJob(job.getSid()); + return this; + } + + /** + * @return the acceleration namespace to use in this pivot. + */ + public String getAccelerationNamespace() { + return this.accelerationNamespace; + } + + private void assertCorrectlyTypedField(String fieldName, FieldType[] acceptableTypes) { + DataModelField field = this.dataModelObject.getField(fieldName); + if (field == null) { + throw new IllegalArgumentException("No such field named " + fieldName); + } else if (!Arrays.asList(acceptableTypes).contains(field.getType())) { + StringBuilder errorMessage = new StringBuilder(); + errorMessage.append("Expected a field of one of the following types: "); + boolean first = true; + for (FieldType t : acceptableTypes) { + if (!first) errorMessage.append(", "); + errorMessage.append(t.toString()); + first = false; + } + errorMessage.append("; found type " + field.getType().toString()); + throw new IllegalArgumentException(errorMessage.toString()); + } + } + + private void assertCorrectlyTypedField(String field, FieldType acceptableType) { + assertCorrectlyTypedField(field, new FieldType[] { acceptableType }); + } + + /** + * Add a filter on a boolean valued field. The filter will be a constraint of the form + * + * field `comparison` compareTo + * + * for example + * + * is_remote = false + * + * @param field the name of the field + * @param comparison a comparison operator for the filter + * @param compareTo the value to compare the field to + * @return the PivotSpecification you are operating on. + */ + public PivotSpecification addFilter(String field, BooleanComparison comparison, boolean compareTo) { + assertCorrectlyTypedField(field, FieldType.BOOLEAN); + + BooleanPivotFilter filter = new BooleanPivotFilter(this.dataModelObject, field, comparison, compareTo); + filters.add(filter); + + return this; + } + + /** + * Add a filter on a string valued field. The filter will be a constraint of the form + * + * field `comparison` compareTo + * + * for example + * + * host startswith 'boris' + * + * @param field the name of the field + * @param comparison a comparison operator for the filter + * @param comparisonValue the value to compare the field to + * @return the PivotSpecification you are operating on. + */ + public PivotSpecification addFilter(String field, StringComparison comparison, String comparisonValue) { + assertCorrectlyTypedField(field, FieldType.STRING); + + StringPivotFilter filter = new StringPivotFilter(this.dataModelObject, field, comparison, comparisonValue); + filters.add(filter); + + return this; + } + + /** + * Add a filter on an IPv4 valued field. The filter will be a constraint of the form + * + * field `comparison` compareTo + * + * for example + * + * hostip = 192.168.100.12 + * + * @param field the name of the field + * @param comparison a comparison operator for the filter + * @param comparisonValue the value to compare the field to + * @return the PivotSpecification you are operating on. + */ + public PivotSpecification addFilter(String field, IPv4Comparison comparison, String comparisonValue) { + assertCorrectlyTypedField(field, FieldType.IPV4); + + IPv4PivotFilter filter = new IPv4PivotFilter(this.dataModelObject, field, comparison, comparisonValue); + filters.add(filter); + + return this; + } + + /** + * Add a filter on a numeric field. The filter will be a constraint of the form + * + * field `comparison` compareTo + * + * for example + * + * {@code height > 6} + * + * @param field the name of the field + * @param comparison a comparison operator for the filter + * @param comparisonValue the value to compare the field to + * @return the PivotSpecification you are operating on. + */ + public PivotSpecification addFilter(String field, NumberComparison comparison, double comparisonValue) { + assertCorrectlyTypedField(field, FieldType.NUMBER); + + NumberPivotFilter filter = new NumberPivotFilter(this.dataModelObject, field, comparison, comparisonValue); + filters.add(filter); + + return this; + } + + /** + * Add a filter that limits the number of values of an aggregated field that will be allowed + * into the pivot. + * + * @param field the name of a field + * @param sortAttribute field to aggregate for limiting + * @param sortDirection whether to take the lowest or highest values of the aggregated field + * @param limit how many values of the aggregated field to take + * @param statsFunction the function to use for aggregation + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addFilter(String field, String sortAttribute, + SortDirection sortDirection, int limit, StatsFunction statsFunction) { + if (!dataModelObject.containsField(field)) { + throw new IllegalArgumentException("No such field " + sortAttribute); + } + assertCorrectlyTypedField( + sortAttribute, + new FieldType[] { FieldType.STRING, FieldType.NUMBER, FieldType.OBJECTCOUNT } + ); + + LimitPivotFilter filter = new LimitPivotFilter(this.dataModelObject, field, sortAttribute, + sortDirection, limit, statsFunction); + filters.add(filter); + + return this; + } + + /** + * Add a row split on a numeric or string valued field, splitting on each distinct value of the field. + * + * @param field name of the field to split on + * @param label a human readable name for this set of rows + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addRowSplit(String field, String label) { + assertCorrectlyTypedField(field, new FieldType[] { FieldType.NUMBER, FieldType.STRING }); + + FieldType t = this.dataModelObject.getField(field).getType(); + if (t == FieldType.NUMBER) { + rows.add(new NumberPivotRowSplit(this.dataModelObject, field, label)); + } else if (t == FieldType.STRING) { + rows.add(new StringPivotRowSplit(this.dataModelObject, field, label)); + } else { + throw new IllegalArgumentException("Field not of type number or string despite precondition asserting so."); + } + + return this; + } + + /** + * Add a row split on a numeric field, splitting into numeric ranges. + * + * This split generates bins with edges equivalent to the + * classic loop {@code 'for i in <start> to <end> by <step>' } but with a maximum + * number of bins {@code <limit> }. This dispatches to the stats and xyseries search commands. + * See their documentation for more details. + * + * + * @param field The field to split on + * @param label a human readable name for this set of rows + * @param start the value of the start of the first range, or null to take the lowest value in the events. + * @param end the value for the end of the last range, or null to take the highest value in the events. + * @param step the width of each range, or null to have Splunk calculate it. + * @param limit the maximum number of ranges to split into, or null for no limit. + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addRowSplit(String field, String label, Integer start, Integer end, + Integer step, Integer limit) { + assertCorrectlyTypedField(field, FieldType.NUMBER); + + PivotRowSplit split = new RangePivotRowSplit(this.dataModelObject, field, label, start, end, step, limit); + rows.add(split); + + return this; + } + + /** + * Add a row split on a boolean valued field. + * + * @param field String value + * @param label String value + * @param trueDisplayValue the string to display in the true valued row label. + * @param falseDisplayValue the string to display in the false valued row label; + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addRowSplit(String field, String label, + String trueDisplayValue, String falseDisplayValue) { + assertCorrectlyTypedField(field, FieldType.BOOLEAN); + + PivotRowSplit split = new BooleanPivotRowSplit(this.dataModelObject, field, label, + trueDisplayValue, falseDisplayValue); + rows.add(split); + + return this; + } + + /** + * Add a row split on a timestamp valued field, binned by the specified bucket size. + * + * @param field the name of the field to split on. + * @param label a human readable name for this set of rows + * @param binning the size of bins to use + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addRowSplit(String field, String label, TimestampBinning binning) { + assertCorrectlyTypedField(field, FieldType.TIMESTAMP); + + PivotRowSplit split = new TimestampPivotRowSplit(this.dataModelObject, field, label, binning); + rows.add(split); + + return this; + } + + /** + * Add a column split on a string or number valued field, producing a column for + * each distinct value of the field. + * + * @param field the field to split on. + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addColumnSplit(String field) { + assertCorrectlyTypedField(field, new FieldType[] { FieldType.NUMBER, FieldType.STRING }); + + FieldType t = this.dataModelObject.getField(field).getType(); + + if (t == FieldType.NUMBER) { + columns.add(new NumericPivotColumnSplit(this.dataModelObject, field)); + } else if (t == FieldType.STRING) { + columns.add(new StringPivotColumnSplit(this.dataModelObject, field)); + } + + return this; + } + + /** + * Add a column split on a numeric field, splitting the values into ranges. + * + * @param field the field to split on. + * @param start the value of the start of the first range, or null to take the lowest value in the events. + * @param end the value for the end of the last range, or null to take the highest value in the events. + * @param step the width of each range, or null to have Splunk calculate it. + * @param limit the maximum number of ranges to split into, or null for no limit. + * @return The PivotSpecification you are modifying. + */ + public PivotSpecification addColumnSplit(String field, Integer start, Integer end, Integer step, Integer limit) { + assertCorrectlyTypedField(field, FieldType.NUMBER); + + PivotColumnSplit split = new RangePivotColumnSplit(this.dataModelObject, field, start, end, step, limit); + + columns.add(split); + return this; + } + + /** + * Add a column split on a boolean valued field. + * + * @param field the field to split on. + * @param trueDisplayValue the string to display in the true valued column label. + * @param falseDisplayValue the string to display in the false valued column label. + * @return the PivotSpecification you are working on. + */ + public PivotSpecification addColumnSplit(String field, String trueDisplayValue, String falseDisplayValue) { + assertCorrectlyTypedField(field, FieldType.BOOLEAN); + + PivotColumnSplit split = new BooleanPivotColumnSplit(this.dataModelObject, field, + trueDisplayValue, falseDisplayValue); + + columns.add(split); + return this; + } + + /** + * Add a column split on a timestamp valued field. + * + * @param field the field to split on. + * @param binning what time periods to use for binning valued of the field. + * @return the PivotSpecification you are working on. + */ + public PivotSpecification addColumnSplit(String field, TimestampBinning binning) { + assertCorrectlyTypedField(field, FieldType.TIMESTAMP); + + PivotColumnSplit split = new TimestampPivotColumnSplit(this.dataModelObject, field, binning); + + columns.add(split); + return this; + } + + /** + * Add an aggregate to each cell of the pivot. + * + * @param field the field to aggregate. + * @param label a human readable name for this aggregate. + * @param statsFunction the function to use for aggregation. + * @return the PivotSpecification you are working on. + */ + public PivotSpecification addCellValue(String field, String label, StatsFunction statsFunction) { + cells.add(new PivotCellValue(this.dataModelObject, field, label, statsFunction)); + + return this; + } + + /** + * @return a JSON serialization of this object. + */ + JsonObject toJson() { + JsonObject root = new JsonObject(); + + root.addProperty("dataModel", this.dataModelObject.getDataModel().getName()); + root.addProperty("baseClass", this.dataModelObject.getName()); + + JsonArray filterArray = new JsonArray(); + for (PivotFilter p : filters) { filterArray.add(p.toJson()); } + root.add("filters", filterArray); + + JsonArray rowsplitArray = new JsonArray(); + for (PivotRowSplit p : rows) { rowsplitArray.add(p.toJson()); } + root.add("rows", rowsplitArray); + + JsonArray cellvalueArray = new JsonArray(); + for (PivotCellValue p : cells) { cellvalueArray.add(p.toJson()); } + root.add("cells", cellvalueArray); + + JsonArray columnsplitArray = new JsonArray(); + for (PivotColumnSplit p : columns) { columnsplitArray.add(p.toJson()); } + root.add("columns", columnsplitArray); + + return root; + } + + /** + * @return a collection of all the filters added to this PivotSpecification. + */ + public Collection<PivotFilter> getFilters() { + return Collections.unmodifiableCollection(this.filters); + } + + /** + * @return a collection of all the row splits added to this PivotSpecification. + */ + public Collection<PivotRowSplit> getRowSplits() { + return Collections.unmodifiableCollection(this.rows); + } + + /** + * @return a collection of all the column splits added to this PivotSpecification. + */ + public Collection<PivotColumnSplit> getColumnSplits() { + return Collections.unmodifiableCollection(this.columns); + } + + /** + * @return a collection of all the cell values added to this PivotSpecification. + */ + public Collection<PivotCellValue> getCellValues() { + return Collections.unmodifiableCollection(this.cells); + } + + /** + * Query Splunk for SPL queries corresponding to this pivot. + * + * @return a Pivot object encapsulating the returned queries. + */ + public Pivot pivot() { + Service service = this.dataModelObject.getDataModel().getService(); + + Args args = new Args(); + args.put("pivot_json", toJson()); + if (this.accelerationNamespace != null) { + args.put("namespace", this.accelerationNamespace); + } + + ResponseMessage response = service.get( + "datamodel/pivot/" + this.dataModelObject.getDataModel().getName(), + args + ); + + if (response.getStatus() != 200) { + throw HttpException.create(response); + } else { + return Pivot.parseStream(service, response.getContent()); + } + } +} diff --git a/splunk/src/main/java/com/splunk/PortInput.java b/splunk/src/main/java/com/splunk/PortInput.java new file mode 100644 index 00000000..f0f2be1f --- /dev/null +++ b/splunk/src/main/java/com/splunk/PortInput.java @@ -0,0 +1,66 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code PortInput} class represents a superclass of inputs that are bound + * to a particular port and can be host restricted. + * + * This class collects common functionality to minimize duplication and is not + * part of the public API. + */ +abstract class PortInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The input endpoint. + */ + PortInput(Service service, String path) { + super(service, path); + } + + /** + * Returns the port that this input is listening on. + * @return int value + */ + public int getPort() { + String[] nameComponents = this.getName().split(":"); + String portString = nameComponents[nameComponents.length - 1]; + return Integer.parseInt(portString); + } + + /** + * {@inheritDoc} + * + * Overrides the {@code update} method to additionally update this input's + * path if the {@code RestrictToHost} property is changed. + */ + @Override + public void update(Map<String, Object> args) { + if (args.containsKey("restrictToHost")) { + throw new UnsupportedOperationException( + "You cannot update the restrictToHost parameter " + + "on an existing input with the SDK."); + } else { + super.update(args); + } + } +} diff --git a/splunk/src/main/java/com/splunk/RangePivotColumnSplit.java b/splunk/src/main/java/com/splunk/RangePivotColumnSplit.java new file mode 100644 index 00000000..05167f8e --- /dev/null +++ b/splunk/src/main/java/com/splunk/RangePivotColumnSplit.java @@ -0,0 +1,73 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Split values of a field into rows by ranges of a numeric field. + */ +public class RangePivotColumnSplit extends PivotColumnSplit { + private final Integer start, end, step, limit; + + RangePivotColumnSplit(DataModelObject dataModelObject, String field, + Integer start, Integer end, Integer step, Integer limit) { + super(dataModelObject, field); + this.start = start; + this.end = end; + this.step = step; + this.limit = limit; + } + + /** + * @return the value of the start of the lowest range, or null if not specified. + */ + public Integer getStart() { return this.start; } + + /** + * @return the value of the end of the highest range, or null if not specified. + */ + public Integer getEnd() { return this.end; } + + /** + * @return the width of each range, or null if not specified. + */ + public Integer getStep() { return this.step; } + + /** + * @return the maximum number of ranges to split into, or null if no limit. + */ + + @Override + JsonObject toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + JsonObject ranges = new JsonObject(); + // In Splunk 6.0.1.1, data models incorrectly expect strings for these fields + // instead of numbers. In 6.1, this is fixed and both are accepted. + if (start != null) ranges.add("start", new JsonPrimitive(start.toString())); + if (end != null) ranges.add("end", new JsonPrimitive(end.toString())); + if (step != null) ranges.add("size", new JsonPrimitive(step.toString())); + if (limit != null) ranges.add("maxNumberOf", new JsonPrimitive(limit.toString())); + root.add("ranges", ranges); + root.add("display", new JsonPrimitive("ranges")); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/RangePivotRowSplit.java b/splunk/src/main/java/com/splunk/RangePivotRowSplit.java new file mode 100644 index 00000000..a6882ce4 --- /dev/null +++ b/splunk/src/main/java/com/splunk/RangePivotRowSplit.java @@ -0,0 +1,72 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Split values of a field into rows by ranges of a numeric field. + */ +public class RangePivotRowSplit extends PivotRowSplit { + final Integer start, end, step, limit; + + RangePivotRowSplit(DataModelObject dataModelObject, String field, String label, + Integer start, Integer end, Integer step, Integer limit) { + super(dataModelObject, field, label); + this.start = start; + this.end = end; + this.step = step; + this.limit = limit; + } + + /** + * @return the value of the start of the lowest range, or null if not specified. + */ + public Integer getStart() { return this.start; } + + /** + * @return the value of the end of the highest range, or null if not specified. + */ + public Integer getEnd() { return this.end; } + + /** + * @return the width of each range, or null if not specified. + */ + public Integer getStep() { return this.step; } + + /** + * @return the maximum number of ranges to split into, or null if no limit. + */ + public Integer getLimit() { return this.limit; } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + JsonObject ranges = new JsonObject(); + if (start != null) ranges.addProperty("start", start); + if (end != null) ranges.addProperty("end", end); + if (step != null) ranges.addProperty("size", step); + if (limit != null) ranges.addProperty("maxNumberOf", limit); + root.add("ranges", ranges); + root.addProperty("display", "ranges"); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/Receiver.java b/splunk/src/main/java/com/splunk/Receiver.java new file mode 100644 index 00000000..8ae4d826 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Receiver.java @@ -0,0 +1,219 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.*; +import java.net.Socket; +import java.lang.StringBuilder; +import java.util.ArrayList; +import java.util.List; + +/** + * The {@code Receiver} class represents a named index and unnamed index + * receivers. + */ +public class Receiver { + + Service service = null; + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + Receiver(Service service) { + this.service = service; + } + + /** + * Creates a writable socket to this index. + * + * @return The socket. + * @throws IOException The IOException instance + */ + public Socket attach() throws IOException { + return attach(null, null); + } + + /** + * Creates a writable socket to this index. + * + * @param indexName The index to write to. + * @return The socket. + * @throws IOException The IOException instance + */ + public Socket attach(String indexName) throws IOException { + return attach(indexName, null); + } + + /** + * Creates a writable socket to this index. + * + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @return The socket. + * @throws IOException The IOException instance + */ + public Socket attach(Args args) throws IOException { + return attach(null, args); + } + + /** + * Creates a writable socket to this index. + * + * @param indexName The index to write to. + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @return The socket. + * @throws IOException The IOException instance + */ + public Socket attach(String indexName, Args args) throws IOException { + Socket socket = service.open(); + PrintWriter writer = new PrintWriter(new OutputStreamWriter(socket.getOutputStream(), "UTF-8")); + String postUrl = "POST /services/receivers/stream"; + if (indexName != null) { + postUrl = postUrl + "?index=" + indexName; + } + if (args != null && args.size() > 0) { + postUrl = postUrl + ((indexName == null) ? "?" : "&"); + postUrl = postUrl + args.encode(); + } + + List<String> headers = new ArrayList<>(); + headers.add(String.format("%s HTTP/1.1", postUrl)); + headers.add("Accept-Encoding: identity"); + headers.add("X-Splunk-Input-Mode: Streaming"); + + if (service.hasSplunkAuthCookies()) { + headers.add(String.format("Cookie: %s", service.stringifyCookies())); + } else { + // to persist the cookies other than Splunk such as from Load Balancer + if(!service.cookieStore.isEmpty()){ + headers.add(String.format("Cookie: %s", service.stringifyCookies())); + } + headers.add(String.format("Authorization: %s", service.getToken())); + } + headers.add(""); + headers.forEach(header -> writer.println(header)); + writer.flush(); + return socket; + } + + /** + * Submits an event to this index through HTTP POST. + * + * @param data A string containing event data. + */ + public void submit(String data) { + submit(null, null, data); + } + + /** + * Submits an event to this index through HTTP POST. + * + * @param indexName The index to write to. + * @param data A string containing event data. + */ + public void submit(String indexName, String data) { + submit(indexName, null, data); + } + + /** + * Submits an event to this index through HTTP POST. + * + * @param data A string containing event data. + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + */ + public void submit(Args args, String data) { + submit(null, args, data); + } + + /** + * Logs an event to this index through HTTP POST. + * + * @param indexName The index to write to. + * @param data A string containing event data. + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + */ + public void submit(String indexName, Args args, String data) { + String sendString = ""; + RequestMessage request = new RequestMessage("POST"); + request.setContent(data); + if (indexName !=null) { + sendString = String.format("?index=%s", indexName); + } + if (args != null && args.size() > 0) { + sendString = sendString + ((indexName == null) ? "?" : "&"); + sendString = sendString + args.encode(); + } + ResponseMessage response = service.send(service.simpleReceiverEndPoint + + sendString, request); + try { + response.getContent().close(); + } catch (IOException e) { + // noop + } + } + + /** + * Submits an event to this index through HTTP POST. This method is an alias + * for {@code submit()}. + * + * @param data A string containing event data. + */ + public void log(String data) { + submit(data); + } + + /** + * Submits an event to this index through HTTP POST. This method is an alias + * for {@code submit()}. + * + * @param indexName The index to write to. + * @param data A string containing event data. + */ + public void log(String indexName, String data) { + submit(indexName, data); + } + + /** + * Submits an event to this index through HTTP POST. This method is an alias + * for {@code submit()}. + * + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @param data A string containing event data. + */ + public void log(Args args, String data) { + submit(args, data); + } + + /** + * Logs an event to this index through HTTP POST. This method is an alias + * for {@code submit()}. + * + * @param indexName The index to write to. + * @param args Optional arguments for this stream. Valid parameters are: + * "host", "host_regex", "source", and "sourcetype". + * @param data A string containing event data. + */ + public void log(String indexName, Args args, String data) { + submit(indexName, args, data); + } +} diff --git a/tests/com/splunk/OutputSyslogTest.java b/splunk/src/main/java/com/splunk/ReceiverBehavior.java similarity index 54% rename from tests/com/splunk/OutputSyslogTest.java rename to splunk/src/main/java/com/splunk/ReceiverBehavior.java index 0c8b9895..2ad80160 100644 --- a/tests/com/splunk/OutputSyslogTest.java +++ b/splunk/src/main/java/com/splunk/ReceiverBehavior.java @@ -13,25 +13,16 @@ * License for the specific language governing permissions and limitations * under the License. */ - package com.splunk; -import org.junit.Test; - -public class OutputSyslogTest extends SplunkTestCase { - @Test public void testOutputSyslog() throws Exception { - Service service = connect(); - - EntityCollection<OutputSyslog> dos = service.getOutputSyslogs(); - - if (dos.values().size() == 0) { - System.out.println("WARNING: OutputSyslog not configured"); - return; - } +import java.io.IOException; +import java.io.OutputStream; +/** + * The {@code ReceiverBehavior} interface represents actions to be taken given + * an output stream connected to Splunk over which a program can stream events. + */ - for (OutputSyslog entity: dos.values()) { - entity.getServer(); - entity.getType(); - } - } +public interface ReceiverBehavior { + public void run(OutputStream stream) throws IOException; } + diff --git a/splunk/com/splunk/Record.java b/splunk/src/main/java/com/splunk/Record.java similarity index 84% rename from splunk/com/splunk/Record.java rename to splunk/src/main/java/com/splunk/Record.java index 30853c4c..ff387bdb 100644 --- a/splunk/com/splunk/Record.java +++ b/splunk/src/main/java/com/splunk/Record.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -21,13 +21,13 @@ import java.util.List; /** - * An extension of {@code HashMap} that contains a variety of value converting - * access methods. + * The {@code Record} class represents an extension of {@code HashMap} that + * contains a variety of value-converting access methods. */ public class Record extends HashMap<String, Object> { /** - * Returns the {@code boolean} value associated with the given key. + * Returns the {@code Boolean} value associated with the given key. * * @param key The key of the value being retrieved. * @return The value associated with the given key, or {@code null} if the @@ -38,11 +38,11 @@ boolean getBoolean(String key) { } /** - * Returns the {@code boolean} value associated with the given key, or the + * Returns the {@code Boolean} value associated with the given key, or the * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -67,7 +67,7 @@ long getByteCount(String key) { * or {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -92,7 +92,7 @@ Date getDate(String key) { * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -101,33 +101,6 @@ Date getDate(String key, Date defaultValue) { return Value.toDate(getString(key)); } - /** - * Returns the {@code Date} value associated with the given key. The value - * stored in the record is a string representation of a date from the epoch. - * - * @param key The key of the value being retrieved. - * @return The value associated with the given key, or {@code null} if the - * key does not exist. - */ - Date getDateFromEpoch(String key) { - return Value.toDateFromEpoch(getString(key)); - } - - /** - * Returns the {@code Date} value associated with the given key, or - * {@code defaultValue} if the key does not exist. The value stored in the - * record is a string representation of a data from the epoch. - * - * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist - * @return The value associated with the given key, or {@code defaultValue} - * if the key does not exist. - */ - Date getDateFromEpoch(String key, Date defaultValue) { - if (!containsKey(key)) return defaultValue; - return Value.toDateFromEpoch(getString(key)); - } - /** * Returns the {@code float} value associated with the given key. * @@ -153,7 +126,7 @@ int getInteger(String key) { * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -177,7 +150,7 @@ long getLong(String key) { * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -201,7 +174,7 @@ String getString(String key) { * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ @@ -226,7 +199,7 @@ String[] getStringArray(String key) { * {@code defaultValue} if the key does not exist. * * @param key The key of the value being retrieved. - * @param defaultValue The value to return if the key does not exist + * @param defaultValue The value to return if the key does not exist. * @return The value associated with the given key, or {@code defaultValue} * if the key does not exist. */ diff --git a/splunk/src/main/java/com/splunk/RegexpDataModelCalculation.java b/splunk/src/main/java/com/splunk/RegexpDataModelCalculation.java new file mode 100644 index 00000000..9a3eb495 --- /dev/null +++ b/splunk/src/main/java/com/splunk/RegexpDataModelCalculation.java @@ -0,0 +1,44 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import java.util.Map; + +/** + * Represents a calculation on a data model object done by a regular expression. + */ +public class RegexpDataModelCalculation extends DataModelCalculation { + private final String expression; + private final String inputField; + + RegexpDataModelCalculation(String[] owner, String calculationID, + Map<String, DataModelField> generatedFields, String comment, + boolean editable, String inputField, String expression) { + super(owner, calculationID, generatedFields, comment, editable); + this.expression = expression; + this.inputField = inputField; + } + + /** + * @return regular expression specifying this calculation + */ + public String getExpression() { return this.expression; } + + /** + * @return name of the field to apply the regular expression to. + */ + public String getInputField() { return this.inputField; } +} diff --git a/splunk/com/splunk/RequestMessage.java b/splunk/src/main/java/com/splunk/RequestMessage.java similarity index 74% rename from splunk/com/splunk/RequestMessage.java rename to splunk/src/main/java/com/splunk/RequestMessage.java index cca813f4..816e1fe2 100644 --- a/splunk/com/splunk/RequestMessage.java +++ b/splunk/src/main/java/com/splunk/RequestMessage.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -17,12 +17,12 @@ package com.splunk; import java.io.OutputStream; -import java.util.TreeMap; import java.util.Map; +import java.util.TreeMap; /** - * Representation of an HTTP request message including method, headers and body - * content. + * The {@code RequestMessage} class represents an HTTP request message including + * method, headers, and body content. */ public class RequestMessage { String method = "GET"; // "GET" | "PUT" | "POST" | "DELETE" @@ -32,16 +32,21 @@ public class RequestMessage { /** Creates a new {@code RequestMessage} instance. */ public RequestMessage() {} - /** Creates a {@code RequestMessage} instance with the given method */ + /** + * Creates a new {@code RequestMessage} instance with a given method + * + * @param method String value + */ public RequestMessage(String method) { this.method = method; } /** - * Answers if the given value is a supported HTTP method. + * Indicates whether the given value is a supported HTTP method. * * @param value The value to check. - * @return {@code true} if the value is a supported method. + * @return {@code true} if the value is a supported method, + * {@code false} if not. */ boolean checkMethod(String value) { return @@ -52,9 +57,9 @@ boolean checkMethod(String value) { } /** - * Returns the {@code Map} of message headers. + * Returns a map of message headers. * - * @return Message headers. + * @return A {@code Map} of message headers. */ public Map<String, String> getHeader() { if (this.header == null) @@ -64,18 +69,18 @@ public Map<String, String> getHeader() { } /** - * Returns the message's HTTP method value. + * Returns the message's HTTP method. * - * @return HTTP method. + * @return The HTTP method. */ public String getMethod() { return this.method; } /** - * Sets the message's HTTP method value. + * Sets the message's HTTP method. * - * @param value HTTP method. + * @param value The HTTP method. */ public void setMethod(String value) { value = value.toUpperCase(); @@ -87,7 +92,7 @@ public void setMethod(String value) { /** * Returns the message body content. * - * @return Message content. + * @return The message content. */ public Object getContent() { return this.content; @@ -96,7 +101,7 @@ public Object getContent() { /** * Sets the message body content. * - * @param value Message content. + * @param value The message content. */ public void setContent(String value) { this.content = value; diff --git a/splunk/src/main/java/com/splunk/Resource.java b/splunk/src/main/java/com/splunk/Resource.java new file mode 100644 index 00000000..4dc43e27 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Resource.java @@ -0,0 +1,189 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; +import java.util.Map; + +/** + * The {@code Resource} abstract base class represents a Splunk resource. + */ +public abstract class Resource { + private static final String[] NAMESPACE_COMPONENT_NAMES = { + "app", "owner", "sharing" + }; + + /* Initialized by constructor. */ + protected Service service; + protected String path; + protected Args refreshArgs; + + /* Initialized by {@link #load()}. */ + protected Map<String, String> actions; + protected String title; + protected Date updated; + private boolean maybeValid = false; + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The target endpoint. + */ + Resource(Service service, String path) { + this(service, path, null); + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The target endpoint. + * @param args Arguments to use when you instantiate the entity. + */ + Resource(Service service, String path, Args args) { + // Clone the original argument list, since it will be modified + args = Args.create(args); + + Args namespace = extractNamespaceFrom(args); + if (!args.containsKey("count")) { + args.put("count", "-1"); + } + + this.service = service; + this.path = service.fullpath( + path, namespace.size() == 0 ? null : namespace); + this.refreshArgs = args; + } + + /** + * Extracts the namespace components from the specified argument list + * (modifying the original list in place) and returns the namespace + * components in its own namespace Args. + * + * @param args An argument list. Will be modified in place. + * @return The namespace arguments from the original argument list. + */ + private static Args extractNamespaceFrom(Args args) { + Args namespace = new Args(); + for (String componentName : NAMESPACE_COMPONENT_NAMES) { + if (args.containsKey(componentName)) { + namespace.put(componentName, args.get(componentName).toString()); + args.remove(componentName); + } + } + return namespace; + } + + /** + * Returns the resource name. By default, the name is the resource title. + * This name can also be used as the key for the resource if it belongs + * to a container resource (for example, an entity that belongs to an + * entity collection). + * + * @return The resource name. + */ + public String getName() { + return getTitle(); + } + + /** + * Returns the path to this resource. + * + * @return The resource path. + */ + public String getPath() { + return this.path; + } + + /** + * Returns the {@code Service} instance this resource is connected to. + * + * @return The {@code Service} instance. + */ + public Service getService() { + return this.service; + } + + /** + * Return the title of this resource, which corresponds to the Atom + * {@code <title>} element. + * + * @return The resource title. + */ + public String getTitle() { + return validate().title; + } + + /** + * Return the last updated time of this resource, which corresponds to the Atom + * {@code <updated>} element. + * + * @return The resource last updated time. + */ + public Date getUpdated() { + return validate().updated; + } + + /** + * Marks the local state of this resource as no longer current. + * + * @return The current {@code Resource} instance. + */ + public Resource invalidate() { + this.maybeValid = false; + return this; + } + + /** + * Loads the state of this resource from a given Atom object. + * + * @param value The {@code AtomObject} from which to load the resource + * state. + * @return The current {@code Resource} instance. + */ + Resource load(AtomObject value) { + if (value == null) { + this.title = "title"; + } + else { + this.actions = value.links; + this.title = value.title; + this.updated = Value.toDate(value.updated); + } + this.maybeValid = true; + return this; + } + + /** + * Refreshes the local state of this resource. + * + * @return The current {@code Resource} instance. + */ + public abstract Resource refresh(); + + /** + * Ensures that the local state of the resource is current, + * calling {@code refresh} if necessary. + * + * @return The current {@code Resource} instance. + */ + public Resource validate() { + if (!this.maybeValid) refresh(); + return this; + } +} diff --git a/splunk/src/main/java/com/splunk/ResourceCollection.java b/splunk/src/main/java/com/splunk/ResourceCollection.java new file mode 100644 index 00000000..b81ecb8a --- /dev/null +++ b/splunk/src/main/java/com/splunk/ResourceCollection.java @@ -0,0 +1,386 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.lang.reflect.Constructor; +import java.lang.reflect.InvocationTargetException; +import java.util.*; + +/** + * The {@code ResourceCollection} abstract base class represents a collection of + * Splunk resources. + * + * @param <T> The type of members of the collection. + */ +public class ResourceCollection<T extends Resource> + extends Resource implements Map<String, T> +{ + protected LinkedHashMap<String, LinkedList<T>> + items = new LinkedHashMap<String, LinkedList<T>>(); + protected Class itemClass; + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The target endpoint. + * @param itemClass The class of this resource item. + */ + ResourceCollection(Service service, String path, Class itemClass) { + super(service, path); + this.itemClass = itemClass; + } + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The target endpoint. + * @param itemClass The class of this resource item. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + ResourceCollection( + Service service, String path, Class itemClass, Args args) { + super(service, path, args); + this.itemClass = itemClass; + } + + /** {@inheritDoc} */ + public void clear() { + throw new UnsupportedOperationException(); + } + + /** {@inheritDoc} */ + public boolean containsKey(Object key) { + return validate().items.containsKey(key); + } + + /** + * Determines whether a scoped, namespace-constrained key + * exists within this collection. + * + * @param key The key to look up. + * @param namespace The namespace to constrain the search to. + * @return {@code true} if the key exists, {@code false} if not. + */ + public boolean containsKey(Object key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + validate(); + + LinkedList<T> entities = items.get(key); + if (entities == null || entities.size() == 0) return false; + String pathMatcher = service.fullpath("", namespace); + for (T entity: entities) { + if (entity.path.startsWith(pathMatcher)) { + return true; + } + } + return false; + } + + /** {@inheritDoc} */ + public boolean containsValue(Object value) { + // value should be a non-linked-list value; values are stored as linked + // lists inside our container. + LinkedList<Object> linkedList = new LinkedList<Object>(); + linkedList.add(value); + return validate().items.containsValue(linkedList); + } + + static Class[] itemSig = new Class[] { Service.class, String.class }; + + /** + * Creates a collection member. + * + * @param itemClass The class of the member to create. + * @param path The path to the member resource. + * @param namespace The namespace. + * @return The new member. + */ + protected T createItem(Class itemClass, String path, Args namespace) { + Constructor constructor; + try { + constructor = itemClass.getDeclaredConstructor(itemSig); + } + catch (NoSuchMethodException e) { + throw new RuntimeException(e); + } + + T item; + try { + while (true) { + Object obj = constructor.newInstance(service, service.fullpath(path, namespace)); + //if (obj instanceof Message) { // We ignore messages sent back inline. + // continue; + //} else { + item = (T)obj; + break; + //} + } + } + catch (IllegalAccessException e) { + throw new RuntimeException(e); + } + catch (InvocationTargetException e) { + throw new RuntimeException(e.getTargetException()); + } + catch (InstantiationException e) { + throw new RuntimeException(e); + } + + return item; + } + + /** + * Creates a collection member corresponding to a given + * Atom entry. This base implementation uses the class object that was + * passed in when the generic {@code ResourceCollection} was created. + * Subclasses may override this method to provide alternative means of + * instantiating collection members. + * + * @param entry The {@code AtomEntry} corresponding to the member to + * instantiate. + * @return The new member. + */ + protected T createItem(AtomEntry entry) { + return createItem(itemClass, itemPath(entry), namespace(entry)); + } + + /** {@inheritDoc} */ + public Set<Map.Entry<String, T>> entrySet() { + throw new UnsupportedOperationException(); + } + + /** {@inheritDoc} */ + @Override public boolean equals(Object o) { + return validate().items.equals(o); + } + + /** + * Gets the value of a given key, if it exists within this collection. + * + * @param key The key to look up. + * @return The value indexed by the key, or {@code null} if it doesn't + * exist. + * @throws SplunkException The exception to throw if there is more than one + * value represented by this key. + */ + public T get(Object key) { + validate(); + LinkedList<T> entities = items.get(key); + if (entities != null && entities.size() > 1) { + throw new SplunkException(SplunkException.AMBIGUOUS, + "Key has multiple values, specify a namespace"); + } + if (entities == null || entities.size() == 0) return null; + return entities.get(0); + } + + /** + * Gets a the value of a scoped, namespace-constrained key, if it exists + * within this collection. + * + * @param key The key to look up. + * @param namespace The namespace to constrain the search to. + * @return The value indexed by the key, or {@code null} if it doesn't + * exist. + */ + public T get(Object key, Args namespace) { + Util.ensureNamespaceIsExact(namespace); + validate(); + + LinkedList<T> entities = items.get(key); + if (entities == null || entities.size() == 0) return null; + String pathMatcher = service.fullpath("", namespace); + for (T entity: entities) { + if (entity.path.startsWith(pathMatcher)) { + return entity; + } + } + return null; + } + + @Override public int hashCode() { + return validate().items.hashCode(); + } + + /** {@inheritDoc} */ + public boolean isEmpty() { + return validate().items.isEmpty(); + } + + /** + * Returns the value to use as the key from a given Atom entry. + * Subclasses may override this value for collections that use something + * other than "title" as the key. + * + * @param entry The {@code AtomEntry} corresponding to the collection + * member. + * @return The value to use as the member's key. + */ + protected String itemKey(AtomEntry entry) { + return entry.title; + } + + /** + * Returns the value to use as the member's path from a given Atom entry. + * Subclasses may override this value to support alternative methods of + * determining a member's path. + * + * @param entry The {@code AtomEntry} corresponding to the collection + * member. + * @return The value to use as the member's path. + */ + protected String itemPath(AtomEntry entry) { + return entry.links.get("alternate"); + } + + private Args namespace(AtomEntry entry) { + Args namespace = new Args(); + + // no content? return an empty namespace. + if (entry.content == null) + return namespace; + + HashMap<String, String> entityMetadata = + (HashMap<String, String>)entry.content.get("eai:acl"); + + // If there is no ACL info, we just create an empty map + if (entityMetadata == null) { + entityMetadata = new HashMap<String, String>(); + } + + if (entityMetadata.containsKey("owner")) + namespace.put("owner", entityMetadata.get("owner")); + if (entityMetadata.containsKey("app")) + namespace.put("app", entityMetadata.get("app")); + if (entityMetadata.containsKey("sharing")) + namespace.put("sharing", entityMetadata.get("sharing")); + return namespace; + } + + /** {@inheritDoc} */ + public Set<String> keySet() { + return validate().items.keySet(); + } + + /** + * Issues an HTTP request to list the contents of the collection resource. + * + * @return The list response message. + */ + public ResponseMessage list() { + return service.get(path, this.refreshArgs); + } + + /** + * Loads the collection resource from a given Atom feed. + * + * @param value The {@code AtomFeed} instance to load the collection from. + * @return The current {@code ResourceCollection} instance. + */ + ResourceCollection<T> load(AtomFeed value) { + super.load(value); + for (AtomEntry entry : value.entries) { + String key = itemKey(entry); + T item = createItem(entry); + if (items.containsKey(key)) { + LinkedList<T> list = items.get(key); + list.add(item); + } else { + LinkedList<T> list = new LinkedList<T>(); + list.add(item); + items.put(key, list); + } + } + return this; + } + + /** {@inheritDoc} */ + public T put(String key, T value) { + throw new UnsupportedOperationException(); + } + + /** + * Copies all mappings from a given map to this map (unsupported). + * + * @param map The set of mappings to copy into this map. + */ + public void putAll(Map<? extends String, ? extends T> map) { + throw new UnsupportedOperationException(); + } + + /** {@inheritDoc} */ + @Override public ResourceCollection refresh() { + items.clear(); + ResponseMessage response = list(); + assert(response.getStatus() == 200); + + AtomFeed feed = null; + try { + feed = AtomFeed.parseStream(response.getContent()); + } catch (Exception e) { + throw new RuntimeException(e); + } + load(feed); + return this; + } + + /** {@inheritDoc} */ + public T remove(Object key) { + throw new UnsupportedOperationException(); + } + + /** {@inheritDoc} */ + public int size() { + return validate().items.size(); + } + + /** {@inheritDoc} */ + @Override public ResourceCollection<T> validate() { + super.validate(); + return this; + } + + /** {@inheritDoc} */ + public Collection<T> values() { + LinkedList<T> collection = new LinkedList<T>(); + validate(); + Set<String> keySet = items.keySet(); + for (String key: keySet) { + LinkedList<T> list = items.get(key); + for (T item: list) { + collection.add(item); + } + } + return collection; + } + + /** + * Returns the number of values that a specific key represents. + * + * @param key The key to look up. + * @return The number of entity values represented by the key. + */ + public int valueSize(Object key) { + validate(); + LinkedList<T> entities = items.get(key); + if (entities == null || entities.size() == 0) return 0; + return entities.size(); + } +} diff --git a/splunk/com/splunk/ResponseMessage.java b/splunk/src/main/java/com/splunk/ResponseMessage.java similarity index 82% rename from splunk/com/splunk/ResponseMessage.java rename to splunk/src/main/java/com/splunk/ResponseMessage.java index e6fc6b24..6eb50c06 100644 --- a/splunk/com/splunk/ResponseMessage.java +++ b/splunk/src/main/java/com/splunk/ResponseMessage.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -21,8 +21,8 @@ import java.util.TreeMap; /** - * Representation of an HTTP response message including status code, response - * headers and body content. + * The {@code ResponseMessage} class represents an HTTP response message that + * includes status codes, response headers, and body content. */ public class ResponseMessage { int status; @@ -51,7 +51,7 @@ public class ResponseMessage { /** * Returns the body content stream. * - * @return Content stream. + * @return The content stream. */ public InputStream getContent() { return this.content; @@ -64,14 +64,15 @@ public InputStream getContent() { */ public Map<String, String> getHeader() { if (this.header == null) - this.header = new TreeMap<String, String>(String.CASE_INSENSITIVE_ORDER); + this.header = + new TreeMap<String, String>(String.CASE_INSENSITIVE_ORDER); return this.header; } /** * Returns the response status. * - * @return Response status. + * @return The response status. */ public int getStatus() { return this.status; diff --git a/splunk/src/main/java/com/splunk/ResultsReader.java b/splunk/src/main/java/com/splunk/ResultsReader.java new file mode 100644 index 00000000..3ccaee6c --- /dev/null +++ b/splunk/src/main/java/com/splunk/ResultsReader.java @@ -0,0 +1,178 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.util.Iterator; + +/** + * The {@code ResultsReader} class is a base class for the streaming readers + * for Splunk search results. This class should not be used to retrieve preview + * results for an export search. + */ +public abstract class ResultsReader + extends StreamIterableBase<Event> + implements SearchResults { + protected final InputStream inputStream; + // Default should be false which will result in no result set skipping. + boolean isPreview; + boolean isExportStream; + private boolean isInMultiReader; + + ResultsReader(InputStream inputStream, boolean isInMultiReader) + throws IOException { + this.inputStream = inputStream; + isExportStream = inputStream instanceof ExportResultsStream; + this.isInMultiReader = isInMultiReader; + } + + /** + * Closes the reader and returns resources. + * + * @throws IOException On IO exception. + */ + public void close() throws IOException { + inputStream.close(); + } + + /** + * Returns the next event in the event stream. + * + * @return The map of key-value pairs for an event. + * The format of multi-item values is implementation-specific. + * We recommend using the methods from the + * {@link Event} class to interpret multi-item values. + * @throws IOException On IO exception. + */ + final public Event getNextEvent() throws IOException { + return getNextElement(); + } + + /** + * Returns an iterator over the events from this reader. + * @return an Iterator. + */ + @Override + public final Iterator<Event> iterator() { + return super.iterator(); + } + + /** + * Returns the next event while moving to the next set + * automatically when needed, such as concatenating final results + * across multiple sets. + * + * @return null {@code null} if the end is reached. + * @throws IOException On IO exception. + */ + final Event getNextElement() throws IOException { + Event event; + while (true) { + event = getNextEventInCurrentSet(); + + // If we actually managed to get an event, then we break and return it + if (event != null) + break; + + // We don't concatenate across previews across sets, since each set + // might be a snapshot at a given time or a summary result with + // partial data from a reporting search + // (for example "count by host"). So if this is a preview, + // break. Null return indicating the end of the set. + if (isPreview) + break; + + // If we did not advance to next set, i.e. the end of stream is + // reached, break. Null return indicating the end of the set. + if (!advanceStreamToNextSet()) + break; + + // We have advanced to the next set. isPreview is for that set. + // It should not be a preview. Splunk should never return a preview + // after final results which we might have concatenated together + // across sets. + assert (!isPreview) : + "Preview result set should never be after a final set."; + } + return event; + } + + /* + * Get the next event in the current result set. Return null + * if the end is reached. + */ + abstract Event getNextEventInCurrentSet() throws IOException; + + /* + * Return false if the end is reached. + */ + final boolean resetIteratorToNextSet() throws IOException { + + // Get to the beginning of the next set in the stream + // skipping remaining event(s) if any in the current set. + boolean hasMoreResults = advanceStreamToNextSet(); + + // Reset the iterator so that it would either fetch a new + // element for the next iteration or stop. + resetIteration(hasMoreResults); + + return hasMoreResults; + } + + /* + * Return false if the end is reached. + */ + boolean advanceStreamToNextSet() throws IOException { + // Indicate that no more sets are available + // Subclasses can override this method to support + // MultiResultsReader. + return false; + } + + /* + * This method is used by constructors of result readers to do + * the following for single reader: + * 1. Obtain the preview flag and the field list. + * 2. Skip any previews for export. + */ + final void finishInitialization() throws IOException { + if (isInMultiReader) + return; + + while (true) { + // Stop if no more set is available + if (!advanceStreamToNextSet()) { + // Terminating the iteration. + // This avoids future callings into the underlying reader + // to get events, which may result in exceptions. + resetIteration(false); + break; + } + + // No skipping of result sets if the stream + // is not from an export endpoint. + if (!isExportStream) + break; + + // Skipping ends at any file results. + if (!isPreview) + break; + } + } +} diff --git a/splunk/src/main/java/com/splunk/ResultsReaderCsv.java b/splunk/src/main/java/com/splunk/ResultsReaderCsv.java new file mode 100644 index 00000000..64b3dec8 --- /dev/null +++ b/splunk/src/main/java/com/splunk/ResultsReaderCsv.java @@ -0,0 +1,116 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import au.com.bytecode.opencsv.CSVReader; + +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.util.Arrays; +import java.util.Collection; +import java.util.List; + +/** + * The {@code ResultsReaderCsv} class represents a streaming CSV reader for + * Splunk search results. This class requires the opencsv-2.3.jar file in your + * build path. + */ +public class ResultsReaderCsv extends ResultsReader { + + private CSVReader csvReader = null; + private List<String> keys; + + /** + * Class constructor. + * + * Constructs a streaming CSV reader for the event stream. You should only + * attempt to parse a CSV stream with this reader. If you attempt to parse + * a different type of stream, unpredictable results may occur. + * + * @param inputStream The CSV stream to parse. + * @throws IOException The IOException instance + */ + public ResultsReaderCsv(InputStream inputStream) throws IOException { + super(inputStream, false); + if (isExportStream) + throw new UnsupportedOperationException( + "A stream from an export endpoint is not supported " + + "by a CSV result reader. Use XML or JSON search output "+ + "format and matching reader instead." + ); + csvReader = new CSVReader(new InputStreamReader(inputStream, "UTF-8")); + // initial line contains the keyArray, except for oneshot -- which + // contains a blank line, and then the key list. + String[] keyArray = csvReader.readNext(); + if (keyArray.length == 1 && keyArray[0].trim().equals("")) { + keyArray = csvReader.readNext(); + } + keys = Arrays.asList(keyArray); + } + + /** {@inheritDoc} */ + @Override public void close() throws IOException { + super.close(); + if (csvReader != null) + csvReader.close(); + csvReader = null; + } + + /** + * This method is not supported. + * @return Not applicable. + */ + public boolean isPreview(){ + throw new UnsupportedOperationException( + "isPreview() is not supported by this subclass."); + } + + /** {@inheritDoc} */ + public Collection<String> getFields(){ + return keys; + } + + /* + * Multiple result sets are not supported by this reader. + * This function reads the entire stream. + * An application won't reach here with a stream from + * an /export endpoint. The constructor will throw an error in that case. + */ + @Override Event getNextEventInCurrentSet() throws IOException { + Event returnData = null; + String[] line; + + if ((line = csvReader.readNext()) != null) { + if (line.length == 1 && line[0].equals("")) { + line = csvReader.readNext(); + if (line == null) { + return returnData; + } + } + + returnData = new Event(); + int count = 0; + for (String key : keys) { + String delimitedValues = line[count++]; + returnData.putSingleOrDelimited(key, delimitedValues); + } + } + + return returnData; + } +} diff --git a/splunk/src/main/java/com/splunk/ResultsReaderJson.java b/splunk/src/main/java/com/splunk/ResultsReaderJson.java new file mode 100644 index 00000000..6544f614 --- /dev/null +++ b/splunk/src/main/java/com/splunk/ResultsReaderJson.java @@ -0,0 +1,356 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import com.google.gson.stream.JsonReader; +import com.google.gson.stream.JsonToken; + +import java.io.EOFException; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.util.ArrayList; +import java.util.Collection; +import java.util.List; + +/** + * The {@code ResultsReaderJson} class represents a streaming JSON reader for + * Splunk search results. This class requires the gson-2.1.jar file in your + * build path. If you want to access the preview events, use the + * {@link MultiResultsReaderJson} class. + */ +public class ResultsReaderJson extends ResultsReader { + private JsonReader jsonReader; + // Helper object that will only be constructed if the reader is handling + // json format used by export. + private ExportHelper exportHelper; + // Whether the 'preview' flag is read + private boolean previewFlagRead; + + /** + * Class constructor. + * + * Constructs a streaming JSON reader for the event stream. You should only + * attempt to parse a JSON stream with this reader. If you attempt to parse + * a different type of stream, unpredictable results may occur. + * + * @param inputStream The JSON stream to parse. + * @throws IOException The IOException instance + */ + public ResultsReaderJson(InputStream inputStream) throws IOException { + this(inputStream, false); + } + + ResultsReaderJson(InputStream inputStream, boolean isInMultiReader) + throws IOException { + super(inputStream, isInMultiReader); + jsonReader = new JsonReader(new InputStreamReader(inputStream, "UTF-8")); + // if stream is empty, return a null reader. + jsonReader.setLenient(true); + if (isExportStream || isInMultiReader) + exportHelper = new ExportHelper(); + finishInitialization(); + } + + // Advance in the json stream, reading meta data if available, and + // get ready for readEvent method. + // Return false if end of stream is encountered. + boolean advanceIntoNextSetBeforeEvent() throws IOException { + // jsonReader will be set to null once the end is reached. + if (jsonReader == null) + return false; + + // In Splunk 5.0 from the export endpoint, + // each result is in its own top level object. + // In Splunk 5.0 not from the export endpoint, the results are + // an array at that object's key "results". + // In Splunk 4.3, the + // array was the top level returned. So if we find an object + // at top level, we step into it until we find the right key, + // then leave it in that state to iterate over. + try { + // Json single-reader depends on 'isExport' flag to function. + // It does not support a stream from a file saved from + // a stream from an export endpoint. + // Json multi-reader assumes export format thus does not support + // a stream from none export endpoints. + if (exportHelper != null) { + if (jsonReader.peek() == JsonToken.BEGIN_ARRAY) + throw new UnsupportedOperationException( + "A stream from an export endpoint of " + + "a Splunk 4.x server in the JSON output format " + + "is not supported by this class. " + + "Use the XML search output format, " + + "and an XML result reader instead."); + /* + * We're on a stream from an export endpoint + * Below is an example of an input stream. + * {"preview":true,"offset":0,"lastrow":true,"result":{"host":"Andy-PC","count":"62"}} + * {"preview":true,"offset":0,"result":{"host":"Andy-PC","count":"1682"}} + */ + // Read into first result object of the next set. + while (true) { + boolean endPassed = exportHelper.lastRow; + exportHelper.skipRestOfRow(); + if (!exportHelper.readIntoRow()) + return false; + if (endPassed) + break; + } + return true; + } + // Single-reader not from an export endpoint + if (jsonReader.peek() == JsonToken.BEGIN_OBJECT) { + /* + * We're on Splunk 5 with a single-reader not from + * an export endpoint + * Below is an example of an input stream. + * {"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0/etc\""}],"results":[{"sum(kb)":"14372242.758775","series":"twitter"},{"sum(kb)":"267802.333926","series":"splunkd"},{"sum(kb)":"5979.036338","series":"splunkd_access"}]} + */ + jsonReader.beginObject(); + String key; + while (true) { + key = jsonReader.nextName(); + if (key.equals("preview")) + readPreviewFlag(); + else if (key.equals("results")) { + jsonReader.beginArray(); + return true; + } else { + skipEntity(); + } + } + } else { // We're on Splunk 4.x, and we just need to start the array. + /* + * Below is an example of an input stream + * [ + * { + * "sum(kb)":"14372242.758775", + * "series":"twitter" + * }, + * { + * "sum(kb)":"267802.333926", + * "series":"splunkd" + * }, + * { + * "sum(kb)":"5979.036338", + * "series":"splunkd_access" + * } + * ] + */ + jsonReader.beginArray(); + return true; + } + } catch (EOFException e) { + return false; + } + } + + private void readPreviewFlag() throws IOException { + isPreview = jsonReader.nextBoolean(); + previewFlagRead = true; + } + + /** + * Skip the next value, whether it is atomic or compound, in the JSON + * stream. + */ + private void skipEntity() throws IOException { + if (jsonReader.peek() == JsonToken.STRING) { + jsonReader.nextString(); + } else if (jsonReader.peek() == JsonToken.BOOLEAN) { + jsonReader.nextBoolean(); + } else if (jsonReader.peek() == JsonToken.NUMBER) { + jsonReader.nextDouble(); + } else if (jsonReader.peek() == JsonToken.NULL) { + jsonReader.nextNull(); + } else if (jsonReader.peek() == JsonToken.NAME) { + jsonReader.nextName(); + } else if (jsonReader.peek() == JsonToken.BEGIN_ARRAY) { + jsonReader.beginArray(); + while (jsonReader.peek() != JsonToken.END_ARRAY) { + skipEntity(); + } + jsonReader.endArray(); + } else if (jsonReader.peek() == JsonToken.BEGIN_OBJECT) { + jsonReader.beginObject(); + while (jsonReader.peek() != JsonToken.END_OBJECT) { + skipEntity(); + } + jsonReader.endObject(); + } + } + + /** {@inheritDoc} */ + @Override public void close() throws IOException { + super.close(); + if (jsonReader != null) + jsonReader.close(); + jsonReader = null; + } + + /** {@inheritDoc} */ + public boolean isPreview(){ + if (!previewFlagRead) + throw new UnsupportedOperationException( + "isPreview() is not supported " + + "with a stream from a Splunk 4.x server by this class. " + + "Use the XML format and an XML result reader instead."); + return isPreview; + } + + /** + * This method is not supported. + * @return Not applicable. + */ + public Collection<String> getFields(){ + throw new UnsupportedOperationException( + "getFields() is not supported by this subclass."); + } + + @Override Event getNextEventInCurrentSet() throws IOException { + if (exportHelper != null) { + // If the last row has been passed and moveToNextStreamPosition + // has not been called, end the current set. + if (exportHelper.lastRow && !exportHelper.inRow ) { + return null; + } + exportHelper.readIntoRow(); + } + + Event returnData = readEvent(); + + if (exportHelper != null) { + exportHelper.skipRestOfRow(); + return returnData; + } + // Single reader not from export + if (returnData == null) + close(); + return returnData; + } + + private Event readEvent() throws IOException { + Event returnData = null; + String name = null; + List<String> values = new ArrayList<String>(); + + if (jsonReader == null) + return null; + + // Events are almost flat, so no need for a true general parser + // solution. But the Gson parser is a little unintuitive here. Nested + // objects, have their own relative notion of hasNext. This + // means that for every object or array start, hasNext() returns false + // and one must consume the closing (END) object to get back to the + // previous object. + while (jsonReader.hasNext()) { + if (returnData == null) { + returnData = new Event(); + } + if (jsonReader.peek() == JsonToken.BEGIN_OBJECT) { + jsonReader.beginObject(); + } + if (jsonReader.peek() == JsonToken.BEGIN_ARRAY) { + jsonReader.beginArray(); + // The Gson parser is a little unintuitive here. Nested objects, + // have their own relative notion of hasNext; when hasNext() + // is done, it is only for this array. + while (jsonReader.hasNext()) { + JsonToken jsonToken2 = jsonReader.peek(); + if (jsonToken2 == JsonToken.STRING) { + values.add(jsonReader.nextString()); + } + } + jsonReader.endArray(); + + String[] valuesArray = + values.toArray(new String[values.size()]); + returnData.putArray(name, valuesArray); + + values.clear(); + } + if (jsonReader.peek() == JsonToken.NAME) { + name = jsonReader.nextName(); + } + if (jsonReader.peek() == JsonToken.STRING) { + String delimitedValues = jsonReader.nextString(); + returnData.putSingleOrDelimited(name, delimitedValues); + } + if (jsonReader.peek() == JsonToken.END_OBJECT) { + jsonReader.endObject(); + break; + } + if (jsonReader.peek() == JsonToken.END_ARRAY) { + jsonReader.endArray(); + } + } + return returnData; + } + + @Override boolean advanceStreamToNextSet() throws IOException{ + return advanceIntoNextSetBeforeEvent(); + } + + /** + * Contains code only used for streams from the export endpoint. + */ + private class ExportHelper { + // Initial value must be true so that + // the first row is treated as the start of a new set. + boolean lastRow = true; + boolean inRow; + + ExportHelper() { } + + // Return false if end of stream is encountered. + private boolean readIntoRow() throws IOException { + if (inRow) + return true; + if (jsonReader.peek() == JsonToken.END_DOCUMENT) + return false; + inRow = true; + jsonReader.beginObject(); + // lastrow name and value pair does not appear if the row + // is not the last in the set. + lastRow = false; + while (jsonReader.hasNext()) { + String key = jsonReader.nextName(); + if (key.equals("preview")) { + readPreviewFlag(); + } else if (key.equals("lastrow")) { + lastRow = jsonReader.nextBoolean(); + } else if (key.equals("result")) { + return true; + } else { + skipEntity(); + } + } + return false; + } + + private void skipRestOfRow() throws IOException { + if (!inRow) + return; + inRow = false; + while (jsonReader.peek() != JsonToken.END_OBJECT) { + skipEntity(); + } + jsonReader.endObject(); + } + } +} diff --git a/splunk/src/main/java/com/splunk/ResultsReaderXml.java b/splunk/src/main/java/com/splunk/ResultsReaderXml.java new file mode 100644 index 00000000..e242ff8e --- /dev/null +++ b/splunk/src/main/java/com/splunk/ResultsReaderXml.java @@ -0,0 +1,428 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import javax.xml.namespace.QName; +import javax.xml.stream.*; +import javax.xml.stream.events.Attribute; +import javax.xml.stream.events.StartElement; +import javax.xml.stream.events.XMLEvent; +import java.io.*; +import java.nio.ByteBuffer; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Iterator; +import java.util.List; + +/** + * The {@code ResultsReaderXml} class represents a streaming XML reader for + * Splunk search results. When a stream from an export search is passed to this + * reader, it skips any preview events in the stream. If you want to access the + * preview events, use the {@link MultiResultsReaderXml} class. + */ +public class ResultsReaderXml + extends ResultsReader { + + private XMLEventReader xmlReader = null; + private ArrayList<String> fields = new ArrayList<String>(); + private PushbackInputStream pushbackInputStream; + + /** + * Class constructor. + * + * Constructs a streaming XML reader for the event stream. You should only + * attempt to parse an XML stream with this reader. If you attempt to parse + * a different type of stream, unpredictable results may occur. + * <br> + * The pushback reader modifies export streams to generate non-strict XML + * at the beginning of the stream. The streaming reader ignores preview + * data, and only extracts finalized data. + * + * @param inputStream The XML stream to parse. + * @throws IOException The IOException instance + */ + public ResultsReaderXml(InputStream inputStream) throws IOException { + this(inputStream, false); + } + + ResultsReaderXml( + InputStream inputStream, + boolean isInMultiReader) + throws IOException { + super(inputStream, isInMultiReader); + + // We need to do read-ahead, so we have to use a PushbackInputStream for everything + // in this class. + this.pushbackInputStream = new PushbackInputStream(inputStream); + XMLInputFactory inputFactory = XMLInputFactory.newInstance(); + + int ch = this.pushbackInputStream.read(); + if (ch == -1) { + return; // Stream is empty. + } else { + ((PushbackInputStream)this.pushbackInputStream).unread(ch); + } + + inputFactory.setProperty(XMLInputFactory.IS_COALESCING, true); + try { + InputStream filteredStream = new InsertRootElementFilterInputStream(this.pushbackInputStream); + xmlReader = inputFactory.createXMLEventReader(filteredStream); + finishInitialization(); + } catch (XMLStreamException e) { + throw new RuntimeException(e); + } + } + + /** {@inheritDoc} */ + @Override public void close() throws IOException { + if (xmlReader != null) { + try { + xmlReader.close(); + } catch (XMLStreamException e) { + throw new RuntimeException(e); + } + } + xmlReader = null; + + super.close(); + } + + /** {@inheritDoc} */ + public boolean isPreview() { + return isPreview; + } + + /** {@inheritDoc} */ + public Collection<String> getFields() { + return fields; + } + + @Override Event getNextEventInCurrentSet() throws IOException { + // Handle empty stream or other cases where xmlReader is + // not constructed. + if (xmlReader == null) { + return null; + } + try { + Event event = null; + XMLEvent xmlEvent = readToStartOfElementAtSameLevelWithName("result"); + if (xmlEvent != null) { + event = getResultKVPairs(); + } + return event; + } catch (XMLStreamException e) { + throw new RuntimeException(e); + } + } + + // Reads the preview flag and field name list, and position in the middle of + // the result element for reading actual results later. + // Return value indicates whether the next 'results' element is found. + boolean readIntoNextResultsElement() + throws XMLStreamException, IOException { + XMLEvent xmlEvent = readToStartOfElementWithName("results"); + if (xmlEvent == null) { + return false; + } + + if (xmlEvent != null && + xmlEvent.asStartElement() + .getAttributeByName(QName.valueOf("preview")) + .getValue() + .equals("0") ){ + isPreview = false; + } else { + isPreview = true; + } + + // Read <meta> element. + final String meta = "meta"; + if (readToStartOfElementAtSameLevelWithName(meta) != null) { + readFieldOrderElement(); + readToEndElementWithName(meta); + } + return true; + } + + XMLEvent readToStartOfElementWithName(String elementName) + throws XMLStreamException { + while (xmlReader.hasNext()) { + XMLEvent xmlEvent = xmlReader.nextEvent(); + int eType = xmlEvent.getEventType(); + if (eType != XMLStreamConstants.START_ELEMENT){ + continue; + } + + StartElement startElement = xmlEvent.asStartElement(); + if(startElement + .getName() + .getLocalPart() + .equals(elementName)){ + return xmlEvent; + } + } + return null; + } + + void readToEndElementWithName(String elementName) throws XMLStreamException { + XMLEvent xmlEvent; + int eType; + + while (xmlReader.hasNext()) { + xmlEvent = xmlReader.nextEvent(); + eType = xmlEvent.getEventType(); + switch (eType) { + case XMLStreamConstants.START_ELEMENT: + break; + case XMLStreamConstants.END_ELEMENT: + if (xmlEvent.asEndElement() + .getName() + .getLocalPart() + .equals(elementName)) { + return; + } + break; + default: + break; + } + } + + throw new RuntimeException("End tag of " + elementName + " not found."); + } + + /** + * Reads to the next specified start element at the same level. The reader + * stops past that element if it is found. Otherwise, the reader stops + * before the end element of the current level. + * + * @param elementName The name of the start element. + * @return The start element, or {@code null} if not found. + * @throws XMLStreamException + */ + XMLEvent readToStartOfElementAtSameLevelWithName(String elementName) + throws XMLStreamException { + XMLEvent xmlEvent; + int eType; + int level = 0; + while (xmlReader.hasNext()) { + xmlEvent = xmlReader.peek(); + eType = xmlEvent.getEventType(); + switch (eType) { + case XMLStreamConstants.START_ELEMENT: + if (level++ > 0){ + break; + } + StartElement startElement = xmlEvent.asStartElement(); + if (startElement + .getName() + .getLocalPart() + .equals(elementName)) { + xmlReader.nextEvent(); + return xmlEvent; + } + break; + case XMLStreamConstants.END_ELEMENT: + if (level-- == 0) { + return null; + } + break; + default: + break; + } + xmlReader.nextEvent(); + } + + throw new RuntimeException("Parent end element not found:" + elementName); + } + + // At the end, move off the end element of 'fieldOrder' + private void readFieldOrderElement() + throws IOException, XMLStreamException { + XMLEvent xmlEvent; + int eType; + int level = 0; + + if (readToStartOfElementAtSameLevelWithName("fieldOrder") == null) + return; + + while (xmlReader.hasNext()) { + xmlEvent = xmlReader.nextEvent(); + eType = xmlEvent.getEventType(); + switch (eType) { + case XMLStreamConstants.START_ELEMENT: + level++; + break; + case XMLStreamConstants.END_ELEMENT: + if (xmlEvent.asEndElement() + .getName() + .getLocalPart() + .equals("fieldOrder")) { + return; + } + level--; + break; + case XMLStreamConstants.CHARACTERS: + if (level == 1) { + fields.add(xmlEvent.asCharacters().getData()); + } + break; + default: + break; + } + } + + throw new RuntimeException("End tag of fieldOrder not found."); + } + + // At the end, move off the end tag of 'result' + private Event getResultKVPairs() + throws IOException, XMLStreamException { + + Event returnData = new Event(); + XMLEvent xmlEvent; + int eType; + String key = null; + List<String> values = new ArrayList<String>(); + int level = 0; + + // Event results are flat, so extract k/v pairs based on XML indentation + // level throwing away the uninteresting non-data. + + while (xmlReader.hasNext()) { + xmlEvent = xmlReader.nextEvent(); + eType = xmlEvent.getEventType(); + switch (eType) { + case XMLStreamConstants.START_ELEMENT: + final StartElement startElement = xmlEvent.asStartElement(); + @SuppressWarnings("unchecked") + Iterator<Attribute> attrIttr = + startElement.getAttributes(); + if (level == 0) { + if (attrIttr.hasNext()) + key = attrIttr.next().getValue(); + } else if (level == 1 && + key.equals("_raw") && + startElement + .getName() + .getLocalPart() + .equals("v")) { + StringBuilder asString = new StringBuilder(); + StringWriter asXml = new StringWriter(); + readSubtree(startElement, asString, asXml); + values.add(asString.toString()); + returnData.putSegmentedRaw(asXml.toString()); + level--; + } + level++; + break; + case XMLStreamConstants.END_ELEMENT: + if (xmlEvent.asEndElement() + .getName() + .getLocalPart() + .equals("result")) + return returnData; + + if (--level == 0) { + String[] valuesArray = + values.toArray(new String[values.size()]); + returnData.putArray(key, valuesArray); + + key = null; + values.clear(); + } + break; + case XMLStreamConstants.CHARACTERS: + if (level > 1) { + values.add(xmlEvent.asCharacters().getData()); + } + break; + default: + break; + } + } + + throw new RuntimeException("End tag of 'result' not found."); + } + + @Override boolean advanceStreamToNextSet() throws IOException { + // Handle empty stream or other cases where xmlReader is + // not constructed. + if (xmlReader == null) { + return false; + } + try { + return readIntoNextResultsElement(); + } catch (XMLStreamException e) { + throw new RuntimeException(e); + } catch (NullPointerException e) { + // Invalid xml (<doc> and multiple <results> may results in + // this exception in the xml reader with JDK 1.7 at: + // com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1748) + return false; + } catch (ArrayIndexOutOfBoundsException e) { + // Invalid xml (<doc> and multiple <results> may results in + // this exception in the xml reader with JDK 1.6 at: + // com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.endEntity(XMLDocumentFragmentScannerImpl.java:904) + return false; + } + } + + /** + * Read the whole element including those contained in the outer element. + * @param startElement start element (tag) of the outer element. + * @param asString output builder that the element's inner-text + * will be appended to, with markup removed and + * characters un-escaped + * @param asXml output builder that full xml including markups + * will be appended to. Characters are escaped as + * needed. + * @throws IOException + * @throws XMLStreamException + */ + void readSubtree( + StartElement startElement, + StringBuilder asString, + StringWriter asXml) + throws IOException, XMLStreamException { + XMLEventWriter xmlWriter = XMLOutputFactory.newInstance(). + createXMLEventWriter(asXml); + XMLEvent xmlEvent = startElement; + int level = 0; + do { + xmlWriter.add(xmlEvent); + int eType = xmlEvent.getEventType(); + switch (eType) { + case XMLStreamConstants.START_ELEMENT: + level++; + break; + case XMLStreamConstants.END_ELEMENT: + if (--level == 0) { + xmlWriter.close(); + return; + } + break; + case XMLStreamConstants.CHARACTERS: + asString.append(xmlEvent.asCharacters().getData()); + default: + break; + } + xmlEvent = xmlReader.nextEvent(); + } while (xmlReader.hasNext()); + throw new RuntimeException("Invalid XML format."); + } +} + diff --git a/splunk/src/main/java/com/splunk/Role.java b/splunk/src/main/java/com/splunk/Role.java new file mode 100644 index 00000000..5de4dc9a --- /dev/null +++ b/splunk/src/main/java/com/splunk/Role.java @@ -0,0 +1,421 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code Role} class represents a Splunk role, which is a collection of + * permissions and capabilities. The user's role determines what the user can + * see and interact with in Splunk. + */ +public class Role extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The role endpoint. + */ + Role(Service service, String path) { + super(service, path); + } + + /** + * Returns an array of capabilities assigned to this role. + * + * @return An array of capabilities. + */ + public String[] getCapabilities() { + return getStringArray("capabilities"); + } + + /** + * Returns the app to use as the default app for this role. The user + * can override this setting. + * + * @return The default app for this role. + */ + public String getDefaultApp() { + return getString("defaultApp", null); + } + + /** + * Returns an array of capabilities imported for this role. + * + * @return An array of imported capabilities. + */ + public String[] getImportedCapabilities() { + return getStringArray("imported_capabilities", null); + } + + /** + * Returns an array of roles to import attributes from, such as capabilities + * and allowed indexes to search. + * + * @return An array of imported roles. + */ + public String[] getImportedRoles() { + return getStringArray("imported_roles", null); + } + + /** + * Returns the maximum number of concurrent real-time search jobs a user + * with this role is allowed to run. + * + * @return The imported quota for real-time search jobs. + * @deprecated Use {@link #getImportedRealTimeSearchJobsQuota()} instead. + */ + public int getImportedRtSearchJobsQuota() { + return getInteger("imported_rtSrchJobsQuota"); + } + + /** + * Returns the maximum number of concurrent real-time search jobs a user + * with this role is allowed to run. + * + * @return The imported quota for real-time search jobs. + */ + public int getImportedRealTimeSearchJobsQuota() { + return getImportedRtSearchJobsQuota(); + } + + /** + * Returns the maximum disk space that can be used for search jobs by a user + * with this role. + * + * @return The imported search disk quota, in megabytes. + */ + public int getImportedSearchDiskQuota() { + return getInteger("imported_srchDiskQuota"); + } + + /** + * Returns a search string that restricts the scope of searches run by this + * role. Only those events that also match this search string are shown to + * the user. If a user has multiple roles with different search filters, + * they are combined with an {@code OR}. + * + * @return The imported search filter. + */ + public String getImportedSearchFilter() { + return getString("imported_srchFilter", null); + } + + /** + * Returns an array of indexes that a user with this role has permissions to + * search. + * + * @return The imported array of allowed indexes. + */ + public String[] getImportedIndexesAllowed() { + return getStringArray("imported_srchIndexesAllowed", null); + } + + /** + * Returns an array of indexes to search by default when no index is + * specified for a user with this role. + * + * @return The imported array of default indexes. + */ + public String[] getImportedIndexesDefault() { + return getStringArray("imported_srchIndexesDefault", null); + } + + /** + * Returns the maximum number of concurrent searches a user with this role + * is allowed to run. + * + * @return The imported quota for normal search jobs. + */ + public int getImportedSearchJobsQuota() { + return getInteger("imported_srchJobsQuota"); + } + + /** + * Returns the maximum time span of a search, in seconds. + * + * @return The maximum time span of a search, in seconds. + */ + public int getImportedSearchTimeWindow() { + return getInteger("imported_srchTimeWin"); + } + + /** + * Returns the maximum number of concurrent real-time search jobs a user + * with this role is allowed to run. + * + * @return Maximum number of concurrent real-time search jobs. + * @deprecated Use {@link #getRealTimeSearchJobsQuota()} instead. + */ + public int getRtSearchJobsQuota() { + return getInteger("rtSrchJobsQuota"); + } + + /** + * Returns the maximum number of concurrent real-time search jobs a user + * with this role is allowed to run. + * + * @return Maximum number of concurrent real-time search jobs. + */ + public int getRealTimeSearchJobsQuota() { + return getRtSearchJobsQuota(); + } + + /** + * Returns the maximum disk space that can be used for search jobs by a user + * with this role. + * + * @return Maximum disk space usage, in megabytes. + */ + public int getSearchDiskQuota() { + return getInteger("srchDiskQuota"); + } + + /** + * Returns a search string that restricts the scope of searches run by this + * role. Only those events that also match this search string are shown to + * the user. If a user has multiple roles with different search filters, + * they are combined with an OR. + * + * @return The search filter. + */ + public String getSearchFilter() { + return getString("srchFilter", null); + } + + /** + * Returns an array of indexes that a user with this role has permissions + * to search. + * + * @return An array of allowed indexes. + */ + public String[] getSearchIndexesAllowed() { + return getStringArray("srchIndexesAllowed", null); + } + + /** + * Returns an array of indexes to search by default when no index is + * specified for a user with this role. + * + * @return An array of default indexes. + */ + public String[] getSearchIndexesDefault() { + return getStringArray("srchIndexesDefault", null); + } + + /** + * Returns the maximum number of concurrent searches a user with this role + * is allowed to run. + * + * @return The quota for normal search jobs. + */ + public int getSearchJobsQuota() { + return getInteger("srchJobsQuota"); + } + + /** + * Returns the maximum time span of a search that is allowed for users in + * this role. + * + * @return Maximum time span of a search, in seconds. + * @deprecated Use {@link #getSearchTimeWindow()} instead. + */ + public int getSearchTimeWin() { + return getInteger("srchTimeWin"); + } + + /** + * Returns the maximum time span of a search that is allowed for users in + * this role. + * + * @return Maximum time span of a search, in seconds. + */ + public int getSearchTimeWindow() { + return getSearchTimeWin(); + } + + /** + * Assigns an array of capabilities to this role. For a list of possible + * capabilities, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7#capabilities" + * target="_blank">Capabilities</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7" + * target="_blank">dev.splunk.com</a>. + * + * @param capabilities An array of capabilities. + */ + public void setCapabilities(String[] capabilities) { + setCacheValue("capabilities", capabilities); + } + + /** + * Assigns a single capability to this role. + * For a list of possible capabilities, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7#capabilities" + * target="_blank">Capabilities</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7" + * target="_blank">dev.splunk.com</a>. + * + * @param capability The capability to set. + */ + public void setCapabilities(String capability) { + setCapabilities(new String[] { capability }); + } + + /** + * Sets the default app for this role. + * + * @param defaultApp The default app (the name of the folder that contains + * the app). + */ + public void setDefaultApp(String defaultApp) { + setCacheValue("defaultApp", defaultApp); + } + + /** + * Sets a list of roles to import attributes from, such as capabilities and + * allowed indexes to search. In combining multiple roles, the effective + * value for each attribute is the value with the broadest permissions. + * <p> + * Default Splunk roles are:</p> + * <ul> + * <li>admin</li> + * <li>can_delete</li> + * <li>power</li> + * <li>user</li> + * </ul><p> + * You also can specify additional roles that have been created.</p> + * + * @param importedRoles An array of roles from which to import attributes. + */ + public void setImportedRoles(String[] importedRoles) { + setCacheValue("imported_roles", importedRoles); + } + + /** + * Sets a role to import attributes from, such as capabilities and allowed + * indexes to search. Use this method to set a single role. + * <p>Importing other roles imports all aspects of that role, such as + * capabilities and allowed indexes to search. </p> + * <p> + * Default Splunk roles are:</p> + * <ul> + * <li>admin</li> + * <li>can_delete</li> + * <li>power</li> + * <li>user</li> + * </ul><p> + * You also can specify additional roles that have been created.</p> + * + * @param importedRole A role from which to import attributes. + */ + public void setImportedRoles(String importedRole) { + setImportedRoles(new String[] { importedRole }); + } + + /** + * Sets the maximum number of concurrent real-time search jobs a user with + * this role is allowed to run. This count is independent from the normal + * search jobs limit. + * + * @param numJobs The maximum number of real-time search jobs. + */ + public void setRealTimeSearchJobsQuota(int numJobs) { + setCacheValue("rtSrchJobsQuota", numJobs); + } + + /** + * Sets the maximum disk space that can be used for search jobs by a user + * with this role. + * + * @param srchDiskQuota The maximum disk space to allocate, in megabytes. + */ + public void setSearchDiskQuota(int srchDiskQuota) { + setCacheValue("srchDiskQuota", srchDiskQuota); + } + + /** + * Sets a search string that restricts the scope of searches run by this + * role. Search results for this role only show events that also match the + * search string you specify. In the case that a user has multiple roles + * with different search filters, they are combined with an {@code OR}. + * + * @param srchFilter The restrictive search string. + */ + public void setSearchFilter(String srchFilter) { + setCacheValue("srchFilter", srchFilter); + } + + /** + * Sets the indexes that a user with this role has permissions to search. + * + * @param indexesAllowed An array of allowed indexes. + */ + public void setSearchIndexesAllowed(String[] indexesAllowed) { + setCacheValue("srchIndexesAllowed", indexesAllowed); + } + + /** + * Sets the index that a user with this role has permissions to search. Use + * this method to set a single index. + * + * @param indexAllowed The allowed index. + */ + public void setSearchIndexesAllowed(String indexAllowed) { + setSearchIndexesAllowed(new String[] { indexAllowed }); + } + + /** + * Sets the indexes to search by default when no index is specified for a + * user with this role. + * + * @param srchIndexesDefault An array of default indexes. + */ + public void setSearchIndexesDefault(String[] srchIndexesDefault) { + setCacheValue("srchIndexesDefault", srchIndexesDefault); + } + + /** + * Sets the index to search by default when no index is specified for a + * user with this role. Use this method to set a single default index. + * + * @param srchIndexDefault The default index. + */ + public void setSearchIndexesDefault(String srchIndexDefault) { + setSearchIndexesDefault(new String[] { srchIndexDefault }); + } + + /** + * Sets the maximum number of concurrent searches a user with this role is + * allowed to run. In the event of many roles per user, the maximum of + * these quotas is applied. + * + * @param srchJobsQuota The maximum number of concurrent jobs. + */ + public void setSearchJobsQuota(int srchJobsQuota) { + setCacheValue("srchJobsQuota", srchJobsQuota); + } + + /** + * Sets the maximum time span of a search that is allowed for users in this + * role. + * + * @param srchTimeWin The maximum time span of a search, in seconds. + */ + public void setSearchTimeWindow(int srchTimeWin) { + setCacheValue("srchTimeWin", srchTimeWin); + } +} diff --git a/splunk/src/main/java/com/splunk/SSLSecurityProtocol.java b/splunk/src/main/java/com/splunk/SSLSecurityProtocol.java new file mode 100644 index 00000000..8e223cac --- /dev/null +++ b/splunk/src/main/java/com/splunk/SSLSecurityProtocol.java @@ -0,0 +1,16 @@ +package com.splunk; + +public enum SSLSecurityProtocol { + TLSv1_2 { + public String toString() { return "TLSv1.2"; } + }, + TLSv1_1 { + public String toString() { return "TLSv1.1"; } + }, + TLSv1 { + public String toString() { return "TLSv1"; } + }, + SSLv3 { + public String toString() { return "SSLv3"; } + } +} diff --git a/splunk/src/main/java/com/splunk/SavedSearch.java b/splunk/src/main/java/com/splunk/SavedSearch.java new file mode 100644 index 00000000..b01fe17d --- /dev/null +++ b/splunk/src/main/java/com/splunk/SavedSearch.java @@ -0,0 +1,2261 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; +import java.util.Map; + +/** + * The {@code SavedSearch} class represents a saved search. + */ +public class SavedSearch extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The saved searches endpoint. + */ + SavedSearch(Service service, String path) { + super(service, path); + } + + /** + * Acknowledges the suppression of alerts from this saved search + * and resumes alerting. + */ + public void acknowledge() { + service.post(actionPath("acknowledge")); + invalidate(); + } + + /** {@inheritDoc} */ + @Override protected String actionPath(String action) { + if (action.equals("acknowledge")) + return path + "/acknowledge"; + if (action.equals("dispatch")) + return path + "/dispatch"; + if (action.equals("history")) + return path + "/history"; + return super.actionPath(action); + } + + /** + * Runs the saved search. + * + * @return The search job. + * @throws InterruptedException The InterruptedException instance + */ + public Job dispatch() throws InterruptedException { + return dispatch(null); + } + + /** + * Runs the saved search using dispatch arguments. + * + * @param args Dispatch arguments: <ul> + * <li>"dispatch.now": A time string that is used to dispatch the search as + * though the specified time were the current time.</li> + * <li>"dispatch.*": Overwrites the value of the search field specified in + * "*".</li> + * <li>"trigger_actions": A Boolean that indicates whether to trigger alert + * actions.</li> + * <li>"force_dispatch": A Boolean that indicates whether to start a new + * search if another instance of this search is already running.</li></ul> + * @return The search job. + * @throws InterruptedException The InterruptedException instance + */ + public Job dispatch(Map args) throws InterruptedException { + ResponseMessage response = service.post(actionPath("dispatch"), args); + invalidate(); + String sid = Job.getSid(response); + + Job job = service.getJob(sid); + + // if job not yet scheduled, create an empty job object + if (job == null) { + job = new Job(service, JobCollection.REST_PATH + "/" + sid); + } + + return job; + } + + /** + * Runs the saved search using dispatch arguments. + * + * @param args Dispatch arguments (see {@link SavedSearchDispatchArgs}). + * @return The search job. + * @throws InterruptedException The InterruptedException instance + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public Job dispatch(SavedSearchDispatchArgs args) throws InterruptedException { + return dispatch((Map<String, Object>) args); + } + + /** + * Returns an array of search jobs created from this saved search. + * + * @return An array of search jobs. + */ + public Job[] history() { + ResponseMessage response = service.get(actionPath("history")); + AtomFeed feed; + return parseHistoryResponse(response); + } + + /** + * Returns an array of search jobs based on passed search arguments + * + * @param args + * @return An array of search jobs + */ + public Job[] history(Map<String, Object> args) { + ResponseMessage response = service.get(actionPath("history"), args); + return parseHistoryResponse(response); + } + + /** + * Parses response message from history action path + * + * @param response + * @return result An array of Job + */ + private Job[] parseHistoryResponse(final ResponseMessage response) { + AtomFeed feed; + try { + feed = AtomFeed.parseStream(response.getContent()); + } catch (Exception e) { + throw new RuntimeException(e); + } + int count = feed.entries.size(); + Job[] result = new Job[count]; + for (int i = 0; i < count; ++i) { + String sid = feed.entries.get(i).title; + result[i] = new Job(service, JobCollection.REST_PATH + "/" + sid); + } + return result; + } + + /** + * Returns the email password. + * + * @return The email password. + */ + public String getActionEmailAuthPassword() { + return getString("action.email.auth_password", null); + } + + /** + * Returns the email username. + * + * @return The email username. + */ + public String getActionEmailAuthUsername() { + return getString("action.email.auth_username", null); + } + + /** + * Returns the blind carbon copy (BCC) email address. + * + * @return The BCC address. + */ + public String getActionEmailBcc() { + return getString("action.email.bcc", null); + } + + /** + * Returns the carbon copy (CC) email address. + * + * @return The CC address. + */ + public String getActionEmailCc() { + return getString("action.email.cc", null); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @return The search command (or pipeline). + */ + public String getActionEmailCommand() { + return getString("action.email.command", null); + } + + /** + * Returns the format of text in the email. This value also applies to any + * attachments formats. Valid values are: "plain", "html", "raw", and "csv". + * + * @return The email format. + */ + public String getActionEmailFormat() { + return getString("action.email.format", null); + } + + /** + * Returns the email sender's name. + * + * @return The sender's name. + */ + public String getActionEmailFrom() { + return getString("action.email.from", null); + } + + /** + * Returns the host name used in the web link (URL) that is sent in email + * alerts. + * + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @return The host name used in the URL. + */ + public String getActionEmailHostname() { + return getString("action.email.hostname", null); + } + + /** + * Indicates whether the search results are contained in the body of the + * email. + * + * @return {@code true} if search results are contained in the body of the + * email, {@code false} if not. + */ + public boolean getActionEmailInline() { + return getBoolean("action.email.inline", false); + } + + /** + * Returns the address of the MTA server that is used to send the emails. If + * this attribute is not set, this value defaults to the setting in the + * alert_actions.conf file. + * + * @return The address of the MTA server. + */ + public String getActionEmailMailServer() { + return getString("action.email.mailserver", null); + } + + /** + * Returns the maximum number of search results to send in email alerts. + * + * @return The maximum number of search results per email. + */ + public int getActionEmailMaxResults() { + return getInteger("action.email.maxresults", -1); + } + + /** + * Returns the maximum amount of time an email action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The maximum amount of time. + */ + public String getActionEmailMaxTime() { + return getString("action.email.maxtime", null); + } + + /** + * Returns the name of the view to deliver if {@code ActionEmailSendPdf} is + * enabled. + * @see #getActionEmailSendPdf + * + * @return The name of the PDF view. + */ + public String getActionEmailPdfView() { + return getString("action.email.pdfview", null); + } + + /** + * Returns the search string for pre-processing results before emailing + * them. Usually preprocessing consists of filtering out unwanted internal + * fields. + * + * @return The search string for pre-processing results. + */ + public String getActionEmailPreProcessResults() { + return getString("action.email.preprocess_results", null); + } + + /** + * Returns the paper orientation. Valid values are "portrait" and + * "landscape". + * + * @return The paper orientation. + */ + public String getActionEmailReportPaperOrientation() { + return getString("action.email.reportPaperOrientation", null); + } + + /** + * Returns the paper size for PDFs. Valid values are: + * "letter", "legal", "ledger", "a2", "a3", "a4", and "a5". + * + * @return The paper size. + */ + public String getActionEmailReportPaperSize() { + return getString("action.email.reportPaperSize", null); + } + + /** + * Indicates whether the PDF server is enabled. + * + * @return {@code true} if the PDF server is enabled, {@code false} if not. + */ + public boolean getActionEmailReportServerEnabled() { + return getBoolean("action.email.reportServerEnabled", false); + } + + /** + * Returns the URL of the PDF report server, if one is set up and available + * on the network. + * + * @return The URL of the PDF report server. + */ + public String getActionEmailReportServerUrl() { + return getString("action.email.reportServerURL", null); + } + + /** + * Indicates whether to create and send the results in PDF format. + * + * @return {@code true} if results are sent in PDF format, {@code false} if + * not. + */ + public boolean getActionEmailSendPdf() { + return getBoolean("action.email.sendpdf", false); + } + + /** + * Indicates whether search results are attached to an email. + * + * @return {@code true} if search results are attached to an email, + * {@code false} if not. + */ + public boolean getActionEmailSendResults() { + return getBoolean("action.email.sendresults", false); + } + + /** + * Returns the subject line of the email. + * + * @return The subject line of the email. + */ + public String getActionEmailSubject() { + return getString("action.email.subject", null); + } + + /** + * Returns a list of email recipients. + * + * @return A comma- or semicolon-delimited list of email recipients. + */ + public String getActionEmailTo() { + return getString("action.email.to", null); + } + + /** + * Indicates whether running this email action results in a trackable alert. + * + * @return {@code true} for a trackable alert, {@code false} if not. + */ + public boolean getActionEmailTrackAlert() { + return getBoolean("action.email.track_alert", false); + } + + /** + * Returns the minimum time-to-live (ttl) of search artifacts if + * this email action is triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @return The minimum time-to-live in seconds, or the number of scheduled + * periods. + */ + public String getActionEmailTtl() { + return getString("action.email.ttl", null); + } + + /** + * Indicates whether to use secure socket layer (SSL) when communicating + * with the SMTP server. + * + * @return {@code true} if SSL is used, {@code false} if not. + */ + public boolean getActionEmailUseSsl() { + return getBoolean("action.email.use_ssl", false); + } + + /** + * Indicates whether to use transport layer security (TLS) when + * communicating with the SMTP server. + * + * @return {@code true} if TLS is used, {@code false} if not. + */ + public boolean getActionEmailUseTls() { + return getBoolean("action.email.use_tls", false); + } + + /** + * Indicates whether columns should be sorted from least wide to most wide, + * left to right. + * This value is only used when {@code ActionEmailFormat} is "plain". + * @see #getActionEmailFormat + * + * @return {@code true} if columns are sorted from least wide to most wide, + * {@code false} if not. + */ + public boolean getActionEmailWidthSortColumns() { + return getBoolean("action.email.width_sort_columns", false); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * + * @return The search command (or pipeline). + */ + public String getActionPopulateLookupCommand() { + return getString("action.populate_lookup.command", null); + } + + /** + * Returns the name of the lookup table or lookup path to populate. + * + * @return The lookup name or path. + */ + public String getActionPopulateLookupDest() { + return getString("action.populate_lookup.dest", null); + } + + /** + * Returns the host name used in the web link (URL) that is sent in + * populate-lookup alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @return The hostname used in the URL. + */ + public String getActionPopulateLookupHostname() { + return getString("action.populate_lookup.hostname", null); + } + + /** + * Returns the maximum number of search results to send in populate-lookup + * alerts. + * + * @return The maximum number of search results per alert. + */ + public int getActionPopulateLookupMaxResults() { + return getInteger("action.populate_lookup.maxresults", -1); + } + + /** + * Returns the maximum amount of time an alert action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The maximum amount of time. + */ + public String getActionPopulateLookupMaxTime() { + return getString("action.populate_lookup.maxtime", null); + } + + /** + * Indicates whether running this populate-lookup action results in a + * trackable alert. + * + * @return {@code true} for a trackable alert, {@code false} if not. + */ + public boolean getActionPopulateLookupTrackAlert() { + return getBoolean("action.populate_lookup.track_alert", false); + } + + /** + * Returns the minimum time-to-live (ttl) of search artifacts if + * this populate-lookup action is triggered. If the value is a number + * followed by "p", it is the number of scheduled search periods. + * + * @return The minimum time-to-live in seconds, or the number of scheduled + * periods. + */ + public String getActionPopulateLookupTtl() { + return getString("action.populate_lookup.ttl", null); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * + * @return The search command (or pipeline). + */ + public String getActionRssCommand() { + return getString("action.rss.command", null); + } + + /** + * Returns the host name used in the web link (URL) that is sent in RSS + * alerts. + * + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @return The host name used in the URL. + */ + public String getActionRssHostname() { + return getString("action.rss.hostname", null); + } + + /** + * Returns the maximum number of search results to send in RSS alerts. + * + * @return The maximum number of search results per alert. + */ + public int getActionRssMaxResults() { + return getInteger("action.rss.maxresults", -1); + } + + /** + * Returns the maximum amount of time an RSS alert action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The maximum amount of time. + */ + public String getActionRssMaxTime() { + return getString("action.rss.maxtime", null); + } + + /** + * Indicates whether running this RSS action results in a trackable alert. + * + * @return {@code true} for a trackable alert, {@code false} if not. + */ + public boolean getActionRssTrackAlert() { + return getBoolean("action.rss.track_alert", false); + } + + /** + * Returns the minimum time-to-live (ttl) of search artifacts if + * this RSS action is triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @return The minimum time-to-live in seconds, or the number of scheduled + * periods. + */ + public String getActionRssTtl() { + return getString("action.rss.ttl", null); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * + * @return The search command (or pipeline). + */ + public String getActionScriptCommand() { + return getString("action.script.command", null); + } + + /** + * Returns the filename of the script to call. + * + * @return The filename of the script. + */ + public String getActionScriptFilename() { + return getString("action.script.filename", null); + } + + /** + * Returns the host name used in the web link (URL) that is sent in script + * alerts. + * + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @return The host name used in the URL. + */ + public String getActionScriptHostname() { + return getString("action.script.hostname", null); + } + + /** + * Returns the maximum number of search results to send in script alerts. + * + * @return The maximum number of search results per alert. + */ + public int getActionScriptMaxResults() { + return getInteger("action.script.maxresults", -1); + } + + /** + * Returns the maximum amount of time a script action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The maximum amount of time. + */ + public String getActionScriptMaxTime() { + return getString("action.script.maxtime", null); + } + + /** + * Indicates whether running this script action results in a trackable + * alert. + * + * @return {@code true} for a trackable alert, {@code false} if not. + */ + public boolean getActionScriptTrackAlert() { + return getBoolean("action.script.track_alert", false); + } + + /** + * Returns the minimum time-to-live (ttl) of search artifacts if + * this script action is triggered. If the value is a number followed by + * "p", it is the number of scheduled search periods. + * + * @return The minimum time-to-live in seconds, or the number of scheduled + * periods. + */ + public String getActionScriptTtl() { + return getString("action.script.ttl", null); + } + + /** + * Returns the name of the summary index where the results of the scheduled + * search are saved. + * + * @return The name of the summary index. + */ + public String getActionSummaryIndexName() { + return getString("action.summary_index._name", null); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @return The search command (or pipeline). + */ + public String getActionSummaryIndexCommand() { + return getString("action.summary_index.command", null); + } + + /** + * Returns the host name used in the web link (URL) that is sent in + * summary-index alerts. + * + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @return The host name used in the URL. + */ + public String getActionSummaryIndexHostname() { + return getString("action.summary_index.hostname", null); + } + + /** + * Indicates whether to run the summary indexing action as part of the + * scheduled search. + * + * @return {@code true} if the summary indexing action runs with the + * scheduled search, {@code false} if not. + */ + public boolean getActionSummaryIndexInline() { + return getBoolean("action.summary_index.inline", false); + } + + /** + * Returns the maximum number of search results to send in summary-index + * alerts. + * + * @return The maximum number of search results per alert. + */ + public int getActionSummaryIndexMaxResults() { + return getInteger("action.summary_index.maxresults", -1); + } + + /** + * Returns the maximum amount of time a summary action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The maximum amount of time. + */ + public String getActionSummaryIndexMaxTime() { + return getString("action.summary_index.maxtime", null); + } + + /** + * Indicates whether running this summary-index action results in a + * trackable alert. + * + * @return {@code true} for a trackable alert, {@code false} if not. + */ + public boolean getActionSummaryIndexTrackAlert() { + return getBoolean("action.summary_index.track_alert", false); + } + + /** + * Returns the minimum time-to-live (ttl) of search artifacts if + * a summary-index action is triggered. If the value is a number followed by + * "p", it is the number of scheduled search periods. + * + * @return The minimum time-to-live in seconds, or the number of scheduled + * periods. + */ + public String getActionSummaryIndexTtl() { + return getString("action.summary_index.ttl", null); + } + + /** + * Indicates whether Splunk applies the alert actions to the entire result + * set (digest) or to each individual search result (per result). + * + * @return {@code true} if Splunk applies the alert actions to the entire + * result set (digest), {@code false} if actions are applied to individual + * search results (per result). + */ + public boolean getAlertDigestMode() { + return getBoolean("alert.digest_mode", false); + } + + /** + * Returns the amount of time to show the alert in the dashboard. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @return The amount of time. + */ + public String getAlertExpires() { + return getString("alert.expires"); + } + + /** + * Returns the alert severity level. Valid values are: + * {@code 1=DEBUG, 2=INFO, 3=WARN, 4=ERROR, 5=SEVERE, 6=FATAL}. + * + * @return The alert severity level. + */ + public int getAlertSeverity() { + return getInteger("alert.severity"); + } + + /** + * Indicates whether alert suppression is enabled for this search. + * + * @return {@code true} if alert suppression is enabled for this + * search, {@code false} if not. + */ + public boolean getAlertSuppress() { + return getBoolean("alert.suppress", false); + } + + /** + * Returns a list of fields to use for alert suppression. + * + * @return A comma-delimited list of fields. + */ + public String getAlertSuppressFields() { + return getString("alert.suppress.fields", null); + } + + /** + * Returns the alert suppression period, which is only valid if + * {@code AlertSuppress} is enabled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * @see #getAlertSuppress + * + * @return The alert suppression period. + */ + public String getAlertSuppressPeriod() { + return getString("alert.suppress.period", null); + } + + /** + * Returns a value that indicates how to track the actions triggered + * by this saved search. Valid values are: "true" (enabled), "false" + * (disabled), and "auto" (tracking is based on the setting of each action). + * + * @return The alert tracking setting. + */ + public String getAlertTrack() { + return getString("alert.track"); + } + + /** + * Returns the alert comparator. Valid values are: "greater than", "less + * than", "equal to", "rises by", "drops by", "rises by perc", and "drops by + * perc". + * + * @return The alert comparator. + */ + public String getAlertComparator() { + return getString("alert_comparator", null); + } + + /** + * Returns a conditional search that is evaluated against the results of + * the saved search. + * + * @return A conditional search string. + */ + public String getAlertCondition() { + return getString("alert_condition", null); + } + + /** + * Returns the value to compare to before triggering the alert action. + * If this value is expressed as a percentage, it indicates the value to use + * when {@code AlertComparator} is set to "rises by perc" or "drops by + * perc." + * @see #getAlertComparator + * + * @return The alert threshold value. + */ + public String getAlertThreshold() { + return getString("alert_threshold", null); + } + + /** + * Returns a value that indicates what to base the alert on. Valid values + * are: "always", "custom", "number of events", "number of hosts", and + * "number of sources". This value is overridden by {@code AlertCondition} + * if specified. + * + * @see #getAlertCondition + * + * @return The alert trigger type. + */ + public String getAlertType() { + return getString("alert_type"); + } + + /** + * Returns the cron-style schedule for running this saved search. + * + * @return The schedule, as a valid cron-style string. + */ + public String getCronSchedule() { + return getString("cron_schedule", null); + } + + /** + * Returns a description of this saved search. + * + * @return A description of the saved search. + */ + public String getDescription() { + return getString("description", null); + } + + /** + * Returns the maximum number of timeline buckets. + * + * @return The maximum number of timeline buckets. + */ + public int getDispatchBuckets() { + return getInteger("dispatch.buckets"); + } + + /** + * Returns the earliest time for this search. This value can be a relative + * or absolute time (as formatted by {@code DispatchTimeFormat}). + * @see #getDispatchTimeFormat + * + * @return The earliest time for this search. + */ + public String getDispatchEarliestTime() { + return getString("dispatch.earliest_time", null); + } + + /** + * Returns the latest time for this search. This value can be a relative + * or absolute time (as formatted by {@code DispatchTimeFormat}). + * @see #getDispatchTimeFormat + * + * @return The latest time for this search. + */ + public String getDispatchLatestTime() { + return getString("dispatch.latest_time", null); + } + + /** + * Indicates whether lookups are enabled for this search. + * + * @return {@code true} if lookups are enabled, {@code false} if not. + */ + public boolean getDispatchLookups() { + return getBoolean("dispatch.lookups"); + } + + + /** + * Returns the maximum number of results before finalizing the search. + * + * @return The maximum number of results. + */ + public int getDispatchMaxCount() { + return getInteger("dispatch.max_count"); + } + + /** + * Returns the maximum amount of time before finalizing the search. + * + * @return The maximum amount of time, in seconds. + */ + public int getDispatchMaxTime() { + return getInteger("dispatch.max_time"); + } + + /** + * Returns how frequently Splunk runs the MapReduce reduce phase + * on accumulated map values. + * + * @return The reduce frequency. + */ + public int getDispatchReduceFrequency() { + return getInteger("dispatch.reduce_freq"); + } + + /** + * Indicates whether to back fill the real-time window for this search. + * This attribute only applies to real-time searches. + * + * @return {@code true} if Splunk back fills the real-time window, + * {@code false} if not. + * @deprecated Use {@link #getDispatchRealTimeBackfill()} instead. + */ + public boolean getDispatchRtBackfill() { + return getDispatchRealTimeBackfill(); + } + + /** + * Indicates whether to back fill the real-time window for this search. + * This attribute only applies to real-time searches. + * + * @return {@code true} if Splunk back fills the real-time window, + * {@code false} if not. + */ + public boolean getDispatchRealTimeBackfill() { + return getBoolean("dispatch.rt_backfill", false); + } + + /** + * Indicates whether Splunk spawns a new search process when running + * this saved search. + * + * @return {@code true} if Splunk spawns a new search process, {@code false} + * if not. + */ + public boolean getDispatchSpawnProcess() { + return getBoolean("dispatch.spawn_process"); + } + + /** + * Returns the time format used to specify the earliest and latest times + * for this search. + * + * @return The time format. + */ + public String getDispatchTimeFormat() { + return getString("dispatch.time_format"); + } + + /** + * Returns the time to live (ttl) for artifacts of the scheduled search (the + * time before the search job expires and artifacts are still available), + * if no alerts are triggered. If the value is a number followed by "p", it + * is the number of scheduled search periods. + * + * @return The time to live, in seconds or as a multiple of the scheduled + * search period. + */ + public String getDispatchTtl() { + return getString("dispatch.ttl"); + } + + /** + * Returns the default view in which to load results. + * + * @return The view name. + */ + public String getDisplayView() { + return getString("displayview", null); + } + + /** + * Returns the maximum number of concurrent instances of this search + * the scheduler is allowed to run. + * + * @return The maximum number of concurrent instances. + */ + public int getMaxConcurrent() { + return getInteger("max_concurrent"); + } + + /** + * Returns the next scheduled time. + * + * @return The next scheduled time. + */ + public Date getNextScheduledTime() { + return getDate("next_scheduled_time", null); + } + + /** + * Returns the qualified search. + * + * @return The qualified search. + */ + public String getQualifiedSearch() { + return getString("qualifiedSearch", null); + } + + /** + * Indicates whether the scheduler computes the next run time of a + * scheduled search based on the current time or on the last search run + * time (for continuous scheduling). + * + * @return {@code true} if the run time is based on current time, + * {@code false} if based on the previous search time. + */ + public boolean getRealtimeSchedule() { + return getBoolean("realtime_schedule"); + } + + /** + * Returns the app in which Splunk Web dispatches this search. + * + * @return The app name. + */ + public String getRequestUiDispatchApp() { + return getString("request.ui_dispatch_app", null); + } + + /** + * Returns the view in which Splunk Web displays this search. + * + * @return The view name. + */ + public String getRequestUiDispatchView() { + return getString("request.ui_dispatch_view", null); + } + + /** + * Indicates whether a real-time search managed by the scheduler is + * restarted when a search peer becomes available for this saved search. + * + * @return {@code true} if a real-time search is restarted, + * {@code false} if not. + */ + public boolean getRestartOnSearchPeerAdd() { + return getBoolean("restart_on_searchpeer_add"); + } + + /** + * Indicates whether this search is run when Splunk starts. If the search + * is not run on startup, it runs at the next scheduled time. + * + * @return {@code true} if this search is run when Splunk starts, + * {@code false} if not. + */ + public boolean getRunOnStartup() { + return getBoolean("run_on_startup"); + } + + /** + * Returns the search query for this saved search. + * + * @return The search query. + */ + public String getSearch() { + return getString("search"); + } + + /** + * Returns the view state ID that is associated with the view specified in + * the {@code DisplayView} attribute. This ID corresponds to a stanza in the + * viewstates.conf configuration file. + * @see #getDisplayView + * + * @return The view state ID. + */ + public String getVsid() { + return getString("vsid", null); + } + + /** + * Indicates whether the email action is enabled. + * + * @return {@code true} if the email action is enabled, {@code false} if + * not. + */ + public boolean isActionEmail() { + return getBoolean("action.email"); + } + + /** + * Indicates whether the populate-lookup action is enabled. + * + * @return {@code true} if the populate-lookup action is enabled, + * {@code false} if not. + */ + public boolean isActionPopulateLookup() { + return getBoolean("action.populate_lookup"); + } + + /** + * Indicates whether the RSS action is enabled. + * + * @return {@code true} if the RSS action is enabled, {@code false} if not. + */ + public boolean isActionRss() { + return getBoolean("action.rss"); + } + + /** + * Indicates whether the script action is enabled. + * + * @return {@code true} if the script action is enabled, {@code false} if + * not. + */ + public boolean isActionScript() { + return getBoolean("action.script"); + } + + /** + * Indicates whether the summary-index action is enabled. + * + * @return {@code true} if the summary-index action is enabled, + * {@code false} if not. + */ + public boolean isActionSummaryIndex() { + return getBoolean("action.summary_index"); + } + + /** + * Indicates whether Splunk applies the alert actions to the entire result + * set (digest) or to each individual search result (per result). + * + * @return {@code true} if actions are applied per digest, + * {@code false} if per result. + */ + public boolean isDigestMode() { + return getBoolean("alert.digest_mode"); + } + + /** + * Indicates whether this search is run on a schedule. + * + * @return {@code true} if this search is run on a schedule, {@code false} + * if not. + */ + public boolean isScheduled() { + return getBoolean("is_scheduled"); + } + + /** + * Indicates whether the search should be visible in the saved search list. + * + * @return {@code true} if the search should be listed, {@code false} if + * not. + */ + public boolean isVisible() { + return getBoolean("is_visible"); + } + + /** + * Indicates whether embedding is enabled for the search. + * + * @return {@code true} if the search is enabled for the search, {@code false} if not. + */ + public boolean isEmbedEnabled() { + if (service.versionIsEarlierThan("6.2.0")){ + throw new UnsupportedOperationException(); + } + return getBoolean("embed.enabled"); + } + + /** + * Returns the authorization token for embedding the search. + * + * @return The authorization token for embedding the search. + */ + public String getEmbedToken() { + if (service.versionIsEarlierThan("6.2.0")) { + throw new UnsupportedOperationException(); + } + return getString("embed.token", null); + } + + /** + * Sets the password to use when authenticating with the SMTP server. + * Normally this value will be set when editing the email settings, however + * you can set a clear text password here and it will be encrypted on the + * next Splunk restart. + * + * @param password The password. + */ + public void setActionEmailAuthPassword(String password) { + setCacheValue("action.email.auth_password", password); + } + + /** + * Sets the username to use when authenticating the SMTP server. If this + * string is empty, authentication is not attempted. + * + * @param username The username for authentication. + */ + public void setActionEmailAuthUsername(String username) { + setCacheValue("action.email.auth_username", username); + } + + /** + * Sets the blind carbon copy (BCC) email address to use for email alerts. + * @see #isActionEmail + * + * @param bcc The BCC email address. + */ + public void setActionEmailBcc(String bcc) { + setCacheValue("action.email.bcc", bcc); + } + + /** + * Sets the carbon copy (CC) email address to use for email alerts. + * @see #isActionEmail + * + * @param cc The CC email address. + */ + public void setActionEmailCc(String cc) { + setCacheValue("action.email.cc", cc); + } + + /** + * Returns the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @param command The search command (or pipeline). + */ + public void setActionEmailCommand(String command) { + setCacheValue("action.email.command", command); + } + + /** + * Sets the format of text in the email. This value also applies to any + * attachments formats. Valid values are: "plain", "html", "raw", and "csv". + * + * @param format The email format. + */ + public void setActionEmailFormat(String format) { + setCacheValue("action.email.format", format); + } + + /** + * Sets the email sender's name. + * + * @param from The sender's name. + */ + public void setActionEmailFrom(String from) { + setCacheValue("action.email.from", from); + } + + /** + * Sets the host name used in the web link (URL) to send in email alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @param hostname The host name to use in the URL. + */ + public void setActionEmailHostname(String hostname) { + setCacheValue("action.email.hostname", hostname); + } + + /** + * Sets whether the search results are contained in the body of the email. + * + * @param inline {@code true} to include search results in the body of the + * email, {@code false} if not. + */ + public void setActionEmailInline(boolean inline) { + setCacheValue("action.email.inline", inline); + } + + /** + * Sets the address of the MTA server that is used to send the emails. If + * this parameter is not set, the value defaults to the setting in the + * alert_actions.conf file. + * + * @param mailServer The address of the MTA server. + */ + public void setActionEmailMailServer(String mailServer) { + setCacheValue("action.email.mailserver", mailServer); + } + + /** + * Sets the maximum number of search results to send in email alerts. + * + * @param maxResults The maximum number of search results per alert. + */ + public void setActionEmailMaxResults(int maxResults) { + setCacheValue("action.email.maxresults", maxResults); + } + + /** + * Sets the maximum amount of time an email action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param maxTime The maximum amount of time. + */ + public void setActionEmailMaxTime(String maxTime) { + setCacheValue("action.email.maxtime", maxTime); + } + + /** + * Sets the name of the view to deliver if {@code ActionEmailSendPdf} is + * enabled. + * @see #getActionEmailSendPdf + * + * @param name The name of the PDF view. + */ + public void setActionEmailPdfView(String name) { + setCacheValue("action.email.pdfview", name); + } + + /** + * Sets the search string for pre-processing results before emailing + * them. Usually preprocessing consists of filtering out unwanted internal + * fields. + * + * @param preprocess The search string for pre-processing results. + */ + public void setActionEmailPreProcessResults(String preprocess) { + setCacheValue("action.email.preprocess_results", preprocess); + } + + /** + * Sets the paper orientation. Valid values are "portrait" and + * "landscape". + * + * @param orientation The paper orientation. + */ + public void setActionEmailReportPaperOrientation(String orientation) { + setCacheValue("action.email.reportPaperOrientation", orientation); + } + + /** + * Sets the paper size for PDFs. Valid values are: "letter", "legal", + * "ledger", "a2", "a3", "a4", and "a5". + * + * @param size The paper size. + */ + public void setActionEmailReportPaperSize(String size) { + setCacheValue("action.email.reportPaperSize", size); + } + + /** + * Sets whether the PDF server is enabled. + * + * @param pdfServerEnabled {@code true} if the PDF server is enabled, + * {@code false} if not. + */ + public void setActionEmailReportServerEnabled(boolean pdfServerEnabled) { + setCacheValue("action.email.reportServerEnabled", pdfServerEnabled); + } + + /** + * Sets the URL of the PDF report server. + * + * @param pdfServerUrl The URL of the PDF report server. + */ + public void setActionEmailReportServerUrl(String pdfServerUrl) { + setCacheValue("action.email.reportServerURL", pdfServerUrl); + } + + /** + * Sets whether to create and send the results in PDF format. + * + * @param sendPdf {@code true} to send results in PDF format, {@code false} + * if not. + */ + public void setActionEmailSendPdf(boolean sendPdf) { + setCacheValue("action.email.sendpdf", sendPdf); + } + + /** + * Sets whether to attach the search results to an email. + * + * @param sendResults {@code true} to attach search results to an email, + * {@code false} if not. + */ + public void setActionEmailSendResults(boolean sendResults) { + setCacheValue("action.email.sendresults", sendResults); + } + + /** + * Sets the subject line of the email. + * + * @param subject The subject line of the email. + */ + public void setActionEmailSubject(String subject) { + setCacheValue("action.email.subject", subject); + } + + /** + * Sets a list of email recipients. + * + * @param to A comma- or semicolon-delimited list of email recipients. + */ + public void setActionEmailTo(String to) { + setCacheValue("action.email.to", to); + } + + /** + * Sets whether running this email action results in a trackable alert. + * + * @param trackAlert {@code true} for a trackable alert, {@code false} if + * not. + */ + public void setActionEmailTrackAlert(boolean trackAlert) { + setCacheValue("action.email.track_alert", trackAlert); + } + + /** + * Sets the minimum time-to-live in seconds of the search artifacts if an + * email action is triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @param ttl The minimum time-to-live in seconds, or the number of + * scheduled periods. + */ + public void setActionEmailTtl(String ttl) { + setCacheValue("action.email.ttl", ttl); + } + + /** + * Sets whether to use secure socket layer (SSL) when communicating + * with the SMTP server. + * + * @param useSsl {@code true} to use SSL, {@code false} if not. + */ + public void setActionEmailUseSsl(boolean useSsl) { + setCacheValue("action.email.use_ssl", useSsl); + } + + /** + * Sets whether to use transport layer security (TLS) when + * communicating with the SMTP server. + * + * @param useTls {@code true} to use TLS, {@code false} if not. + */ + public void setActionEmailUseTls(boolean useTls) { + setCacheValue("action.email.use_tls", useTls); + } + + /** + * Sets whether columns should be sorted from least wide to most wide, + * left to right. + * This value is only used when {@code ActionEmailFormat} is "plain". + * @see #getActionEmailFormat + * + * @param widthSortColumns {@code true} to sort columns from least wide to + * most wide, {@code false} if not. + */ + public void setActionEmailWidthSortColumns(boolean widthSortColumns) { + setCacheValue("action.email.width_sort_columns", widthSortColumns); + } + + /** + * Sets the search command (or pipeline) that runs the action. + * + * @param command The search command (or pipeline). + */ + public void setActionPopulateLookupCommand(String command) { + setCacheValue("action.populate_lookup.command", command); + } + + /** + * Sets the name of the lookup table or lookup path to populate. + * + * @param dest The lookup name or path. + */ + public void setActionPopulateLookupDest(String dest) { + setCacheValue("action.populate_lookup.dest", dest); + } + + /** + * Sets the host name used in the web link (URL) to send in populate-lookup + * alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @param hostname The host name to use in the URL. + */ + public void setActionPopulateLookupHostname(String hostname) { + setCacheValue("action.populate_lookup.hostname", hostname); + } + + /** + * Sets the maximum number of search results to send in populate-lookup + * alerts. + * + * @param maxResults The maximum number of search results per alert. + */ + public void setActionPopulateLookupMaxResults(int maxResults) { + setCacheValue("action.populate_lookup.maxresults", maxResults); + } + + /** + * Sets the maximum amount of time an alert action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param maxTime The maximum amount of time. + */ + public void setActionPopulateLookupMaxTime(String maxTime) { + setCacheValue("action.populate_lookup.maxtime", maxTime); + } + /** + * Sets whether running this populate-lookup action results in a trackable + * alert. + * + * @param trackAlert {@code true} for a trackable alert, {@code false} if + * not. + */ + public void setActionPopulateLookupTrackAlert(boolean trackAlert) { + setCacheValue("action.populate_lookup.track_alert", trackAlert); + } + + /** + * Sets the minimum time-to-live (ttl) of the search artifacts if + * this populate-lookup action is triggered. If the value is a number + * followed by "p", it is the number of scheduled search periods. + * + * @param ttl The minimum time-to-live in seconds, or the number of + * scheduled periods. + */ + public void setActionPopulateLookupTtl(String ttl) { + setCacheValue("action.populate_lookup.ttl", ttl); + } + + /** + * Sets the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @param command The search command (or pipeline). + */ + public void setActionRssCommand(String command) { + setCacheValue("action.rss.command", command); + } + + /** + * Sets the host name to use in the web link (URL) to send in RSS alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @param hostname The host name to use in the URL. + */ + public void setActionRssHostname(String hostname) { + setCacheValue("action.rss.hostname", hostname); + } + + /** + * Sets the maximum number of search results to send in RSS alerts. + * + * @param maxResults The maximum number of search results per alert. + */ + public void setActionRssMaxResults(int maxResults) { + setCacheValue("action.rss.maxresults", maxResults); + } + + /** + * Sets the maximum amount of time an RSS action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param maxTime The maximum amount of time. + */ + public void setActionRssMaxTime(String maxTime) { + setCacheValue("action.rss.maxtime", maxTime); + } + + /** + * Sets whether running this RSS action results in a trackable alert. + * + * @param trackAlert {@code true} for a trackable alert, {@code false} if + * not. + */ + public void setActionRssTrackAlert(boolean trackAlert) { + setCacheValue("action.rss.track_alert", trackAlert); + } + + /** + * Sets the minimum time-to-live in seconds of the search artifacts if an + * RSS action is triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @param ttl The minimum time-to-live in seconds, or the number of + * scheduled periods. + */ + public void setActionRssTtl(String ttl) { + setCacheValue("action.rss.ttl", ttl); + } + + /** + * Sets the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @param command The search command (or pipeline). + */ + public void setActionScriptCommand(String command) { + setCacheValue("action.script.command", command); + } + + /** + * Sets the file name of the script to call. This value is required if + * {@code ActionScript} is enabled. + * @see #isActionScript + * + * @param filename The file name of the script. + */ + public void setActionScriptFilename(String filename) { + setCacheValue("action.script.filename", filename); + } + + /** + * Sets the host name used in the web link (URL) to send in script alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @param hostname The host name to use in the URL. + */ + public void setActionScriptHostname(String hostname) { + setCacheValue("action.script.hostname", hostname); + } + + /** + * Sets the maximum number of search results to send in script alerts. + * + * @param maxResults The maximum number of search results per alert. + */ + public void setActionScriptMaxResults(int maxResults) { + setCacheValue("action.script.maxresults", maxResults); + } + + /** + * Sets the maximum amount of time a script action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param maxTime The maximum amount of time. + */ + public void setActionScriptMaxTime(String maxTime) { + setCacheValue("action.script.maxtime", maxTime); + } + + /** + * Sets whether running this script action results in a trackable alert. + * + * @param trackAlert {@code true} for a trackable alert, {@code false} if + * not. + */ + public void setActionScriptTrackAlert(boolean trackAlert) { + setCacheValue("action.script.track_alert", trackAlert); + } + + /** + * Sets the minimum time-to-live in seconds of the search artifacts if a + * script action is triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @param ttl The minimum time-to-live in seconds, or the number of + * scheduled periods. + */ + public void setActionScriptTtl(String ttl) { + setCacheValue("action.script.ttl", ttl); + } + + /** + * Sets the name of the summary index where the results of the scheduled + * search are saved. + * + * @param name The name of the summary index. + */ + public void setActionSummaryIndexName(String name) { + setCacheValue("action.summary_index._name", name); + } + + /** + * Sets the search command (or pipeline) that runs the action. + * <p> + * Generally, this command is a template search pipeline that is realized + * with values from the saved search. To reference saved search field + * values, wrap them in "$". For example, use "$name$" to reference the + * saved search name, or use "$search$" to reference the search query. + * + * @param command The search command (or pipeline). + */ + public void setActionSummaryIndexCommand(String command) { + setCacheValue("action.summary_index.command", command); + } + + /** + * Sets the host name used in the web link (URL) to send in summary-index + * alerts. + * Valid forms are "hostname" and "protocol://hostname:port". + * + * @param hostname The host name to use in the URL. + */ + public void setActionSummaryIndexHostname(String hostname) { + setCacheValue("action.summary_index.hostname", hostname); + } + + /** + * Sets whether to run the summary indexing action as part of the + * scheduled search. + * + * @param inline {@code true} to run the summary indexing action with the + * scheduled search, {@code false} if not. + */ + public void setActionSummaryIndexInline(boolean inline) { + setCacheValue("action.summary_index.inline", inline); + } + + /** + * Sets the maximum number of search results to send in summary-index + * alerts. + * + * @param maxResults The maximum number of search results per alert. + */ + public void setActionSummaryIndexMaxResults(int maxResults) { + setCacheValue("action.summary_index.maxresults", maxResults); + } + + /** + * Sets the maximum amount of time a summary-index action takes before the + * action is canceled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param maxTime The maximum amount of time. + */ + public void setActionSummaryIndexMaxTime(String maxTime) { + setCacheValue("action.summary_index.maxtime", maxTime); + } + + /** + * Sets whether running summary-index action results in a trackable alert. + * + * @param trackAlert {@code true} for a trackable alert, {@code false} if + * not. + */ + public void setActionSummaryIndexTrackAlert(boolean trackAlert) { + setCacheValue("action.summary_index.track_alert", trackAlert); + } + + /** + * Sets the minimum time-to-live in seconds of the search artifacts if a + * summary-index action is triggered. If the value is a number followed by + * "p", it is the number of scheduled search periods. + * + * @param ttl The minimum time-to-live in seconds, or the number of + * scheduled periods. + */ + public void setActionSummaryIndexTtl(String ttl) { + setCacheValue("action.summary_index.ttl", ttl); + } + + /** + * Sets whichs actions to enable. Valid actions are: "email", + * "populate_lookup", "rss", "script", and "summary_index". + * + * @param actions A comma-separated list of actions. + */ + public void setActions(String actions) { + setCacheValue("actions", actions); + } + + /** + * Sets whether Splunk applies the alert actions to the entire result set or + * on each individual result. + * + * @param digest {@code true} if Splunk applies the alert actions to the + * entire result set (digest), {@code false} if actions are applied to + * individual search results (per result). + */ + public void setAlertDigestMode(boolean digest) { + setCacheValue("alert.digest_mode", digest); + } + + /** + * Sets the period of time to show the alert in the dashboard. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * + * @param period The amount of time. + */ + public void setAlertExpires(String period) { + setCacheValue("alert.expires", period); + } + + /** + * Sets the alert severity level, which is an integer from 1-6 (1=DEBUG, + * 2=INFO, 3=WARN, 4=ERROR, 5=SEVERE, 6=FATAL). + * + * @param severity The alert severity level. + */ + public void setAlertSeverity(int severity) { + setCacheValue("alert.severity", severity); + } + + /** + * Sets whether to enable alert suppression for this scheduled search. + * + * @param suppress {@code true} to enable alert suppression, {@code false} + * if not. + */ + public void setAlertSuppress(boolean suppress) { + setCacheValue("alert.suppress", suppress); + } + + /** + * Specifies a list of fields to use for alert suppression. This attribute + * is required when alert suppression and per-result alerting are enabled. + * @see #setAlertSuppress + * @see #isDigestMode + * + * @param fields A comma-delimited list of fields. + */ + public void setAlertSuppressFields(String fields) { + setCacheValue("alert.suppress.fields", fields); + } + + /** + * Sets the period for alert suppression. This attribute is only valid when + * {@code AlertSuppress} is enabled. + * The valid format is <i>number</i> followed by a time unit ("s", "m", "h", + * or "d"). + * @see #setAlertSuppress + * + * @param period The suppression period. + */ + public void setAlertSuppressPeriod(String period) { + setCacheValue("alert.suppress.period", period); + } + + /** + * Sets how to track the actions triggered by this saved search. Valid + * values are: "true" (enabled), "false" (disabled), and "auto" (tracking + * is based on the setting of each action). + * + * @param track The alert tracking setting. + */ + public void setAlertTrack(String track) { + setCacheValue("alert.track", track); + } + + /** + * Sets the alert comparator. Valid values are: "greater than", "less + * than", "equal to", "rises by", "drops by", "rises by perc", and "drops by + * perc". + * + * @param comparator The alert comparator. + */ + public void setAlertComparator(String comparator) { + setCacheValue("alert_comparator", comparator); + } + + /** + * Sets a conditional search that is evaluated against the results of the + * saved search. + * <p> + * <b>Note:</b> If you specify an alert_condition, do not set + * {@code counttype}, {@code relation}, or {@code quantity}. + * + * @param conditional A conditional search. + */ + public void setAlertCondition(String conditional) { + setCacheValue("alert_condition", conditional); + } + + /** + * Sets the value to compare to before triggering the alert action. + * If this value is expressed as a percentage, it indicates the value to use + * when {@code AlertComparator} is set to "rises by perc" or "drops by + * perc." + * @see #getAlertComparator + * + * @param threshold The threshold as a number or percentage (a number + * followed by "%"). + */ + public void setAlertThreshold(String threshold) { + setCacheValue("alert_threshold", threshold); + } + + /** + * Sets a value that indicates what to base the alert on. Valid values + * are: "always", "custom", "number of events", "number of hosts", and + * "number of sources". This value is overridden by {@code AlertCondition} + * if specified. + * + * @param type The alert trigger type. + */ + public void setAlertType(String type) { + setCacheValue("alert_type", type); + } + + /** + * Sets the cron schedule for running this saved search. + * + * @param cronSchedule The schedule, as a valid cron-style string. + */ + public void setCronSchedule(String cronSchedule) { + setCacheValue("cron_schedule", cronSchedule); + } + + /** + * Sets the description of this saved search. + * + * @param description The description. + */ + public void setDescription(String description) { + setCacheValue("description", description); + } + + /** + * Sets whether the saved search is disabled. Disabled searches are not + * visible in Splunk Web. + * + * @param disabled {@code true} to disable the saved search, {@code false} + * to enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the maximum number of timeline buckets. + * + * @param buckets The maximum number of timeline buckets. + * @deprecated Use {@link #setDispatchBuckets(int)} instead. + */ + public void setDispatchBuckets(String buckets) { + setDispatchBuckets(Integer.parseInt(buckets)); + } + + /** + * Sets the maximum number of timeline buckets. + * + * @param buckets The maximum number of timeline buckets. + */ + public void setDispatchBuckets(int buckets) { + setCacheValue("dispatch.buckets", buckets); + } + + /** + * Sets the earliest time for this search. This value can be a relative + * time, or absolute time as formatted by {@code DispatchTimeFormat}. + * @see #getDispatchTimeFormat + * + * @param earliestTime The earliest time for this search. + */ + public void setDispatchEarliestTime(String earliestTime) { + setCacheValue("dispatch.earliest_time", earliestTime); + } + + /** + * Sets the latest time for this search. This value can be a relative time, + * or absolute time as formatted by {@code DispatchTimeFormat}. + * @see #getDispatchTimeFormat + * + * @param latestTime The latest time for this search. + */ + public void setDispatchLatestTime(String latestTime) { + setCacheValue("dispatch.latest_time", latestTime); + } + + /** + * Sets whether to enable lookups for this search. + * + * @param lookups {@code true} to enable lookups, {@code false} if not. + */ + public void setDispatchLookups(boolean lookups) { + setCacheValue("dispatch.lookups", lookups); + } + + /** + * Sets the maximum number of results before finalizing the search. + * + * @param max The maximum number of results. + */ + public void setDispatchMaxCount(int max) { + setCacheValue("dispatch.max_count", max); + } + + /** + * Sets the maximum time before finalizing the search. + * + * @param max The maximum time, in seconds. + */ + public void setDispatchMaxTime(int max) { + setCacheValue("dispatch.max_time", max); + } + + /** + * Sets how frequently Splunk should run the MapReduce reduce phase on + * accumulated map values. + * + * @param seconds The reduce frequency. + */ + public void setDispatchReduceFrequency(int seconds) { + setCacheValue("dispatch.reduce_freq", seconds); + } + + /** + * Sets whether to back fill the real-time window for this search. + * This attribute only applies to real-time searches. + * + * @param backfill {@code true} if Splunk back fills the real-time window, + * {@code false} if not. + */ + public void setDispatchRealTimeBackfill(boolean backfill) { + setCacheValue("dispatch.rt_backfill", backfill); + } + + /** + * Sets whether Splunk spawns a new search process when running this saved + * search. Searches against indexes must run in a separate process. + * + * @param spawn {@code true} if Splunk spawns a new search process, + * {@code false} if not. + */ + public void setDispatchSpawnProcess(boolean spawn) { + setCacheValue("dispatch.spawn_process", spawn); + } + + /** + * Sets the time format used to specify the earliest and latest times + * for this search. + * + * @param format The time format. + */ + public void setDispatchTimeFormat(String format) { + setCacheValue("dispatch.time_format", format); + } + + /** + * Sets the minimum time-to-live in seconds of the search artifacts if no + * actions are triggered. If the value is a number followed by "p", + * it is the number of scheduled search periods. + * + * @param format The time to live, in seconds or as a multiple of the + * scheduled search period. + */ + public void setDispatchTtl(String format) { + setCacheValue("dispatch.ttl", format); + } + + /** + * Sets the default view in which to load the results. + * + * @param view The view name (not label). + */ + public void setDisplayView(String view) { + setCacheValue("displayview", view); + } + + /** + * Sets whether this search runs on a schedule. + * + * @param value {@code true} to run this search on a schedule, {@code false} + * if not. + */ + public void setIsScheduled(boolean value) { + setCacheValue("is_scheduled", value); + } + + /** + * Sets whether this search appears in the visible list of saved searches. + * + * @param value {@code true} to display this in the visible list, + * {@code false} if not. + */ + public void setIsVisible(boolean value) { + setCacheValue("is_visible", value); + } + + /** + * Sets the maximum number of concurrent instances of this search the + * scheduler is allowed to run. + * + * @param max The maximum number of concurrent instances. + */ + public void setMaxConcurrent(int max) { + setCacheValue("max_concurrent", max); + } + + /** + * Sets how the scheduler computes the next time a scheduled search is run. + * <ul> + * <li>When {@code true}: The schedule is based on the current time. + * The scheduler might skip some scheduled periods to make + * sure that searches over the most recent time range are run.</li> + * <li>When {@code false}: The schedule is based on the last search run time + * (referred to as "continuous scheduling") and the scheduler never skips + * scheduled periods. However, the scheduler might fall behind depending on + * its load. Use continuous scheduling whenever you enable the summary index + * option ({@code ActionSummaryIndex}).</li> + * </ul> + * The scheduler tries to run searches that have real-time schedules enabled + * before running searches that have continuous scheduling enabled. + * @see #isActionSummaryIndex + * + * @param value {@code true} to enable a real-time schedule for this search, + * {@code false} to enable continuous scheduling for this search. + */ + public void setRealtimeSchedule(boolean value) { + setCacheValue("realtime_schedule", value); + } + + /** + * Sets the app in which Splunk Web dispatches this search. + * + * @param app The app name. + */ + public void setRequestUiDispatchApp(String app) { + setCacheValue("request.ui_dispatch_app", app); + } + + /** + * Sets the view in which Splunk Web displays this search. + * + * @param view The view name. + */ + public void setRequestUiDispatchView(String view) { + setCacheValue("request.ui_dispatch_view", view); + } + + /** + * Sets whether a real-time search managed by the scheduler is + * restarted when a search peer becomes available for this saved search. + * <p> + * <b>Note:</b> The peer can be one that is newly added or one that has + * become available after being down. + * + * @param restart {@code true} to restart a real-time search, {@code false} + * if not. + * @deprecated Use {@link #setRestartOnSearchPeerAdd(boolean)} instead. + */ + public void setRestartOnSearchpeerAdd(boolean restart) { + setRestartOnSearchPeerAdd(restart); + } + + /** + * Sets whether a real-time search managed by the scheduler is + * restarted when a search peer becomes available for this saved search. + * <p> + * <b>Note:</b> The peer can be one that is newly added or one that has + * become available after being down. + * + * @param restart {@code true} to restart a real-time search, {@code false} + * if not. + */ + public void setRestartOnSearchPeerAdd(boolean restart) { + setCacheValue("restart_on_searchpeer_add", restart); + } + + /** + * Sets whether this search is run when Splunk starts. If the search + * is not run on startup, it runs at the next scheduled time. + * <p> + * It is recommended that you set this value to {@code true} for scheduled + * searches that populate lookup tables. + * + * @param startup {@code true} to run this search when Splunk starts, + * {@code false} if not. + */ + public void setRunOnStartup(boolean startup) { + setCacheValue("run_on_startup", startup); + } + + /** + * Sets the search query for this saved search. + * + * @param search The search query. + */ + public void setSearch(String search) { + setCacheValue("search", search); + } + + /** + * Sets the view state ID that is associated with the view specified in + * the {@code DisplayView} attribute. + * <p> + * <b>Note:</b> This ID must match a stanza in the from the viewstates.conf + * configuration file. + * @see #getDisplayView + * + * @param vsid The view state ID. + */ + public void setVsid(String vsid) { + setCacheValue("vsid", vsid); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("search")) { + args = Args.create(args).add("search", getSearch()); + } + + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("search")) { + setCacheValue("search", getSearch()); + } + super.update(); + } +} diff --git a/splunk/com/splunk/SavedSearchCollection.java b/splunk/src/main/java/com/splunk/SavedSearchCollection.java similarity index 50% rename from splunk/com/splunk/SavedSearchCollection.java rename to splunk/src/main/java/com/splunk/SavedSearchCollection.java index 8d758c47..6abb58ea 100644 --- a/splunk/com/splunk/SavedSearchCollection.java +++ b/splunk/src/main/java/com/splunk/SavedSearchCollection.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -19,30 +19,42 @@ import java.util.Map; /** - * Representation of a collection of saved searches. + * The {@code SavedSearchCollection} class represents a collection of saved + * searches. */ public class SavedSearchCollection extends EntityCollection<SavedSearch> { /** - * Constructs an instance of the {@code SavedSearchCollection}. + * Class constructor. * - * @param service The service the entity is affiliated with. + * @param service The connected {@code Service} instance. */ SavedSearchCollection(Service service) { super(service, "saved/searches", SavedSearch.class); } + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link SavedSearchCollectionArgs}). + */ + SavedSearchCollection(Service service, Args args) { + super(service, "saved/searches", SavedSearch.class, args); + } + /** {@inheritDoc} */ @Override public SavedSearch create(String name) { throw new UnsupportedOperationException(); } /** - * Create a saved search with the given name and search expression. + * Creates a saved search from a name and search query. * - * @param name The name of the new saved search. - * @param search The search expression for the new saved search. - * @return The newly created saved search. + * @param name The name for the search. + * @param search The search query. + * @return The new saved search. */ public SavedSearch create(String name, String search) { Args args = new Args("search", search); @@ -50,13 +62,17 @@ public SavedSearch create(String name, String search) { } /** - * Create a saved search with the given name, search expression and - * additional saved search arguments. + * Creates a saved search from a name, search query, and + * additional arguments. * - * @param name The name of the new saved search. - * @param search The search expression for the new saved search. - * @param args Additional saved search arguments. - * @return The newly created saved search. + * @param name The name for the search. + * @param search The search query. + * @param args Additional arguments. For a list of possible parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEHQ#savedsearchparams" + * target="_blank">Saved search parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEHQ" + * target="_blank">dev.splunk.com</a>. + * @return The new saved search. */ public SavedSearch create(String name, String search, Map args) { args = Args.create(args).add("search", search); diff --git a/splunk/src/main/java/com/splunk/SavedSearchCollectionArgs.java b/splunk/src/main/java/com/splunk/SavedSearchCollectionArgs.java new file mode 100644 index 00000000..d846e19d --- /dev/null +++ b/splunk/src/main/java/com/splunk/SavedSearchCollectionArgs.java @@ -0,0 +1,53 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code SavedSearchCollectionArgs} class contains arguments getting a + * collection of saved searches. + */ +public class SavedSearchCollectionArgs extends CollectionArgs { + + /** + * Class constructor. + */ + public SavedSearchCollectionArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets the earliest time for which to display the scheduled times for scheduled searches (not just the next run time). + * + * @param earliestTime + * The earliest time. + */ + public void setEarliestTime(String earliestTime) { + this.put("earliest_time", earliestTime); + } + + /** + * Sets the latest time until which to display the scheduled times for scheduled searches (not just the next run time). + * + * @param latestTime + * The latest time. + */ + public void setLatestTime(String latestTime) { + this.put("latest_time", latestTime); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/SavedSearchDispatchArgs.java b/splunk/src/main/java/com/splunk/SavedSearchDispatchArgs.java new file mode 100644 index 00000000..1522fc43 --- /dev/null +++ b/splunk/src/main/java/com/splunk/SavedSearchDispatchArgs.java @@ -0,0 +1,207 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.text.SimpleDateFormat; +import java.util.Date; + +/** + * The {@code SavedSearchDispatchArgs} class contains arguments for dispatching + * a saved search using the {@link SavedSearch#dispatch} method. + */ +public class SavedSearchDispatchArgs extends Args { + + /** + * Class constructor. + */ + public SavedSearchDispatchArgs() { super(); } + + /* BEGIN AUTOGENERATED CODE */ + + /** + * Sets a time that dispatches the search as though the specified time were the current time. + * + * @param dispatchNow + * A string with the specified time. + */ + public void setDispatchNow(String dispatchNow) { + this.put("dispatch.now", dispatchNow); + } + + /** + * Sets the maximum number of timeline buckets. + * + * @param dispatchBuckets + * The maximum number of timeline buckets. + */ + public void setDispatchBuckets(int dispatchBuckets) { + this.put("dispatch.buckets", dispatchBuckets); + } + + /** + * Specifies the earliest time for this search. This value can be a relative or absolute time. If this value is an absolute time, use {@link #setDispatchTimeFormat} to format the value. + * + * @param dispatchEarliestTime + * A time string that specifies the earliest time for this search. + */ + public void setDispatchEarliestTime(String dispatchEarliestTime) { + this.put("dispatch.earliest_time", dispatchEarliestTime); + } + + /** + * Sets the earliest time for this search. + * + * @param dispatchEarliestTime + * A date that specifies the earliest time for this search. + */ + public void setDispatchEarliestTime(Date dispatchEarliestTime) { + // Documented format: "%FT%T.%Q%:z" + // strftime original format: "%FT%T.%Q%:z" + // strftime expanded format: "%Y-%m-%dT%H:%M:%S.%Q%:z" + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchEarliestTime); + this.put("dispatch.earliest_time", timeString); + } + + /** + * Specifies the latest time for this search. This value can be a relative or absolute time. If this value is an absolute time, use {@link #setDispatchTimeFormat} to format the value. + * + * @param dispatchLatestTime + * A time string that specifies the latest time for this search. + */ + public void setDispatchLatestTime(String dispatchLatestTime) { + this.put("dispatch.latest_time", dispatchLatestTime); + } + + /** + * Sets the latest time for this search. + * + * @param dispatchLatestTime + * A date that specifies the latest time for this saved search. + */ + public void setDispatchLatestTime(Date dispatchLatestTime) { + // Documented format: "%FT%T.%Q%:z" + // strftime original format: "%FT%T.%Q%:z" + // strftime expanded format: "%Y-%m-%dT%H:%M:%S.%Q%:z" + String javaFormatString = "yyyy-MM-dd'T'HH:mm:ss.SSSZ"; + String timeString = new SimpleDateFormat(javaFormatString).format(dispatchLatestTime); + this.put("dispatch.latest_time", timeString); + } + + /** + * Indicates whether to enable lookups for this search. + * + * @param dispatchLookups + * {@code true} to enable lookups, {@code false} if not. + */ + public void setDispatchLookups(boolean dispatchLookups) { + this.put("dispatch.lookups", dispatchLookups); + } + + /** + * Sets the maximum number of results before finalizing the search. + * + * @param dispatchMaximumCount + * The maximum number of results. + */ + public void setDispatchMaximumCount(int dispatchMaximumCount) { + this.put("dispatch.max_count", dispatchMaximumCount); + } + + /** + * Sets the the maximum amount of time before finalizing the search. + * + * @param dispatchMaximumTime + * The maximum amount of time, in seconds. + */ + public void setDispatchMaximumTime(int dispatchMaximumTime) { + this.put("dispatch.max_time", dispatchMaximumTime); + } + + /** + * Set the frequency for how often Splunk should run the MapReduce reduce phase on accumulated map values. + * + * @param dispatchReduceFrequency + * The frequency, in seconds. + */ + public void setDispatchReduceFrequency(int dispatchReduceFrequency) { + this.put("dispatch.reduce_freq", dispatchReduceFrequency); + } + + /** + * Indicates whether to back fill the real-time window for this search. This + * value only applies to real-time searches. + * + * @param dispatchRealTimeBackfill + * {@code true} to back fill the real-time window, {@code false} if not. + */ + public void setDispatchRealTimeBackfill(boolean dispatchRealTimeBackfill) { + this.put("dispatch.rt_backfill", dispatchRealTimeBackfill); + } + + /** + * Indicates whether the search should run in a separate spawned process. Searches against indexes must run in a separate process. + * + * @param dispatchSpawnProcess + * {@code true} to run the search in a separate process, {@code false} if not. + */ + public void setDispatchSpawnProcess(boolean dispatchSpawnProcess) { + this.put("dispatch.spawn_process", dispatchSpawnProcess); + } + + /** + * Sets a time format for Splunk to use to specify the earliest and latest times. + * + * @param dispatchTimeFormat + * A time format string. + */ + public void setDispatchTimeFormat(String dispatchTimeFormat) { + this.put("dispatch.time_format", dispatchTimeFormat); + } + + /** + * Indicates the time to live (TTL) for the artifacts of the scheduled search, if no actions are triggered. If an action is triggered, Splunk changes the TTL to that action's TTL. If multiple actions are triggered, Splunk applies the maximum TTL to the artifacts. To set the action's TTL, refer to alert_actions.conf.spec. + * + * @param dispatchTtl + * The time to live, in seconds. If the value is a number followed by "p", it is the number of scheduled search periods. + */ + public void setDispatchTtl(String dispatchTtl) { + this.put("dispatch.ttl", dispatchTtl); + } + + /** + * Indicates whether to trigger alert actions. + * + * @param triggerActions + * {@code true} to trigger alert actions, {@code false} if not. + */ + public void setTriggerActions(boolean triggerActions) { + this.put("trigger_actions", triggerActions); + } + + /** + * Indicates whether to start a new search, even if another instance of this search is already running. + * + * @param forceDispatch + * {@code true} to start a new search, {@code false} if not. + */ + public void setForceDispatch(boolean forceDispatch) { + this.put("force_dispatch", forceDispatch); + } + + /* END AUTOGENERATED CODE */ +} diff --git a/splunk/src/main/java/com/splunk/ScriptInput.java b/splunk/src/main/java/com/splunk/ScriptInput.java new file mode 100644 index 00000000..eba17d78 --- /dev/null +++ b/splunk/src/main/java/com/splunk/ScriptInput.java @@ -0,0 +1,226 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; + +/** + * The {@code ScriptInput} class represents a scripted data input. + */ +public class ScriptInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The scripted input endpoint. + */ + ScriptInput(Service service, String path) { + super(service, path); + } + + /** + * Returns the time when the scripted input stopped running. + * + * @return The ending time, or {@code null} if not specified. + */ + public Date getEndTime() { + return getDate("endtime", null); + } + + /** + * Returns the OS group of commands for this scripted input. + * + * @return The group of commands, or {@code null} if not specified. + */ + public String getGroup() { + return getString("group", null); + } + + /** + * Returns the source host for this scripted input. + * + * @return The source host, or {@code null} if not specified. + */ + public String getHost() { + return getString("host", null); + } + + /** + * Returns the index name for this scripted input. + * + * @return The index name. + */ + public String getIndex() { + return getString("index"); + } + + /** + * Returns the frequency for running this scripted input. + * + * @return The frequency, in seconds or a cron schedule. + */ + public String getInterval() { + return getString("interval"); + } + + /** + * Returns the input kind for this scripted input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.Script; + } + + /** + * Returns the username that this scripted input runs under. + * + * @return The username. + */ + public String getPassAuth() { + return getString("passAuth", null); + } + + /** + * @deprecated Returns the value of the {@code _rcvbuf} attribute for this + * scripted input. + * + * @return The {@code _rcvbuf} value. + */ + public int getRcvBuf() { + return getInteger("_rcvbuf"); + } + + /** + * Returns the source of events from this scripted input. + * + * @return The source. + */ + public String getSource() { + return getString("source", null); + } + + /** + * Returns the source type of events from this scripted input. + * + * @return The source type. + */ + public String getSourceType() { + return getString("sourcetype", null); + } + + /** + * Returns the time when the script was started. + * + * @return The start time, or {@code null if not specified}. + */ + public Date getStartTime() { + return getDate("starttime", null); + } + + /** + * Sets whether the scripted input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable the input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the value for the <b>host</b> field for events from this scripted + * input. + * + * @param host The host. + */ + public void setHost(String host) { + setCacheValue("host", host); + } + + /** + * Sets the index in which to store events from this scripted input. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets an interval or a cron schedule that determines when to run the + * script. If a cron schedule is used, the script doesn't run at startup. + * + * @param interval An interval, in seconds or a cron schedule. + */ + public void setInterval(String interval) { + setCacheValue("interval", interval); + } + + /** + * Sets a username to run the script under. Splunk generates an + * authorization token for the username and passes it to the script. + * + * @param passAuth The username. + */ + public void setPassAuth(String passAuth) { + setCacheValue("passAuth", passAuth); + } + + /** + * Sets the source name for events from this scripted input. The same source + * should not be used for multiple data inputs. + * + * @param name The source name. + */ + public void setRenameSource(String name) { + setCacheValue("rename-source", name); + } + + /** + * Sets the initial value for the source key for events from this + * input. The source key is used during parsing and indexing. The + * <b>source</b> field is used for searches. As a convenience, the source + * string is prepended with "source::". + * <p> + * <b>Note:</b> Overriding the source key is generally not recommended. + * Typically, the input layer provides a more accurate string to aid in + * problem analysis and investigation, accurately recording the file from + * which the data was retrieved. Consider the use of source types, tagging, + * and search wildcards before overriding this value. + * + * @param source The source. + */ + public void setSource(String source) { + setCacheValue("source", source); + } + + /** + * Sets the source type for events from this scripted input. + * + * @param sourcetype The source type. + */ + public void setSourcetype(String sourcetype) { + setCacheValue("sourcetype", sourcetype); + } +} diff --git a/splunk/src/main/java/com/splunk/SearchResults.java b/splunk/src/main/java/com/splunk/SearchResults.java new file mode 100644 index 00000000..0dfa6060 --- /dev/null +++ b/splunk/src/main/java/com/splunk/SearchResults.java @@ -0,0 +1,38 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Collection; + +/** + * The {@code SearchResults} interface represents Splunk search results. + */ +public interface SearchResults extends Iterable<Event> { + /** + * Indicates whether the results are a preview from an unfinished search. + * @return {@code true} if the results are a preview, {@code false} if not. + */ + public boolean isPreview(); + + /** + * Returns a collection of field names from the results. + * @return A collection of field names. + * <p> + * Note that any given result will contain a subset of these fields. + */ + public Collection<String> getFields(); +} diff --git a/splunk/src/main/java/com/splunk/Service.java b/splunk/src/main/java/com/splunk/Service.java new file mode 100644 index 00000000..57609010 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Service.java @@ -0,0 +1,1466 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.InputStream; +import java.io.UnsupportedEncodingException; +import java.net.*; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; + +/** + * The {@code Service} class represents a Splunk service instance at a given + * address (host:port), accessed using the {@code http} or {@code https} + * protocol scheme. + * <p> + * A {@code Service} instance also captures an optional namespace context + * consisting of an optional owner name (or "-" wildcard) and optional app name + * (or "-" wildcard). + * <p> + * To access {@code Service} members, the {@code Service} instance must be + * authenticated by presenting credentials using the {@code login} method, or + * by constructing the {@code Service} instance using the {@code connect} + * method, which both creates and authenticates the instance. + */ +public class Service extends BaseService { + /** The current app context. */ + protected String app = null; + + /** The current session token. */ + protected String token = null; + + /** The current owner context. A value of "nobody" means that all users + * have access to the resource. + */ + protected String owner = null; + + /** The Splunk account username, which is used to authenticate the Splunk + * instance. */ + protected String username = null; + + /** The password, which is used to authenticate the Splunk instance. */ + protected String password = null; + + /** The default simple receiver endpoint. */ + protected String simpleReceiverEndPoint = "/services/receivers/simple"; + + /** The default password endpoint, can change over Splunk versions. */ + protected String passwordEndPoint = "admin/passwords"; + + /** The version of this Splunk instance, once logged in. */ + public String version = null; + + /** The type of this Splunk instance, once logged in. */ + public String instanceType = null; + + /** The default host name, which is used when a host name is not provided.*/ + public static String DEFAULT_HOST = "localhost"; + + /** The default port number, which is used when a port number is not + * provided. */ + public static int DEFAULT_PORT = 8089; + + /** The default scheme, which is used when a scheme is not provided. */ + public static String DEFAULT_SCHEME = "https"; + + /** + * Creates a new {@code Service} instance using a host. + * + * @param host The host name. + */ + public Service(String host) { + super(host); + } + + /** + * Creates a new {@code Service} instance using a host and port. + * + * @param host The host name. + * @param port The port number. + */ + public Service(String host, int port) { + super(host, port); + } + + /** + * Creates a new {@code Service} instance using a host, port, and + * scheme for accessing the service ({@code http} or {@code https}). + * + * @param host The host name. + * @param port The port number. + * @param scheme The scheme ({@code http} or {@code https}). + */ + public Service(String host, int port, String scheme) { + super(host, port, scheme); + } + + /** + * Constructs a new {@code Service} instance using the given host, + * port, and scheme, and instructing it to use the specified HTTPS handler. + * + * @param host The host name of the service. + * @param port The port number of the service. + * @param scheme Scheme for accessing the service ({@code http} or + * {@code https}). + * @param httpsHandler The URLStreamHandler instance + */ + public Service(String host, int port, String scheme, + URLStreamHandler httpsHandler) { + this.host = host; + this.port = port; + this.scheme = scheme; + this.httpsHandler = httpsHandler; + } + + /** + * Creates a new {@code Service} instance using a collection of arguments. + * + * @param args The {@code ServiceArgs} to initialize the service. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + @SuppressWarnings("deprecation") + public Service(ServiceArgs args) { + super(); + // NOTE: Must read the deprecated fields for backward compatibility. + // (Consider the case where the fields are initialized directly, + // rather than using the new setters.) + // NOTE: Must also read the underlying dictionary for forward compatibility. + // (Consider the case where the user calls Map.put() directly, + // rather than using the new setters.) + this.app = Args.<String>get(args, "app", args.app != null ? args.app : null); + this.host = Args.<String>get(args, "host", args.host != null ? args.host : DEFAULT_HOST); + this.owner = Args.<String>get(args, "owner", args.owner != null ? args.owner : null); + this.port = Args.<Integer>get(args, "port", args.port != null ? args.port : DEFAULT_PORT); + this.scheme = Args.<String>get(args, "scheme", args.scheme != null ? args.scheme : DEFAULT_SCHEME); + this.token = Args.<String>get(args, "token", args.token != null ? args.token : null); + this.username = (String)args.get("username"); + this.password = (String)args.get("password"); + this.httpsHandler = Args.<URLStreamHandler>get(args, "httpsHandler", null); + this.setSslSecurityProtocol(Args.get(args, "SSLSecurityProtocol", Service.getSslSecurityProtocol())); + this.addCookie((String)args.get("cookie")); + this.setCustomHeaders((Map<String, String>) args.get("customHeaders")); + } + + /** + * Creates a new {@code Service} instance using a map of arguments. + * + * @param args A {@code Map} of arguments to initialize the service. + */ + public Service(Map<String, Object> args) { + super(); + this.app = Args.<String>get(args, "app", null); + this.host = Args.<String>get(args, "host", DEFAULT_HOST); + this.owner = Args.<String>get(args, "owner", null); + this.port = Args.<Integer>get(args, "port", DEFAULT_PORT); + this.scheme = Args.<String>get(args, "scheme", DEFAULT_SCHEME); + this.token = Args.<String>get(args, "token", null); + this.username = (String)args.get("username"); + this.password = (String)args.get("password"); + this.httpsHandler = Args.<URLStreamHandler>get(args, "httpsHandler", null); + this.setSslSecurityProtocol(Args.get(args, "SSLSecurityProtocol", Service.getSslSecurityProtocol())); + this.addCookie((String)args.get("cookie")); + this.connectTimeout = Args.<Integer>get(args, "connectTimeout", null); + this.readTimeout = Args.<Integer>get(args, "readTimeout", null); + } + + /** + * Establishes a connection to a Splunk service using a map of arguments. + * This member creates a new {@code Service} instance and authenticates + * the session using credentials passed in from the {@code args} map. + * + * @param args The {@code args} map. + * @return A new {@code Service} instance. + */ + public static Service connect(Map<String, Object> args) { + Service service = new Service(args); + if (args.containsKey("username")) { + service.login(); + } + return service; + } + + /** + * Runs an export search (using the {@code search/jobs/export} endpoint), + * and streams results back in an input stream. + * + * @param search The search query to run. + * @return The {@code InputStream} object that contains the search results. + */ + public InputStream export(String search) { + return export(search, null); + } + + /** + * Runs an export search with arguments (using the {@code search/jobs/export} + * endpoint), and streams results back in an input stream. + * + * @param search The search query to run. + * @param args Additional search arguments. + * For a list of possible parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEHQ#savedsearchparams" + * target="_blank">Saved search parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEHQ" + * target="_blank">dev.splunk.com</a>. + * @return The {@code InputStream} object that contains the search results. + */ + public InputStream export(String search, Map args) { + args = Args.create(args).add("search", search); + // By default don't highlight search terms in the output. + if (!args.containsKey("segmentation")) { + args.put("segmentation", "none"); + } + ResponseMessage response; + + if(enableV2SearchApi()) + response = post(JobCollection.REST_PATH_V2 + "/export", args); + else { + response = post(JobCollection.REST_PATH + "/export", args); + } + return new ExportResultsStream(response.getContent()); + } + + /** + * Runs an export search with arguments (using the {@code search/jobs/export} + * endpoint), and streams results back in an input stream. + * + * @param search The search query to run. + * @param args Additional search arguments (see {@code JobExportArgs}). + * @return The {@code InputStream} object that contains the search results. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public InputStream export(String search, JobExportArgs args) { + return export(search, (Map<String, Object>) args); + } + + /** + * Ensures that the given path is fully qualified, prepending a path + * prefix if necessary. The path prefix is constructed using the current + * owner and app context when available. + * + * @param path The path to verify. + * @return A fully-qualified resource path. + */ + String fullpath(String path) { + return fullpath(path, null); + } + + /** + * Ensures that a given path is fully qualified, prepending a path + * prefix if necessary. The path prefix is constructed using the + * current owner and app context when available. + * + * @param path The path to verify. + * @param namespace The namespace dictionary (<i>app, owner, sharing</i>). + * @return A fully-qualified resource path. + */ + public String fullpath(String path, Args namespace) { + + // if already fully qualified (i.e. root begins with /) then return + // the already qualified path. + if (path.startsWith("/")) + return path; + + // if no namespace at all, and no service instance of app, and no + // sharing, return base service endpoint + path. + if (namespace == null && app == null) { + return "/services/" + path; + } + + // base namespace values + String localApp = app; + String localOwner = owner; + String localSharing = ""; + + // override with invocation namespace if set. + if (namespace != null) { + // URL encode the owner and app. + if (namespace.containsKey("app")) { + try { + localApp = URLEncoder.encode((String)namespace.get("app"), "UTF-8"); + } catch (UnsupportedEncodingException e) { + // This is unreachable, since UTF-8 is always supported. + assert false; + } + } + if (namespace.containsKey("owner")) { + try { + localOwner = URLEncoder.encode((String)namespace.get("owner"), "UTF-8"); + } catch (UnsupportedEncodingException e) { + // This is unreachable, since UTF-8 is always supported. + assert false; + } + } + if (namespace.containsKey("sharing")) { + localSharing = (String)namespace.get("sharing"); + } + } + + // sharing, if set calls for special mapping, override here. + // "user" --> {user}/{app} + // "app" --> nobody/{app} + // "global" --> nobody/{app} + // "system" --> nobody/system + if (localSharing.equals("app") || localSharing.equals("global")) + localOwner = "nobody"; + else if (localSharing.equals("system")) { + localApp = "system"; + localOwner = "nobody"; + } + + return String.format("/servicesNS/%s/%s/%s", + localOwner == null ? "-" : localOwner, + localApp == null ? "-" : localApp, + path); + } + + /** + * Returns the app context for this {@code Service} instance. + * A {@code null} value indicates no app context, and a value of + * {@code "-"} indicates an app wildcard. + * + * @return The app context. + */ + public String getApp() { + return this.app; + } + + /** + * Returns the collection of applications. + * + * @return The application collection. + */ + public EntityCollection<Application> getApplications() { + return new EntityCollection<Application>( + this, "/services/apps/local", Application.class); + } + + /** + * Returns the collection of configurations. + * + * @return The configurations collection. + */ + public ConfCollection getConfs() { + return getConfs(null); + } + + /** + * Returns the collection of configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return The configurations collection. + */ + public ConfCollection getConfs(Args args) { + return new ConfCollection(this, args); + } + + /** + * Returns an array of system capabilities. + * + * @return An array of capabilities. + */ + public String[] getCapabilities() { + Entity caps = new Entity(this, "authorization/capabilities"); + return caps.getStringArray("capabilities"); + } + + /** + * Returns the collection of data models. + * @return DataModelCollection instance + */ + public DataModelCollection getDataModels() { + return new DataModelCollection(this); + } + + /** + * Returns the configuration and status of a deployment client. + * + * @return The configuration and status. + */ + public DeploymentClient getDeploymentClient() { + return new DeploymentClient(this); + } + + /** + * Returns the configuration of all deployment servers. + * + * @return The configuration of deployment servers. + */ + public EntityCollection<DeploymentServer> getDeploymentServers() { + return getDeploymentServers(null); + } + + /** + * Returns the collection of deployment servers. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return The configuration of deployment servers. + */ + public EntityCollection<DeploymentServer> getDeploymentServers(Args args) { + String path; + if (versionIsEarlierThan("6.0.0")) { + path = "deployment/server"; + } else { + path = ""; // TODO: Find out what this should be and fix it. + } + return new EntityCollection<DeploymentServer>( + this, "deployment/server", DeploymentServer.class, args); + } + + /** + * Returns a collection of class configurations for a deployment server. + * + * @return A collection of class configurations. + */ + public EntityCollection<DeploymentServerClass> getDeploymentServerClasses(){ + return getDeploymentServerClasses(null); + } + + /** + * Returns a collection of class configurations for a deployment server. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of server class configurations. + */ + public EntityCollection<DeploymentServerClass> getDeploymentServerClasses( + Args args) { + String path; + if (versionIsEarlierThan("6.0.0")) { + path = "deployment/serverclass"; + } else { + path = "deployment/server/serverclasses"; + } + return new EntityCollection<DeploymentServerClass>( + this, path, DeploymentServerClass.class, args); + } + + /** + * Returns a collection of multi-tenant configurations. + * + * @return A collection of multi-tenant configurations. + */ + public EntityCollection<DeploymentTenant> getDeploymentTenants() { + return getDeploymentTenants(null); + } + + /** + * Returns a collection of multi-tenant configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of multi-tenant configurations. + */ + public EntityCollection<DeploymentTenant> getDeploymentTenants(Args args) { + return new EntityCollection<DeploymentTenant>( + this, "deployment/tenants", DeploymentTenant.class, args); + } + + /** + * Returns information about distributed search options. + * + * @return Distributed search information. + */ + public DistributedConfiguration getDistributedConfiguration() { + return new DistributedConfiguration(this); + } + + /** + * Returns a collection of distributed search peers. A <i>search peer</i> + * is a Splunk server to which another Splunk server distributes searches. + * The Splunk server where the search originates is referred to as the + * <i>search head</i>. + * + * @return A collection of search peers. + */ + public EntityCollection<DistributedPeer> getDistributedPeers() { + return getDistributedPeers(null); + } + + /** + * Returns a collection of distributed search peers. A <i>search peer</i> + * is a Splunk server to which another Splunk server distributes searches. + * The Splunk server where the search originates is referred to as the + * <i>search head</i>. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of search peers. + */ + public EntityCollection<DistributedPeer> getDistributedPeers(Args args) { + return new EntityCollection<DistributedPeer>( + this, "search/distributed/peers", DistributedPeer.class, args); + } + + + /** + * Returns a collection of saved event types. + * + * @return A collection of saved event types. + */ + public EventTypeCollection getEventTypes() { + return getEventTypes(null); + } + + /** + * Returns a collection of saved event types. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of saved event types. + */ + public EventTypeCollection getEventTypes(Args args) { + return new EventTypeCollection(this, args); + } + + /** + * Returns a collection of alerts that have been fired by the service. + * + * @return A collection of fired alerts. + */ + public FiredAlertGroupCollection getFiredAlertGroups() { + return getFiredAlertsGroups(null); + } + + /** + * Returns a collection of alerts that have been fired by the service. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of fired alerts. + */ + public FiredAlertGroupCollection getFiredAlertsGroups(Args args) { + return new FiredAlertGroupCollection(this, args); + } + + /** + * Returns a collection of Splunk indexes. + * + * @return A collection of indexes. + */ + public IndexCollection getIndexes() { + return getIndexes((IndexCollectionArgs)null); + } + + /** + * Returns a collection of Splunk indexes. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link IndexCollectionArgs}. + * @return A collection of indexes. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public IndexCollection getIndexes(IndexCollectionArgs args) { + return getIndexes((Args)args); + } + + /** + * Returns a collection of Splunk indexes. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link IndexCollectionArgs}. + * @return A collection of indexes. + */ + public IndexCollection getIndexes(Args args) { + return new IndexCollection(this, args); + } + + /** + * Returns information about the Splunk service. + * + * @return Splunk service information. + */ + public ServiceInfo getInfo() { + return new ServiceInfo(this); + } + + /** + * Returns list of all applicable Cluster Master Hosts for the SearchHead Service. + * + * @return List of Cluster Master Host(s). + */ + public List<String> getClusterMasters(){ + Entity caps = new Entity(this, "cluster/config"); + List<String> hosts = new ArrayList<String>(); + try { + String clusterMasterURIs = caps.getString("master_uri"); + URL clusterMasterUrl; + //for multi-cluster environment, there might be more than cluster master for the searchHead + if(clusterMasterURIs.contains(",")){ + String[] masterURIs = clusterMasterURIs.split(","); + for(String uri : masterURIs){ + clusterMasterUrl = new URL(uri); + hosts.add(clusterMasterUrl.getHost()); + } + }else { + clusterMasterUrl = new URL(clusterMasterURIs); + hosts.add(clusterMasterUrl.getHost()); + } + return hosts; + } catch (MalformedURLException e) { + e.printStackTrace(); + } + return hosts; + } + + /** + * Returns a collection of configured inputs. + * + * @return A collection of inputs. + */ + public InputCollection getInputs() { + return getInputs(null); + } + + /** + * Returns a collection of configured inputs. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of inputs. + */ + public InputCollection getInputs(Args args) { + return new InputCollection(this, args); + } + + /** + * Returns a collection of current search jobs. + * + * @return A collection of search jobs. + */ + public JobCollection getJobs() { + return getJobs((CollectionArgs)null); + } + + /** + * Returns a collection of current search jobs. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of search jobs. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public JobCollection getJobs(CollectionArgs args) { + return getJobs((Args)args); + } + + /** + * Returns a collection of current search jobs. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of search jobs. + */ + public JobCollection getJobs(Args args) { + return new JobCollection(this, args); + } + + /** + * Returns a Job by the provided sid. + * + * @param sid The sid for a job. + * @return A Job. + */ + public Job getJob(String sid) { + return new Job(this, JobCollection.REST_PATH + "/" + sid); + } + + /** + * Returns a collection of license group configurations. + * + * @return A collection of license group configurations. + */ + public EntityCollection<LicenseGroup> getLicenseGroups() { + return getLicenseGroups(null); + } + + /** + * Returns a collection of license group configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of license group configurations. + */ + public EntityCollection<LicenseGroup> getLicenseGroups(Args args) { + return new EntityCollection<LicenseGroup>( + this, "licenser/groups", LicenseGroup.class, args); + } + + /** + * Returns a collection of messages from the licenser. + * + * @return A collection of licenser messages. + */ + public EntityCollection<LicenseMessage> getLicenseMessages() { + return getLicenseMessages(null); + } + + /** + * Returns a collection of messages from the licenser. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of licenser messages. + */ + public EntityCollection<LicenseMessage> getLicenseMessages(Args args) { + return new EntityCollection<LicenseMessage>( + this, "licenser/messages", LicenseMessage.class, args); + } + + /** + * Returns the current owner context for this {@code Service} instance. + * A value of {@code "-"} indicates a wildcard, and a {@code null} value + * indicates no owner context. + * + * @return The current owner context. + */ + public String getOwner() { + return this.owner; + } + + /** + * Returns a collection of licenser pool configurations. + * + * @return A collection of licenser pool configurations. + */ + public LicensePoolCollection getLicensePools() { + return getLicensePools(null); + } + + /** + * Returns a collection of licenser pool configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of licenser pool configurations. + */ + public LicensePoolCollection getLicensePools(Args args) { + return new LicensePoolCollection(this, args); + } + + /** + * Returns a collection of slaves reporting to this license master. + * + * @return A collection of licenser slaves. + */ + public EntityCollection<LicenseSlave> getLicenseSlaves() { + return getLicenseSlaves(null); + } + + /** + * Returns a collection of slaves reporting to this license master. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of licenser slaves. + */ + public EntityCollection<LicenseSlave> getLicenseSlaves(Args args) { + return new EntityCollection<LicenseSlave>( + this, "licenser/slaves", LicenseSlave.class, args); + } + + /** + * Returns a collection of license stack configurations. + * + * @return A collection of license stack configurations. + */ + public EntityCollection<LicenseStack> getLicenseStacks() { + return getLicenseStacks(null); + } + + /** + * Returns a collection of license stack configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of license stack configurations. + */ + public EntityCollection<LicenseStack> getLicenseStacks(Args args) { + return new EntityCollection<LicenseStack>( + this, "licenser/stacks", LicenseStack.class, args); + } + + /** + * Returns a collection of licenses for this service. + * + * @return A collection of licenses. + */ + public EntityCollection<License> getLicenses() { + return getLicenses(null); + } + + /** + * Returns a collection of licenses for this service. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of licenses. + */ + public EntityCollection<License> getLicenses(Args args) { + return new EntityCollection<License>( + this, "licenser/licenses", License.class, args); + } + + /** + * Returns a collection of service logging categories and their status. + * + * @return A collection of logging categories. + */ + public EntityCollection<Logger> getLoggers() { + return getLoggers(null); + } + + /** + * Returns a collection of service logging categories and their status. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of logging categories. + */ + public EntityCollection<Logger> getLoggers(Args args) { + return new EntityCollection<Logger>( + this, "server/logger", Logger.class, args); + } + + /** + * Returns a collection of system messages. + * + * @return A collection of system messages. + */ + public MessageCollection getMessages() { + return getMessages(null); + } + + /** + * Returns a collection of system messages. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of system messages. + */ + public MessageCollection getMessages(Args args) { + return new MessageCollection(this, args); + } + + /** + * Returns a collection of modular inputs. + * + * @return A collection of modular inputs. + */ + public ResourceCollection<ModularInputKind> getModularInputKinds() { + return getModularInputKinds(null); + } + + /** + * Returns a collection of modular inputs. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of modular inputs. + */ + public ResourceCollection<ModularInputKind> getModularInputKinds(Args args) { + return new ResourceCollection<ModularInputKind>( + this, "data/modular-inputs", ModularInputKind.class, args); + } + + /** + * Returns global TCP output properties. + * + * @return Global TCP output properties. + */ + public OutputDefault getOutputDefault() { + return new OutputDefault(this); + } + + /** + * Returns a collection of output group configurations. + * + * @return A collection of output group configurations. + */ + public EntityCollection<OutputGroup> getOutputGroups() { + return getOutputGroups(null); + } + + /** + * Returns a collection of output group configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of output group configurations. + */ + public EntityCollection<OutputGroup> getOutputGroups(Args args) { + return new EntityCollection<OutputGroup>( + this, "data/outputs/tcp/group", OutputGroup.class, args); + } + + /** + * Returns a collection of data-forwarding configurations. + * + * @return A collection of data-forwarding configurations. + */ + public EntityCollection<OutputServer> getOutputServers() { + return getOutputServers(null); + } + + /** + * Returns a collection of data-forwarding configurations. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of data-forwarding configurations. + */ + public EntityCollection<OutputServer> getOutputServers(Args args) { + return new EntityCollection<OutputServer>( + this, "data/outputs/tcp/server", OutputServer.class, args); + } + + /** + * Returns a collection of configurations for forwarding data in standard + * syslog format. + * + * @return A collection of syslog forwarders. + */ + public EntityCollection<OutputSyslog> getOutputSyslogs() { + return getOutputSyslogs(null); + } + + /** + * Returns a collection of configurations for forwarding data in standard + * syslog format. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of syslog forwarders. + */ + public EntityCollection<OutputSyslog> getOutputSyslogs(Args args) { + return new EntityCollection<OutputSyslog>( + this, "data/outputs/tcp/syslog", OutputSyslog.class, args); + } + + /** + * Returns the current password that was used to authenticate the session. + * + * @return The current password. + */ + public String getPassword() { + return this.password; + } + + /** + * Returns a collection of passwords. This collection is used for managing + * secure credentials. + * + * @return A collection of passwords. + */ + public PasswordCollection getPasswords() { + return getPasswords(null); + } + + /** + * Returns a collection of passwords. This collection is used for managing + * secure credentials. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of passwords. + */ + public PasswordCollection getPasswords(Args args) { + return new PasswordCollection(this, args); + } + + /** + * Returns the receiver object for the Splunk service. + * + * @return A Splunk receiver object. + */ + public Receiver getReceiver() { + return new Receiver(this); + } + + /** + * Returns a collection of Splunk user roles. + * + * @return A collection of user roles. + */ + public EntityCollection<Role> getRoles() { + return getRoles(null); + } + + /** + * Returns a collection of Splunk user roles. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of user roles. + */ + public EntityCollection<Role> getRoles(Args args) { + return new EntityCollection<Role>( + this, "authorization/roles", Role.class, args); + } + + /** + * Returns a collection of saved searches. + * + * @return A collection of saved searches. + */ + public SavedSearchCollection getSavedSearches() { + return getSavedSearches((SavedSearchCollectionArgs)null); + } + + /** + * Returns a collection of saved searches. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link SavedSearchCollectionArgs}. + * @return A collection of saved searches. + */ + // NOTE: This overload exists primarily to provide better documentation + // for the "args" parameter. + public SavedSearchCollection getSavedSearches(SavedSearchCollectionArgs args) { + return getSavedSearches((Args)args); + } + + /** + * Returns a collection of saved searches. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of saved searches. + */ + public SavedSearchCollection getSavedSearches(Args args) { + return new SavedSearchCollection(this, args); + } + + /** + * Returns a Saved Search by the provided title key. + * + * @param title The title for a job. + * @return A SavedSearch. + */ + public SavedSearch getSavedSearch(String title) { + return new SavedSearch(this, JobCollection.REST_PATH + "/" + title); + } + + /** + * Returns service configuration information for an instance of Splunk. + * + * @return Service configuration information. + */ + public Settings getSettings() { + return new Settings(this); + } + + /** + * Returns the current session token. Session tokens can be shared across + * multiple {@code Service} instances. + * + * @return The session token. + */ + public String getToken() { + return this.token; + } + + /** + * Returns a collection of in-progress oneshot uploads. + * + * @return A collection of in-progress oneshot uploads + */ + public EntityCollection<Upload> getUploads() { + return getUploads(null); + } + + /** + * Returns a collection of in-progress oneshot uploads. + * + * @param namespace This collection's namespace; there are no other + * optional arguments for this endpoint. + * @return A collection of in-progress oneshot uploads + */ + public EntityCollection<Upload> getUploads(Args namespace) { + return new EntityCollection<Upload>( + this, "data/inputs/oneshot", Upload.class, namespace); + } + + /** + * Returns the Splunk account username that was used to authenticate the + * current session. + * + * @return The current username. + */ + public String getUsername() { + return this.username; + } + + /** + * Returns a collection of Splunk users. + * + * @return A collection of users. + */ + public UserCollection getUsers() { + return getUsers(null); + } + + /** + * Returns a collection of Splunk users. + * + * @param args Collection arguments that specify the number of entities to + * return and how to sort them. See {@link CollectionArgs}. + * @return A collection of users. + */ + public UserCollection getUsers(Args args) { + return new UserCollection(this, args); + } + + /** + * Authenticates the {@code Service} instance with the username and password + * that were specified when the instance was created. + * + * Three cases: + * 1. If we have a cookie, but are missing username and/or password, login is noop + * 2. If we don't have a cookie, and are missing username and/or password we can't login + * 3. Otherwise login as usual + * + * @return The current {@code Service} instance. + */ + public Service login() { + if (this.cookieStore.hasSplunkAuthCookie() && (this.username == null || this.password == null)) { + return this; + } + else if (this.username == null || this.password == null) { + throw new IllegalStateException("Missing username or password."); + } + else { + return login(this.username, this.password); + } + } + + /** + * Authenticates the {@code Service} instance with a specified username and + * password. Note that these values override any previously-set values for + * username and password. + * + * @param username The Splunk account username. + * @param password The password for the username. + * @return The current {@code Service} instance. + */ + public Service login(String username, String password) { + this.username = username; + this.password = password; + + Args args = new Args(); + args.put("username", username); + args.put("password", password); + args.put("cookie", "1"); + ResponseMessage response = post("/services/auth/login", args); + String sessionKey = Xml.parse(response.getContent()) + .getElementsByTagName("sessionKey") + .item(0) + .getTextContent(); + this.token = "Splunk " + sessionKey; + this.version = this.getInfo().getVersion(); + this.instanceType = this.getInfo().getInstanceType(); + if (versionCompare("4.3") >= 0) + this.passwordEndPoint = "storage/passwords"; + + return this; + } + + /** + * Forgets the current session token. + * + * @return The current {@code Service} instance. + */ + public Service logout() { + this.token = null; + this.removeAllCookies(); + return this; + } + + /** + * Creates a oneshot synchronous search. + * + * @param query The search query. + * @return The search results. + */ + public InputStream oneshotSearch(String query) { + return oneshotSearch(query, null); + } + + /** + * Creates a oneshot synchronous search using search arguments. + * + * @param query The search query. + * @param args The search arguments:<ul> + * <li>"output_mode": Specifies the output format of the results (XML, JSON, + * or CSV).</li> + * <li>"earliest_time": Specifies the earliest time in the time range to + * search. The time string can be a UTC time (with fractional seconds), a + * relative time specifier (to now), or a formatted time string.</li> + * <li>"latest_time": Specifies the latest time in the time range to search. + * The time string can be a UTC time (with fractional seconds), a relative + * time specifier (to now), or a formatted time string.</li> + * <li>"rf": Specifies one or more fields to add to the search.</li></ul> + * @return The search results. + */ + public InputStream oneshotSearch(String query, Map args) { + args = Args.create(args); + args.put("search", query); + args.put("exec_mode", "oneshot"); + + // By default, don't highlight search terms in the search output. + if (!args.containsKey("segmentation")) { + args.put("segmentation", "none"); + } + + ResponseMessage response = post(JobCollection.REST_PATH, args); + return response.getContent(); + } + + /** + * Creates a oneshot synchronous search using search arguments. + * + * @param query The search query. + * @param args The search arguments:<ul> + * <li>"output_mode": Specifies the output format of the results (XML, JSON, + * or CSV).</li> + * <li>"earliest_time": Specifies the earliest time in the time range to + * search. The time string can be a UTC time (with fractional seconds), a + * relative time specifier (to now), or a formatted time string.</li> + * <li>"latest_time": Specifies the latest time in the time range to search. + * The time string can be a UTC time (with fractional seconds), a relative + * time specifier (to now), or a formatted time string.</li> + * <li>"rf": Specifies one or more fields to add to the search.</li></ul> + * @return The search results. + */ + public InputStream oneshotSearch(String query, Args args) { + return oneshotSearch(query, (Map<String, Object>)args); + } + + /** + * Opens a raw socket to this service. + * + * @param port The port to open. This port must already have been + * created as an allowable TCP input to the service. + * @return The socket. + * @throws java.io.IOException The IOException instance + */ + public Socket open(int port) throws IOException { + return new Socket(this.host, port); + } + + /** + * Parses a search query and returns a semantic map for the search in JSON + * format. + * + * @param query The search query. + * @return The parse response message. + */ + public ResponseMessage parse(String query) { + return parse(query, null); + } + + /** + * Parses a search query with additional arguments and returns a semantic + * map for the search in JSON format. + * + * @param query The search query. + * @param args Additional parse arguments. + * @return The parse response message. + */ + public ResponseMessage parse(String query, Map args) { + args = Args.create(args).add("q", query); + + if(enableV2SearchApi()) + return post("search/v2/parser", args); + else + return get("search/parser", args); + } + + /** + * Restarts the service. The service will be unavailable until it has + * successfully restarted. + * + * @return The restart response message. + */ + public ResponseMessage restart() { + return post("server/control/restart"); + } + + /** + * Creates an asynchronous search using the given query. Use this + * method for simple searches. + * + * @param query The search query. + * @return The search job. + */ + public Job search(String query) { + return search(query, null); + } + + /** + * Creates an asynchronous search job using the given query and + * search arguments. + * + * @param query The search query. + * @param args The search arguments. + * @return The search job. + */ + public Job search(String query, Map<String, Object> args) { + args = Args.create(args); + + return this.getJobs().create(query, args); + } + + /** + * Issues an HTTP request against the service using a request path and + * message. + * This method overrides the base {@code HttpService.send} method + * and applies the Splunk authorization header, which is required for + * authenticated interactions with the Splunk service. + * + * @param path The request path. + * @param request The request message. + * @return The HTTP response. + */ + @Override public ResponseMessage send(String path, RequestMessage request) { + // cookieStore is a protected member of HttpService + if (token != null && !cookieStore.hasSplunkAuthCookie() ) { + request.getHeader().put("Authorization", token); + } + return super.send(fullpath(path), request); + } + + /** + * Provides a session token for use by this {@code Service} instance. + * Session tokens can be shared across multiple {@code Service} instances. + * + * @param value The session token, which is a basic authorization header in + * the format "Basic <i>sessiontoken</i>", where <i>sessiontoken</i> is the + * Base64-encoded "username:password" string. + */ + public void setToken(String value) { + this.token = value; + } + + /** + * Provides a session token having <b>Splunk</b> added before token. + * This method is specifically used when user just have token value. + * + * @param value The token value + */ + public void setSplunkToken(String value) { + this.token = value.contains("Splunk") ? value : "Splunk " + value; + } + + /** + * Provides a session token having <b>Bearer</b> added before token. + * This method is specifically used when user just have token value. + * + * @param value The token value + */ + public void setBearerToken(String value) { + this.token = value.contains("Splunk") || value.contains("Bearer") ? value : "Bearer " + value; + } + + + public boolean enableV2SearchApi(){ + if(null == this.instanceType){ + this.instanceType = this.getInfo().getInstanceType(); + } + if(this.instanceType.equalsIgnoreCase("cloud")) { + return versionIsAtLeast("9.0.2209"); + }else{ + return versionIsAtLeast("9.0.2"); + } + } + + /** + * Returns true if this Splunk instance's version is no earlier than + * the version specified in {@code version}. + * + * So when called on a Splunk 4.3.2 instance: + * * {@code versionIsAtLeast("4.3.2")} is {@code true}. + * * {@code versionIsAtLeast("4.1.0")} is {@code true}. + * * {@code versionIsAtLeast("5.0.0")} is {@code false}. + * + * @param version The version to compare this Splunk instance's version against. + * @return {@code true} if this Splunk instance's version is equal or + * greater than {@code version}; {@code false} otherwise. + */ + boolean versionIsAtLeast(String version) { + return versionCompare(version) >= 0; + } + + /** + * Returns true if this Splunk instance's version is earlier than + * the version specified in {@code version}. + * + * So when called on a Splunk 4.3.2 instance: + * * {@code versionIsEarlierThan("4.3.2")} is {@code false}. + * * {@code versionIsEarlierThan("4.1.0")} is {@code false}. + * * {@code versionIsEarlierThan("5.0.0")} is {@code true}. + * + * @param version The version to compare this Splunk instance's version against. + * @return {@code true} if this Splunk instance's version is less + * than {@code version}; {@code false} otherwise. + */ + boolean versionIsEarlierThan(String version) { + return versionCompare(version) < 0; + } + + /** + * Returns a value indicating how the version of this Splunk instance + * compares to a given version: + * <ul> + * <li>{@code -1 if this version < the given version}</li> + * <li>{@code 0 if this version = the given version}</li> + * <li>{@code 1 if this version > the given version}</li> + * </ul> + * + * @param otherVersion The other version to compare to. + * @return -1 if this version is less than, 0 if this version is equal to, + * or 1 if this version is greater than the given version. + */ + public int versionCompare(String otherVersion) { + if(null == this.version){ + this.version = this.getInfo().getVersion(); + } + String[] components1 = this.version.split("\\."); + String[] components2 = otherVersion.split("\\."); + int numComponents = Math.max(components1.length, components2.length); + + for (int i = 0; i < numComponents; i++) { + int c1 = (i < components1.length) + ? Integer.parseInt(components1[i], 10) : 0; + int c2 = (i < components2.length) + ? Integer.parseInt(components2[i], 10) : 0; + if (c1 < c2) { + return -1; + } else if (c1 > c2) { + return 1; + } + } + return 0; + } +} diff --git a/splunk/src/main/java/com/splunk/ServiceArgs.java b/splunk/src/main/java/com/splunk/ServiceArgs.java new file mode 100644 index 00000000..bf8f7f03 --- /dev/null +++ b/splunk/src/main/java/com/splunk/ServiceArgs.java @@ -0,0 +1,176 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.net.URLStreamHandler; +import java.util.Map; + +/** + * The {@code ServiceArgs} class contains a collection of arguments that are + * used to initialize a Splunk {@code Service} instance. + */ +public class ServiceArgs extends Args { + /** + * The application context of the service. + * + * @deprecated + * Use {@link #setApp(String)} instead. + */ + public String app = null; + + /** + * The host name of the service. + * + * @deprecated + * Use {@link #setHost(String)} instead. + */ + public String host = null; + + /** + * The owner context of the service. + * + * @deprecated + * Use {@link #setOwner(String)} instead. + */ + public String owner = null; + + /** + * The port number of the service. + * + * @deprecated + * Use {@link #setPort(int)} instead. + */ + public Integer port = null; + + /** + * The scheme to use for accessing the service. + * + * @deprecated + * Use {@link #setScheme(String)} instead. + */ + public String scheme = null; + + /** + * A Splunk authentication token to use for the session. + * + * @deprecated + * Use {@link #setToken(String)} instead. + */ + public String token = null; + + /** + * @param app + * The application context of the service. + */ + public void setApp(String app) { + this.app = app; // for backward compatibility + this.put("app", app); + } + + /** + * @param host + * The host name of the service. + */ + public void setHost(String host) { + this.host = host; // for backward compatibility + this.put("host", host); + } + + /** + * @param handler + * A URLStreamHandler to handle HTTPS requests for the service. + */ + public void setHTTPSHandler(URLStreamHandler handler) { + this.put("httpsHandler", handler); + } + + /** + * @param owner + * The owner context of the service. + */ + public void setOwner(String owner) { + this.owner = owner; // for backward compatibility + this.put("owner", owner); + } + + /** + * @param password + * The password to use when logging in. + */ + public void setPassword(String password) { + this.put("password", password); + } + + /** + * @param port + * The port number of the service. + */ + public void setPort(int port) { + this.port = port; // for backward compatibility + this.put("port", port); + } + + /** + * @param scheme + * The scheme to use for accessing the service. + */ + public void setScheme(String scheme) { + this.scheme = scheme; // for backward compatibility + this.put("scheme", scheme); + } + + /** + * @param securityProtocol + * The SSL security protocol for the service. + */ + public void setSSLSecurityProtocol(SSLSecurityProtocol securityProtocol) { + this.put("SSLSecurityProtocol", securityProtocol); + } + + /** + * @param token + * A Splunk authentication token to use for the session. + */ + public void setToken(String token) { + this.token = token; // for backward compatibility + this.put("token", token); + } + + /** + * @param username + * The username to use when logging in. + */ + public void setUsername(String username) { + this.put("username", username); + } + + /** + * @param cookie + * A valid login cookie. + */ + public void setCookie(String cookie) { + this.put("cookie", cookie); + } + + /** + * @param httpHeaders + * A map of customHeaders. + */ + public void setHttpHeaders(Map<String, String> httpHeaders) { + this.put("customHeaders", httpHeaders); + } +} diff --git a/splunk/src/main/java/com/splunk/ServiceInfo.java b/splunk/src/main/java/com/splunk/ServiceInfo.java new file mode 100644 index 00000000..16ec8aaa --- /dev/null +++ b/splunk/src/main/java/com/splunk/ServiceInfo.java @@ -0,0 +1,189 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code ServiceInfo} class contains information about a running Splunk + * {@code Service} instance (Splunkd). + */ +public class ServiceInfo extends Entity { + ServiceInfo(Service service) { + // We have to use an absolute path here, since + // server/info returns HTTP code 403 if it is + // used with any namespace specifier besides + // /services (i.e., don't use of servicesNS). + super(service, "/services/server/info"); + } + + /** + * Returns the build number of this Splunk instance. + * + * @return The build number. + */ + public String getBuild() { + return getString("build"); + } + + /** + * Returns the CPU architecture of this Splunk instance. + * + * @return The CPU architecture. + */ + public String getCpuArch() { + return getString("cpu_arch"); + } + + /** + * Returns a GUID identifying this Splunk instance. + * + * @return The Splunk instance GUID. + */ + public String getGuid() { + return getString("guid"); + } + + /** + * Returns an array of the service's license labels. + * + * @return An array of license labels. + */ + public String[] getLicenseLabels() { + return getStringArray("license_labels", null); + } + + /** + * Returns an array of the license keys for this Splunk instance. + * + * @return An array of license keys. + */ + public String[] getLicenseKeys() { + return getStringArray("licenseKeys", null); + } + + /** + * Returns the license signature for this Splunk instance. + * + * @return The license signature. + */ + public String getLicenseSignature() { + return getString("licenseSignature"); + } + + /** + * Returns the current license state of this Splunk instance. + * + * @return The license state. + */ + public String getLicenseState() { + return getString("licenseState"); + } + + /** + * Returns a GUID identifying the license master for this Splunk instance. + * + * @return The license master GUID. + */ + public String getMasterGuid() { + return getString("master_guid"); + } + + /** + * Returns the current mode of this Splunk instance. + * + * @return The mode. + */ + public String getMode() { + return getString("mode"); + } + + /** + * Returns the OS build of this Splunk instance. + * + * @return The OS build. + */ + public String getOsBuild() { + return getString("os_build"); + } + + /** + * Returns the service's OS name (type). + * + * @return The OS name. + */ + public String getOsName() { + return getString("os_name"); + } + + /** + * Returns the OS version of this Splunk instance. + * + * @return The OS version. + */ + public String getOsVersion() { + return getString("os_version"); + } + + /** + * Returns the server name of this Splunk instance. + * + * @return The server name. + */ + public String getServerName() { + return getString("serverName"); + } + + /** + * Returns the version number of this Splunk instance. + * + * @return The Splunk version number. + */ + public String getVersion() { + return getString("version"); + } + + public String getInstanceType() {return getString("instance_type", "");} + + /** + * Indicates whether this Splunk instance is running under a free license. + * + * @return {@code true} if the current license is a free license, + * {@code false} if not. + */ + public boolean isFree() { + return getBoolean("isFree"); + } + + /** + * Indicates whether real-time search is enabled for the service. + * + * @return {@code true} if real-time search is enabled, {@code false} if + * not. + */ + public boolean isRtSearchEnabled() { + return getBoolean("rtsearch_enabled", false); + } + + /** + * Indicates whether this Splunk instance is running under a trial license. + * + * @return {@code true} if the current license is a trial license, + * {@code false} if not. + */ + public boolean isTrial() { + return getBoolean("isTrial"); + } +} diff --git a/splunk/src/main/java/com/splunk/Settings.java b/splunk/src/main/java/com/splunk/Settings.java new file mode 100644 index 00000000..3cc28e55 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Settings.java @@ -0,0 +1,289 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.HashMap; +import java.util.Map; + +/** + * The {@code Settings} class represents configuration information for an + * instance of Splunk. + */ +public class Settings extends Entity { + Settings(Service service) { + super(service, "server/settings"); + } + + /** + * Returns the fully-qualified path to the directory containing the + * default index for this instance of Splunk. + * + * @return The path to the Splunk index directory. + */ + public String getSplunkDB() { + return getString("SPLUNK_DB"); + } + + /** + * Returns the fully-qualified path to the Splunk installation directory. + * + * @return The path to the Splunk installation directory. + */ + public String getSplunkHome() { + return getString("SPLUNK_HOME"); + } + + /** + * Indicates whether SSL is enabled on the Splunk management port. + * + * @return {@code true} if SSL is enabled, {@code false} if not. + */ + public boolean getEnableSplunkWebSSL() { + return getBoolean("enableSplunkWebSSL"); + } + + /** + * Returns the default host name to use for data inputs. + * + * @return The host name. + */ + public String getHost() { + return getString("host", null); + } + + /** + * Returns the port on which Splunk Web is listening for this + * instance of Splunk. The port number defaults to 8000. + * + * @return The Splunk Web port number. + */ + public int getHttpPort() { + return getInteger("httpport"); + } + + /** + * Returns the IP address:port number for Splunkd. + * + * @return The IP address:port number. + */ + public int getMgmtPort() { + return getInteger("mgmtHostPort"); + } + + /** + * Returns the amount of free disk space that is required for Splunk + * to continue searching and indexing. + * + * @return The required amount of free disk space, in megabytes. + */ + public int getMinFreeSpace() { + return getInteger("minFreeSpace"); + } + + /** + * Returns the string that is prepended to the Splunk symmetric key to + * generate the final key that used to sign all traffic between master and + * slave licensers. + * + * @return Licenser symmetric key. + */ + public String getPass4SymmKey() { + return getString("pass4SymmKey"); + } + + /** + * Returns the name that is used to identify this Splunk instance for + * features such as distributed search. + * + * @return The name used to identify the Splunk instance. + */ + public String getServerName() { + return getString("serverName"); + } + + /** + * Returns the amount of time before a user session times out. + * + * @return The session time-out. + */ + public String getSessionTimeout() { + return getString("sessionTimeout"); + } + + /** + * Indicates whether the instance is configured to start Splunk Web. + * + * @return {@code true} if the instance is configured to start Splunk Web, + * {@code false} if Splunk Web is disabled. + */ + public boolean getStartWebServer() { + return getBoolean("startwebserver"); + } + + /** + * Returns the IP address of the authenticating proxy. + * + * @return The IP address of the authenticating proxy. + */ + public String getTrustedIP() { + return getString("trustedIP", null); + } + + /** + * Sets the fully-qualified local path to the default index. + * The default value is {@code $SPLUNK_HOME/var/lib/splunk/defaultdb/db/}. + * + * @param path The local path to the default index. + */ + public void setSplunkDBPath(String path) { + setCacheValue("SPLUNK_DB", path); + } + + /** + * Sets whether Splunk Web uses HTTP or HTTPS. + * + * @param useHttps {@code true} to use SSL and HTTPS, {@code false} to use + * HTTP. + */ + public void setEnableSplunkWebSSL(boolean useHttps) { + setCacheValue("enableSplunkWebSSL", useHttps); + } + + /** + * Sets the default host name to use for data inputs that do not override + * this setting. + * + * @param host The default host name. + */ + public void setHost(String host) { + setCacheValue("host", host); + } + + /** + * Sets the Splunk Web listening port. If Splunk uses SSL and HTTPS, this + * value should be set to the HTTPS port number. + * <p> + * <b>Note:</b> The port must be present for Splunk Web to start. If this + * value is omitted or set to 0, the server will not start an HTTP listener. + * @see #getEnableSplunkWebSSL + * + * @param port The Splunk Web listening port. + */ + public void setHttpPort(int port) { + setCacheValue("httpport", port); + } + + /** + * Sets the management port for splunkd. + * The default value is {@code 8089}. + * + * @param port The port for the management interface. + */ + public void setMgmtPort(int port) { + setCacheValue("mgmtHostPort", port); + } + + /** + * Sets the amount of free disk space that must exist for splunkd to + * continue operating. + * <p> + * Before attempting to run a search, Splunk requires this amount of + * free space on the file system where the dispatch directory is stored + * ({@code $SPLUNK_HOME/var/run/splunk/dispatch}). + * + * @param minFreeSpace The minimum free space, in megabytes. + */ + public void setMinimumFreeSpace(int minFreeSpace) { + setCacheValue("minFreeSpace", minFreeSpace); + } + + /** + * Sets the password string that is prepended to the Splunk symmetric key + * to generate the final key, which is used to sign all traffic between + * master/slave licensers. + * + * @param pass4SymmKey The prepended password string. + */ + public void setPasswordSymmKey(String pass4SymmKey) { + setCacheValue("pass4SymmKey", pass4SymmKey); + } + + /** + * Sets the name that is used to identify this Splunk instance for features + * such as distributed search. The default value is + * {@code <hostname>-<user running splunk>}. + * + * @param serverName The server name. + */ + public void setServerName(String serverName) { + setCacheValue("serverName", serverName); + } + + /** + * Sets the session timeout. + * The valid format is <i>number</i> followed by a time unit ("s", "h", + * or "d"). + * + * @param sessionTimeout The session timeout value. + */ + public void setSessionTimeout(String sessionTimeout) { + setCacheValue("sessionTimeout", sessionTimeout); + } + + /** + * Sets whether to start Splunk Web. + * + * @param startwebserver {@code true} to start Splunk Web, {@code false} if + * not. + */ + public void setStartWebServer(boolean startwebserver) { + setCacheValue("startwebserver", startwebserver); + } + + /** + * Sets the IP address of the authenticating proxy. Set this value to a + * valid IP address to enable SSO. + * + * This attribute is disabled by default. The normal value is "127.0.0.1". + * + * @param trustedIP The authenticating proxy's IP address. + */ + public void setTrustedIP(String trustedIP) { + setCacheValue("trustedIP", trustedIP); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Merge cached setters and live args together before updating. + HashMap<String, Object> mergedArgs = new HashMap<String, Object>(); + mergedArgs.putAll(toUpdate); + mergedArgs.putAll(args); + service.post(path + "/settings", mergedArgs); + toUpdate.clear(); + invalidate(); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + service.post(path + "/settings", toUpdate); + invalidate(); + } +} diff --git a/splunk/src/main/java/com/splunk/SimpleCookieStore.java b/splunk/src/main/java/com/splunk/SimpleCookieStore.java new file mode 100644 index 00000000..4fd60664 --- /dev/null +++ b/splunk/src/main/java/com/splunk/SimpleCookieStore.java @@ -0,0 +1,93 @@ + +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.List; +import java.net.HttpCookie; +import java.util.Map; +import java.util.HashMap; +import java.lang.StringBuilder; + +/** + * The {@code SimpleCookieStore} class stores cookies for authentication. + */ +class SimpleCookieStore { + + public static final String SPLUNK_AUTH_COOKIE = "splunkd_"; + + private Map<String, String> cookieJar = new HashMap<String, String>(); + /** + * Adds cookies from a "Set-Cookie" header to the cookie store. + * + * @param setCookieHeader The result from a getRequestHeader("Set-Cookie") call + */ + public void add(String setCookieHeader) { + if (setCookieHeader != null) { + List<HttpCookie> cookies = HttpCookie.parse(setCookieHeader); + for (HttpCookie cookie : cookies) { + cookieJar.put(cookie.getName(), cookie.getValue()); + } + } + } + + /** + * Returns a string to be set as a "Cookie" header + * + * @return Cookie String in the format "Key=Value; Key=Value; etc" + */ + public String getCookies() { + StringBuilder cookieStringBuilder = new StringBuilder(); + + for (Map.Entry<String, String> cookie : cookieJar.entrySet()) { + cookieStringBuilder.append(cookie.getKey()); + cookieStringBuilder.append("="); + cookieStringBuilder.append(cookie.getValue()); + cookieStringBuilder.append("; "); + } + return cookieStringBuilder.toString(); + } + + /** + * Returns true if the cookie store is empty, false otherwise + * + * @return Boolean for whether or not the cookie store is empty + */ + public Boolean isEmpty() { + return cookieJar.isEmpty(); + } + + public boolean hasSplunkAuthCookie(){ + if(cookieJar.isEmpty()){ + return false; + } + for(String cookie : cookieJar.keySet()){ + if(cookie.startsWith(SPLUNK_AUTH_COOKIE)){ + return true; + } + } + return false; + } + + /** + * Removes all cookies from SimpleCookieStore + */ + public void removeAll() { + cookieJar.clear(); + } + +} diff --git a/splunk/src/main/java/com/splunk/SortDirection.java b/splunk/src/main/java/com/splunk/SortDirection.java new file mode 100644 index 00000000..758e3eb7 --- /dev/null +++ b/splunk/src/main/java/com/splunk/SortDirection.java @@ -0,0 +1,20 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + + +public enum SortDirection { ASCENDING, DESCENDING, DEFAULT +} diff --git a/splunk/com/splunk/ServiceArgs.java b/splunk/src/main/java/com/splunk/SplunkException.java similarity index 52% rename from splunk/com/splunk/ServiceArgs.java rename to splunk/src/main/java/com/splunk/SplunkException.java index 94e79665..e8fa6795 100644 --- a/splunk/com/splunk/ServiceArgs.java +++ b/splunk/src/main/java/com/splunk/SplunkException.java @@ -17,24 +17,28 @@ package com.splunk; /** - * A collection of arguments used to initialize a Splunk service instance. + * Thrown for Splunk responses that return an error status code. */ -public class ServiceArgs { - /** The application context for the service */ - public String app = null; +public class SplunkException extends RuntimeException { + private int code; + private String text; - /** The host name of the service */ - public String host = null; + public static final int JOB_NOTREADY = 1; + public static final int TIMEOUT = 2; + public static final int AMBIGUOUS = 3; + public static final int INTERRUPTED = 4; - /** The owner contet for the service */ - public String owner = null; + SplunkException(int code, String text) { + super(text); + this.code = code; + this.text = text; + } - /** The port number for the service */ - public Integer port = null; + public int getCode() { + return code; + } - /** The scheme to use for accessing the service */ - public String scheme = null; - - /** A Splunk auth token to use for the session */ - public String token = null; + public String getText() { + return text; + } } diff --git a/splunk/src/main/java/com/splunk/StatsFunction.java b/splunk/src/main/java/com/splunk/StatsFunction.java new file mode 100644 index 00000000..43b3cf86 --- /dev/null +++ b/splunk/src/main/java/com/splunk/StatsFunction.java @@ -0,0 +1,46 @@ +package com.splunk; + +public enum StatsFunction { + LIST { + public String toString() { return "list"; } + }, + DISTINCT_VALUES { + public String toString() { return "values"; } + }, + FIRST { + public String toString() { return "first"; } + }, + LAST { + public String toString() { return "last"; } + }, + COUNT { + public String toString() { return "count"; } + }, + DISTINCT_COUNT { + public String toString() { return "dc"; } + }, + SUM { + public String toString() { return "sum"; } + }, + AVERAGE { + public String toString() { return "average"; } + }, + MAX { + public String toString() { return "max"; } + }, + MIN { + public String toString() { return "min"; } + }, + STDEV { + public String toString() { return "stdev"; } + }, + DURATION { + public String toString() { return "duration"; } + }, + EARLIEST { + public String toString() { return "earliest"; } + }, + LATEST { + public String toString() { return "latest"; } + } +} diff --git a/splunk/src/main/java/com/splunk/StreamIterableBase.java b/splunk/src/main/java/com/splunk/StreamIterableBase.java new file mode 100644 index 00000000..8c423d3d --- /dev/null +++ b/splunk/src/main/java/com/splunk/StreamIterableBase.java @@ -0,0 +1,94 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.util.Iterator; +import java.util.NoSuchElementException; + +/** + * Helper class for iterator over readers that only support a get operation + * with null return indicating the end. + * @param <T> Type of elements. + */ +abstract class StreamIterableBase<T> implements Iterable<T> { + private T cachedElement; + private boolean nextElementCached; + + public Iterator<T> iterator() { + + return new Iterator<T>() { + + public boolean hasNext() { + cacheNextElement(); + return cachedElement != null; + } + + public T next() { + cacheNextElement(); + // Once reaching the end, don't advance any more. + // Otherwise underlying reader may throw + // which can be confusing. + if (cachedElement == null) { + throw new NoSuchElementException(); + } + else { + nextElementCached = false; + } + return cachedElement; + } + + public void remove() { + throw new UnsupportedOperationException(); + } + }; + } + + /** + * Get the next element. + * @return null if the end is reached. + * @throws IOException The IOException instance + */ + abstract T getNextElement() throws IOException; + + /** + * Interrupt the iteration by setting the iterator to + * either the initial state or the end state. + * @param hasMoreResults Whether or not there are more results. + */ + void resetIteration(boolean hasMoreResults) { + // Throw away any not-null cached element. + cachedElement = null; + // If there's no more results, i.e., the end is reached, + // set nextElementCached to true so that + // the iterator will not try to get the next element. + // Otherwise, if getNextElement is called by the iterator, + // the underlying reader may throw which can be confusing. + nextElementCached = !hasMoreResults; + } + + private void cacheNextElement() { + if (!nextElementCached) { + try { + cachedElement = getNextElement(); + } catch (IOException e) { + throw new RuntimeException(e); + } + nextElementCached = true; + } + } +} diff --git a/splunk/src/main/java/com/splunk/StringComparison.java b/splunk/src/main/java/com/splunk/StringComparison.java new file mode 100644 index 00000000..f79d71d7 --- /dev/null +++ b/splunk/src/main/java/com/splunk/StringComparison.java @@ -0,0 +1,49 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * Comparison operators for string valued fields. + */ +public enum StringComparison { + IS { + public String toString() { return "is"; } + }, + CONTAINS { + public String toString() { return "contains"; } + }, + IS_NOT { + public String toString() { return "isNot"; } + }, + DOES_NOT_CONTAIN { + public String toString() { return "doesNotContain"; } + }, + STARTS_WITH { + public String toString() { return "startsWith"; } + }, + ENDS_WITH { + public String toString() { return "endsWith"; } + }, + IS_NULL { + public String toString() { return "isNull"; } + }, + IS_NOT_NULL { + public String toString() { return "isNotNull"; } + }, + REGEX { + public String toString() { return "regex"; } + } +} diff --git a/splunk/src/main/java/com/splunk/StringPivotColumnSplit.java b/splunk/src/main/java/com/splunk/StringPivotColumnSplit.java new file mode 100644 index 00000000..8008c577 --- /dev/null +++ b/splunk/src/main/java/com/splunk/StringPivotColumnSplit.java @@ -0,0 +1,36 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; + +/** + * Represents a column split on a string valued field. + */ +public class StringPivotColumnSplit extends PivotColumnSplit { + StringPivotColumnSplit(DataModelObject dataModelObject, String field) { + super(dataModelObject, field); + } + + @Override + JsonObject toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/StringPivotFilter.java b/splunk/src/main/java/com/splunk/StringPivotFilter.java new file mode 100644 index 00000000..ca6769ee --- /dev/null +++ b/splunk/src/main/java/com/splunk/StringPivotFilter.java @@ -0,0 +1,53 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; + +/** + * Represents a filter on a string valued field. + */ +public class StringPivotFilter extends PivotFilter { + private final StringComparison comparison; + private final String comparisonValue; + + StringPivotFilter(DataModelObject dataModelObject, String fieldName, + StringComparison comparison, String comparisonValue) { + super(dataModelObject, fieldName); + if (dataModelObject.getField(fieldName).getType() != FieldType.STRING) { + throw new IllegalArgumentException("Field " + fieldName + " on the data model object was of type " + + dataModelObject.getField(fieldName).getType().toString() + ", expected string."); + } + this.comparison = comparison; + this.comparisonValue = comparisonValue; + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + JsonObject filterRule = new JsonObject(); + filterRule.add("comparator", new JsonPrimitive(this.comparison.toString())); + filterRule.add("compareTo", new JsonPrimitive(this.comparisonValue)); + + root.add("rule", filterRule); + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/StringPivotRowSplit.java b/splunk/src/main/java/com/splunk/StringPivotRowSplit.java new file mode 100644 index 00000000..0dbe6abb --- /dev/null +++ b/splunk/src/main/java/com/splunk/StringPivotRowSplit.java @@ -0,0 +1,35 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Represents a row split on a string valued field. + */ +public class StringPivotRowSplit extends PivotRowSplit { + StringPivotRowSplit(DataModelObject dataModelObject, String field, String label) { + super(dataModelObject, field, label); + } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + addCommonFields(root); + return root; + } +} diff --git a/splunk/com/splunk/OutputSyslog.java b/splunk/src/main/java/com/splunk/TcpConnections.java similarity index 52% rename from splunk/com/splunk/OutputSyslog.java rename to splunk/src/main/java/com/splunk/TcpConnections.java index 946fe4cc..2e6db9aa 100644 --- a/splunk/com/splunk/OutputSyslog.java +++ b/splunk/src/main/java/com/splunk/TcpConnections.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -15,37 +15,36 @@ */ package com.splunk; - /** - * Representation of a syslog output. + * The {@code TcpConnections} class represents a raw or cooked TCP connection. */ -public class OutputSyslog extends Entity { +public class TcpConnections extends Entity { /** - * Class Constructor. + * Class constructor. * - * @param service The connected service instance. - * @param path The output syslog endpoint. + * @param service The connected {@code Service} instance. + * @param path The TCP input endpoint. */ - OutputSyslog(Service service, String path) { + TcpConnections(Service service, String path) { super(service, path); } /** - * Returns this server's destination host:port. + * Returns the TCP connection. * - * @return This server's destination host:port. + * @return The TCP connection. */ - public String getServer() { - return getString("server"); + public String getConnection() { + return getString("connection", null); } /** - * Returns this server's connection type. + * Returns the server name. * - * @return this server's connection type. + * @return The server name. */ - public String getType() { - return getString("type"); + public String getServername() { + return getString("servername", null); } } diff --git a/splunk/src/main/java/com/splunk/TcpInput.java b/splunk/src/main/java/com/splunk/TcpInput.java new file mode 100644 index 00000000..29faa6b5 --- /dev/null +++ b/splunk/src/main/java/com/splunk/TcpInput.java @@ -0,0 +1,326 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.io.OutputStream; +import java.net.Socket; + +/** + * The {@code TcpInput} class represents a raw TCP data input. This differs from + * a <i>cooked</i> TCP input in that this TCP input is in raw form, and is not + * processed (or "cooked"). + */ +public class TcpInput extends PortInput { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The raw TCP input endpoint. + */ + TcpInput(Service service, String path) { + super(service, path); + } + + /** + * Returns a socket attached to this raw TCP input. + * @return Socket instance + * @throws IOException The IOException instance + */ + public Socket attach() throws IOException { + return new Socket(this.service.getHost(), this.getPort()); + } + + /** + * Submits events to this raw TCP input, reusing the connection. + * + * This method passes an output stream connected to the index to the + * {@code run} method of the {@code ReceiverBehavior} object, then handles + * setting up and tearing down the socket. + * For an example of how to use this method, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" target="_blank">How to + * get data into Splunk</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ2" + * target="_blank">dev.splunk.com</a>. + * @param behavior The ReceiverBehavior instance + * @throws IOException The IOException instance + */ + public void attachWith(ReceiverBehavior behavior) throws IOException { + Socket socket = null; + OutputStream output = null; + try { + socket = attach(); + output = socket.getOutputStream(); + behavior.run(output); + output.flush(); + } finally { + if (output != null) { output.close(); } + if (socket != null) { socket.close(); } + } + } + + /** + * Returns an object that contains the inbound raw TCP connections. + * + * @return The TCP connections object. + */ + public TcpConnections connections() { + return new TcpConnections(service, path + "/connections"); + } + + /** + * Returns the style of host connection. Valid values are: "ip", "dns", and + * "none". + * + * @return The style of host connection, or {@code null} if not specified. + */ + public String getConnectionHost() { + return getString("connection_host", null); + } + + /** + * Returns the group of this raw TCP input. + * + * @return The group. + */ + public String getGroup() { + return getString("group", null); + } + + /** + * Returns the source host of this raw TCP input where this indexer gets its + * data. + * + * @return The source host, or {@code null} if not specified. + */ + public String getHost() { + return getString("host", null); + } + + /** + * Returns the index name of this raw TCP input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index", null); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.Tcp; + } + + /** + * Returns the queue for this raw TCP input. Valid values are: + * "parsingQueue" and "indexQueue". + * + * @return The queue, or {@code null} if not specified. + */ + public String getQueue() { + return getString("queue", null); + } + + /** + * @deprecated Returns the value of the {@code _rcvbuf} attribute for this + * TCP input. + * + * @return The {@code _rcvbuf} value. + */ + public int getRcvBuf() { + return getInteger("_rcvbuf"); + } + + /** + * Returns the incoming host restriction for this raw TCP input. When + * specified, this input only accepts data from the specified host. + * + * @return The incoming host restriction, or {@code null} if not specified. + */ + public String getRestrictToHost() { + return getString("restrictToHost", null); + } + + /** + * Returns the initial source key for this raw TCP input. Typically this + * value is the input file path. + * + * @return The source key, or {@code null} if not specified. + */ + public String getSource() { + return getString("source", null); + } + + /** + * Returns the source type for events from this raw TCP input. + * + * @return The source type, or {@code null} if not specified. + */ + public String getSourceType() { + return getString("sourcetype", null); + } + + /** + * Indicates whether this raw TCP input is using secure socket layer (SSL). + * + * @return {@code true} if this input is using SSL, {@code false} if not. + */ + public boolean getSSL() { + return getBoolean("SSL", false); + } + + /** + * Sets whether to use secure socket layer (SSL). + * + * @param SSL {@code true} to use SSL, {@code false} if not. + */ + public void setSSL(boolean SSL) { + setCacheValue("SSL", SSL); + } + + /** + * Sets the value for the <b>from-host</b> field for the remote server that + * is sending data. Valid values are: <ul> + * <li>"ip": Sets the host to the IP address of the remote server sending + * data.</li> + * <li>"dns": Sets the host to the reverse DNS entry for the IP address of + * the remote server sending data.</li> + * <li>"none": Leaves the host as specified in inputs.conf, which is + * typically the Splunk system host name.</li></ul> + * + * @param connection_host The connection host information. + */ + public void setConnectionHost(String connection_host) { + setCacheValue("connection_host", connection_host); + } + + /** + * Sets whether this input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the host from which the indexer gets data. + * + * @param host The host name. + */ + public void setHost(String host) { + setCacheValue("host", host); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Submit a single event to this raw TCP input by opening the connection, + * submitting the event, and closing the connection. To submit multiple + * events, use {@code attachWith} to open a single connection. + * @see #attachWith + * + * @param eventBody A string that contains the event. + * @throws IOException The IOException instance + */ + public void submit(String eventBody) throws IOException { + Socket socket = null; + OutputStream output = null; + try { + socket = attach(); + output = socket.getOutputStream(); + output.write(eventBody.getBytes("UTF-8")); + output.flush(); + output.close(); + socket.close(); + } finally { + if (output != null) { output.close(); } + if (socket != null) { socket.close(); } + } + } + + /** + * Sets how the input processor should deposit the events it reads. Valid + * values are:<ul> + * <li>"parsingQueue": Applies props.conf and other parsing rules to your + * data.</li> + * <li>"indexQueue": Sends your data directly into the index.</li></ul> + * + * @param queue The queue-processing type. + */ + public void setQueue(String queue) { + setCacheValue("queue", queue); + } + + /** + * Sets the timeout value for adding a Done key. + * + * If a connection over the input port specified by {@code name} remains + * idle after receiving data for this specified number of seconds, it adds + * a Done key, implying that the last event has been completely received. + * + * @param rawTcpDoneTimeout The timeout value, in seconds. + */ + public void setRawTcpDoneTimeout(int rawTcpDoneTimeout) { + setCacheValue("rawTcpDoneTimeout", rawTcpDoneTimeout); + } + + /** + * Sets the initial value for the source key for events from this + * input. The source key is used during parsing and indexing. The + * <b>source</b> field is used for searches. As a convenience, the source + * string is prepended with "source::". + * <p> + * <b>Note:</b> Overriding the source key is generally not recommended. + * Typically, the input layer provides a more accurate string to aid in + * problem analysis and investigation, accurately recording the file from + * which the data was retrieved. Consider the use of source types, tagging, + * and search wildcards before overriding this value. + * + * @param source The source. + */ + public void setSource(String source) { + setCacheValue("source", source); + } + + /** + * Sets the source type for events from this raw TCP input. + * + * @param sourcetype The source type. + */ + public void setSourceType(String sourcetype) { + setCacheValue("sourcetype", sourcetype); + } +} diff --git a/splunk/src/main/java/com/splunk/TcpSplunkInput.java b/splunk/src/main/java/com/splunk/TcpSplunkInput.java new file mode 100644 index 00000000..a3121ffd --- /dev/null +++ b/splunk/src/main/java/com/splunk/TcpSplunkInput.java @@ -0,0 +1,198 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code TcpSplunkInput} class represents a Splunk-processed "cooked" TCP + * data input. This differs from a raw TCP input in that this cooked TCP data is + * processed by Splunk and is not in raw form. + */ +public class TcpSplunkInput extends PortInput { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The cooked TCP input endpoint. + */ + TcpSplunkInput(Service service, String path) { + super(service, path); + } + + /** + * Returns an object that contains the inbound cooked TCP connections. + * + * @return The TCP connections object. + */ + public TcpConnections connections() { + return new TcpConnections(service, path + "/connections"); + } + + /** + * Returns the style of host connection. Valid values are: "ip", "dns", and + * "none". + * + * @return The style of host connection, or {@code null} if not specified. + */ + public String getConnectionHost() { + return getString("connection_host", null); + } + + /** + * Returns the group for this cooked TCP input. + * + * @return The group. + */ + public String getGroup() { + return getString("group"); + } + + /** + * Returns the source host for this cooked TCP input where this indexer + * gets its data. + * + * @return The source host, or {@code null} if not specified. + */ + public String getHost() { + return getString("host"); + } + + /** + * Returns the index name for this cooked TCP input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index"); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.TcpSplunk; + } + + /** + * Returns the queue for this cooked TCP input. Valid values are: + * "parsingQueue" and "indexQueue". + * + * @return The queue, or {@code null} if not specified. + */ + public String getQueue() { + return getString("queue", null); + } + + /** + * @deprecated Returns the value of the {@code _rcvbuf} attribute for this + * cooked TCP input. + * + * @return The {@code _rcvbuf} value. + */ + public int getRcvBuf() { + return getInteger("_rcvbuf"); + } + + /** + * Returns the incoming host restriction for this cooked TCP input. + * + * @return The incoming host restriction, or {@code null} if not specified. + */ + public String getRestrictToHost() { + return getString("restrictToHost", null); + } + + /** + * Returns the initial source key for this cooked TCP input. Typically this + * value is the input file path. + * + * @return The source, or {@code null} if not specified. + */ + public String getSource() { + return getString("source", null); + } + + /** + * Returns the event source type for this cooked TCP input. + * + * @return The event source type, or {@code null} if not specified. + */ + public String getSourceType() { + return getString("sourceType", null); + } + + /** + * Indicates whether this cooked TCP input is using secure socket layer + * (SSL). + * + * @return {@code true} if this input is using SSL, {@code false} if not. + */ + public boolean getSSL() { + return getBoolean("SSL", false); + } + + /** + * Sets whether to use secure socket layer (SSL). + * + * @param SSL {@code true} to use SSL, {@code false} if not. + */ + public void setSSL(boolean SSL) { + setCacheValue("SSL", SSL); + } + + /** + * Sets the value for the <b>from-host</b> field for the remote server that + * is sending data. Valid values are: <ul> + * <li>"ip": Sets the host to the IP address of the remote server sending + * data.</li> + * <li>"dns": Sets the host to the reverse DNS entry for the IP address of + * the remote server sending data.</li> + * <li>"none": Leaves the host as specified in inputs.conf, which is + * typically the Splunk system host name.</li></ul> + * + * @param connection_host The connection host information. + */ + public void setConnectionHost(String connection_host) { + setCacheValue("connection_host", connection_host); + } + + /** + * Sets whether this input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the host from which the indexer gets data. + * + * @param host The host. + */ + public void setHost(String host) { + setCacheValue("host", host); + } +} diff --git a/splunk/src/main/java/com/splunk/TimestampBinning.java b/splunk/src/main/java/com/splunk/TimestampBinning.java new file mode 100644 index 00000000..de3cfe04 --- /dev/null +++ b/splunk/src/main/java/com/splunk/TimestampBinning.java @@ -0,0 +1,43 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +/** + * Possible bin sizes for timestamp valued fields in pivots. + */ +public enum TimestampBinning { + AUTO { + public String toString() { return "auto"; } + }, + YEAR { + public String toString() { return "year"; } + }, + MONTH { + public String toString() { return "month"; } + }, + DAY { + public String toString() { return "day"; } + }, + HOUR { + public String toString() { return "hour"; } + }, + MINUTE { + public String toString() { return "minute"; } + }, + SECOND { + public String toString() { return "second"; } + } +}; diff --git a/splunk/src/main/java/com/splunk/TimestampPivotColumnSplit.java b/splunk/src/main/java/com/splunk/TimestampPivotColumnSplit.java new file mode 100644 index 00000000..04638c8d --- /dev/null +++ b/splunk/src/main/java/com/splunk/TimestampPivotColumnSplit.java @@ -0,0 +1,40 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonObject; + +/** + * Represents a column split on a timestamp valued field in a pivot. + */ +public class TimestampPivotColumnSplit extends PivotColumnSplit { + private final TimestampBinning binning; + + TimestampPivotColumnSplit(DataModelObject owner, String fieldName, TimestampBinning binning) { + super(owner, fieldName); + this.binning = binning; + } + + public TimestampBinning getBinning() { return this.binning; } + + @Override + JsonObject toJson() { + JsonObject root = new JsonObject(); + addCommonFields(root); + root.addProperty("period", binning.toString()); + return root; + } +} diff --git a/splunk/src/main/java/com/splunk/TimestampPivotRowSplit.java b/splunk/src/main/java/com/splunk/TimestampPivotRowSplit.java new file mode 100644 index 00000000..4829e668 --- /dev/null +++ b/splunk/src/main/java/com/splunk/TimestampPivotRowSplit.java @@ -0,0 +1,46 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Represents a row split on a timestamp valued field in a pivot. + */ +public class TimestampPivotRowSplit extends PivotRowSplit { + private final TimestampBinning binning; + + TimestampPivotRowSplit(DataModelObject dataModelObject, String field, + String label, TimestampBinning binning) { + super(dataModelObject, field, label); + + this.binning = binning; + } + + public TimestampBinning getBinning() { return this.binning; } + + @Override + JsonElement toJson() { + JsonObject root = new JsonObject(); + + addCommonFields(root); + + root.addProperty("period", this.binning.toString()); + + return root; + } +} diff --git a/splunk/com/splunk/Input.java b/splunk/src/main/java/com/splunk/UdpConnections.java similarity index 57% rename from splunk/com/splunk/Input.java rename to splunk/src/main/java/com/splunk/UdpConnections.java index 1c937d8d..cb1c1b61 100644 --- a/splunk/com/splunk/Input.java +++ b/splunk/src/main/java/com/splunk/UdpConnections.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -15,30 +15,27 @@ */ package com.splunk; - /** - * Representation of an input. This class is the base for all typed input - * classes and is also used in any case where we do not recognize an input - * kind. + * The {@code UdpConnections} class represents a UDP connection. */ -public class Input extends Entity { +public class UdpConnections extends Entity { /** * Class constructor. * - * @param service The connected service instance. - * @param path The Input endpoint. + * @param service The connected {@code Service} instance. + * @param path The UPD input endpoint. */ - Input(Service service, String path) { + UdpConnections(Service service, String path) { super(service, path); } /** - * Returns unknown input kind. Overridden in sub-classes. + * Return the server name. * - * @return Unknown input kind. + * @return The server name. */ - public InputKind getKind() { - return InputKind.Unknown; + public String getGroup() { + return getString("group", null); } } diff --git a/splunk/src/main/java/com/splunk/UdpInput.java b/splunk/src/main/java/com/splunk/UdpInput.java new file mode 100644 index 00000000..baa6ff7d --- /dev/null +++ b/splunk/src/main/java/com/splunk/UdpInput.java @@ -0,0 +1,271 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.IOException; +import java.net.DatagramPacket; +import java.net.DatagramSocket; +import java.net.InetAddress; + +/** + * The {@code UdpInput} class represents a UDP data input. + */ +public class UdpInput extends PortInput { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The UDP input endpoint. + */ + UdpInput(Service service, String path) { + super(service, path); + } + + /** + * Returns an object that contains the inbound UDP connections. + * + * @return The UDP connections object. + */ + public UdpConnections connections() { + return new UdpConnections(service, path + "/connections"); + } + + /** + * Returns the style of host connection. Valid values are: "ip", "dns", and + * "none". + * + * @return The style of host connection, or {@code null} if not specified. + */ + public String getConnectionHost() { + return getString("connection_host", null); + } + + /** + * Returns the group for this UDP input. + * + * @return The group. + */ + public String getGroup() { + return getString("group"); + } + + /** + * Returns the source host for this UDP input, where this indexer gets its + * data. + * + * @return The source host, or {@code null} if not specified. + */ + public String getHost() { + return getString("host"); + } + + /** + * Returns the index name for this UDP input. + * + * @return The index name. + */ + public String getIndex() { + return getString("index"); + } + + /** + * Returns the input kind for this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.Udp; + } + + /** + * Returns the queue for this UDP input. Valid values are: + * "parsingQueue" and "indexQueue". + * + * @return The queue, or {@code null} if not specified. + */ + public String getQueue() { + return getString("queue", null); + } + + /** + * Returns the value of the {@code _rcvbuf} attribute for this + * UDP input. + * + * @return The {@code _rcvbuf} value. + * @deprecated This is not used anymore. No replacement. + */ + public int getRcvBuf() { + return getInteger("_rcvbuf"); + } + + /** + * Returns the initial source key for this UDP input. + * Typically, this value is the input file path. + * + * @return The source, or {@code null} if not specified. + */ + public String getSource() { + return getString("source", null); + } + + /** + * Returns the event source type for this UDP input. + * + * @return The event source type, or {@code null} if not specified. + */ + public String getSourceType() { + return getString("sourcetype", null); + } + + /** + * Indicates whether Splunk prepends a timestamp and host name to + * incoming events. + * + * @return {@code true} if Splunk does not prepend a timestamp and + * host name to incoming events, {@code false} if it does. + */ + public boolean getNoAppendingTimeStamp() { + return getBoolean("no_appending_timestamp", false); + } + + /** + * Indicates whether Splunk removes the <b>priority</b> field from incoming + * events. + * + * @return {@code true} if Splunk does not remove the <b>priority</b> field + * from incoming syslog events, {@code false} if it does. + */ + public boolean getNoPriorityStripping() { + return getBoolean("no_priority_stripping", false); + } + + /** + * Sets the value of the <b>from-host</b> field for the remote server that + * is sending data. + * Valid values are: <ul> + * <li>"ip": Sets the host to the IP address of the remote server sending + * data.</li> + * <li>"dns": Sets the host to the reverse DNS entry for the IP address of + * the remote server sending data.</li> + * <li>"none": Leaves the host as specified in inputs.conf, which is + * typically the Splunk system host name.</li></ul> + * + * @param connection_host The connection host information. + */ + public void setConnectionHost(String connection_host) { + setCacheValue("connection_host", connection_host); + } + + /** + * Sets the host from which the indexer gets data. + * + * @param host The host. + */ + public void setHost(String host) { + setCacheValue("host", host); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets whether Splunk should prepend a timestamp and host name to incoming + * events. + * + * @param no_appending_timestamp {@code true} to <i>not</i> prepend a + * timestamp and host name to incoming events, {@code false} to prepend that + * information. + */ + public void setNoAppendingTimeStamp(boolean no_appending_timestamp) { + setCacheValue("no_appending_timestamp", no_appending_timestamp); + } + + /** + * Sets whether Splunk should strip the <b>priority</b> field from incoming + * events. + * + * @param no_priority_stripping {@code true} to <i>not</i> strip the + * <b>priority</b> field, {@code false} to remove it. + */ + public void setNoPriorityStripping(boolean no_priority_stripping) { + setCacheValue("no_priority_stripping", no_priority_stripping); + } + + /** + * Sets how the input processor should deposit the events it reads. Valid + * values are:<ul> + * <li>"parsingQueue": Applies props.conf and other parsing rules to + * your data.</li> + * <li>"indexQueue": Sends your data directly into the index.</li> + * </ul> + * + * @param queue The queue-processing type. + */ + public void setQueue(String queue) { + setCacheValue("queue", queue); + } + + /** + * Sets the initial value for the source key for events from this + * input. The source key is used during parsing and indexing. The + * <b>source</b> field is used for searches. As a convenience, the source + * string is prepended with "source::". + * <p> + * <b>Note:</b> Overriding the source key is generally not recommended. + * Typically, the input layer provides a more accurate string to aid in + * problem analysis and investigation, accurately recording the file from + * which the data was retrieved. Consider the use of source types, tagging, + * and search wildcards before overriding this value. + * + * @param source The source. + */ + public void setSource(String source) { + setCacheValue("source", source); + } + + /** + * Sets the source type for events from this input. + * + * @param sourcetype The source type. + */ + public void setSourceType(String sourcetype) { + setCacheValue("sourcetype", sourcetype); + } + + /** + * Send a string to this UDP input. + * + * @param eventBody The text to send. + * @throws IOException The IOException instance + */ + public void submit(String eventBody) throws IOException { + DatagramSocket socket = new DatagramSocket(); + InetAddress address = InetAddress.getByName(this.service.getHost()); + int port = this.getPort(); + byte[] buffer = eventBody.getBytes("UTF-8"); + DatagramPacket packet = new DatagramPacket(buffer, buffer.length, address, port); + socket.send(packet); + socket.close(); + } +} diff --git a/splunk/src/main/java/com/splunk/Upload.java b/splunk/src/main/java/com/splunk/Upload.java new file mode 100644 index 00000000..00296465 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Upload.java @@ -0,0 +1,83 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Date; + +/** + * The {@code Upload} class represents an in-progress oneshot upload. Use this + * class to query the state of the upload. + * @see Index#upload + */ +public class Upload extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The oneshot input endpoint. + */ + Upload(Service service, String path) { + super(service, path); + } + + /** + * Returns the number of bytes that are currently indexed. + * + * @return The number of bytes. + */ + public int getBytesIndexed() { + return getInteger("Bytes Indexed"); + } + + /** + * Returns the current offset. + * + * @return The offset. + */ + public int getOffset() { + return getInteger("Offset"); + } + + /** + * Returns the current size. + * + * @return The size. + */ + public int getSize() { + return getInteger("Size"); + } + + /** + * Returns the number of sources that are indexed. + * + * @return The number of sources. + */ + public int getSourcesIndexed() { + return getInteger("Sources Indexed"); + } + + /** + * Returns the start time of the upload that is being indexed. + * + * @return The start time. + */ + public Date getSpoolTime() { + return getDate("Spool Time", null); + } +} + diff --git a/splunk/src/main/java/com/splunk/User.java b/splunk/src/main/java/com/splunk/User.java new file mode 100644 index 00000000..7ac729fb --- /dev/null +++ b/splunk/src/main/java/com/splunk/User.java @@ -0,0 +1,198 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code User} class represents a Splunk user who is registered on the + * current Splunk server. + */ +public class User extends Entity { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The user endpoint. + */ + User(Service service, String path) { + super(service, path); + } + + /** + * Returns the user's default app. + * + * @return The default app. + */ + public String getDefaultApp() { + return getString("defaultApp", null); + } + + /** + * Indicates whether the user's default app was set specifically by the + * user. + * + * @return {@code true} if the default app was set by the user, + * {@code false} if not. + */ + public boolean getDefaultAppIsUserOverride() { + return getBoolean("defaultAppIsUserOverride"); + } + + /** + * Returns the name of the role that the default app was inherited from, or + * {@code system} if it was inherited from the default system setting. + * + * @return The name of the role the default app was inherited from, or + * {@code system} if it was inherited from the default system + * settings. + */ + public String getDefaultAppSourceRole() { + return getString("defaultAppSourceRole"); + } + + /** + * Returns the user's email address. + * + * @return The user's email address. + */ + public String getEmail() { + return getString("email", null); + } + + /** + * Returns the user's password. + * + * @return The user's password. + */ + public String getPassword() { + return getString("password", null); + } + + /** + * Returns the full name associated with this user. + * + * @return The user's full name. + */ + public String getRealName() { + return getString("realname", null); + } + + /** + * Returns an array of roles assigned to this user. + * + * @return An array of roles. + */ + public String[] getRoles() { + return getStringArray("roles", null); + } + + /** + * Returns the authentication method responsible for this user. + * + * @return The authentication method for the user. + */ + public String getType() { + return getString("type", null); + } + + /** + * Returns the time zone to use when displaying dates for this user. + * + * @return The user's time zone. + */ + public String getTz() { + return getString("tz", null); + } + + /** + * Sets the default app for this user. + * + * @param defaultApp The default app. + */ + public void setDefaultApp(String defaultApp) { + setCacheValue("defaultApp", defaultApp); + } + + /** + * Sets the email address for this user. + * + * @param email The email address. + */ + public void setEmail(String email) { + setCacheValue("email", email); + } + + /** + * Sets this user's password. + * + * @param password The password. + */ + public void setPassword(String password) { + setCacheValue("password", password); + } + + /** + * Sets this user's real name. + * + * @param realname The real name. + */ + public void setRealName(String realname) { + setCacheValue("realname", realname); + } + + /** + * Sets whether to restart background search jobs when Splunk restarts. + * When {@code true}, a background search job for this user that has not + * completed is restarted when Splunk restarts. + * + * @param restart_background_jobs {@code true} to restart background + * search jobs, {@code false} if not. + */ + public void setRestartBackgroundJobs(boolean restart_background_jobs) { + setCacheValue("restart_background_jobs", restart_background_jobs); + } + + /** + * Sets the roles for this user. + * + * @param roles An array of roles. + */ + public void setRoles(String[] roles) { + setCacheValue("roles", roles); + } + + /** + * Sets this user's role. Use this method to set a single role rather than + * an array. + * + * @param role The role. + */ + public void setRoles(String role) { + setCacheValue("roles", new String [] { role }); + } + + /** + * Sets this user's time zone, which is used for display purposes. + * <p> + * <b>Note:</b> This attribute is valid in Splunk 4.3 and later. + * + * @param tz The timezone. + */ + public void setTz(String tz) { + setCacheValue("tz", tz); + } +} diff --git a/splunk/src/main/java/com/splunk/UserCollection.java b/splunk/src/main/java/com/splunk/UserCollection.java new file mode 100644 index 00000000..cce30dbe --- /dev/null +++ b/splunk/src/main/java/com/splunk/UserCollection.java @@ -0,0 +1,124 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code UserCollection} class represents a collection of Splunk users who + * are registered on the current Splunk server. + */ +public class UserCollection extends EntityCollection<User> { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + */ + UserCollection(Service service) { + super(service, "authentication/users", User.class); + } + + /** + * Constructs an instance of {@code UserCollection}. + * + * @param service The connected {@code Service} instance. + * @param args Collection arguments that specify the number of entities to + * return and how to sort them (see {@link CollectionArgs}). + */ + UserCollection(Service service, Args args) { + super(service, "authentication/users", User.class, args); + } + + /** + * Creates a new Splunk user from a username, password, and role. + * Usernames must be unique on the system, and are used by the user to log + * in to Splunk. + * + * @param name The username for the new user. + * @param password The password for the new user. + * @param role The role to assign to the new user. + * @return The new user. + */ + public User create(String name, String password, String role) { + return create(name, password, role, null); + } + + /** + * Creates a new Splunk user from a username, password, and array of + * roles. + * Usernames must be unique on the system, and are used by the user to log + * in to Splunk. + * + * @param name The username for the new user. + * @param password The password for the new user. + * @param roles Array of roles to assign to the new user. + * @return The new user. + */ + public User create(String name, String password, String[] roles) { + return create(name, password, roles, null); + } + + /** + * Creates a new Splunk user from a username, password, role, and + * additional arguments. + * Usernames must be unique on the system, and are used by the user to log + * in to Splunk. + * + * @param name The username for the new user. + * @param password The password for the new user. + * @param role The role to assign to the new user. + * @param args A map of additional arguments. For a list of available + * parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7#userauthparams" + * target="_blank">User authentication parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7" + * target="_blank">dev.splunk.com</a>. + * @return The new user. + */ + public User create(String name, String password, String role, Map args) { + args = Args.create(args); + args.put("password", password); + args.put("roles", role); + return create(name.toLowerCase(), args); + } + + /** + * Creates a new Splunk user from a username, password, array of + * roles, and additional arguments. + * Usernames must be unique on the system, and are used by the user to log + * in to Splunk. + * + * @param name The username for the new user. + * @param password The password for the new user. + * @param roles Array of roles to assign to the new user. + * @param args A map of additional arguments. For a list of available + * parameters, see + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7#userauthparams" + * target="_blank">User authentication parameters</a> on + * <a href="http://dev.splunk.com/view/SP-CAAAEJ7" + * target="_blank">dev.splunk.com</a> . + * @return The new user. + */ + public User + create(String name, String password, String[] roles, Map args) { + args = Args.create(args); + args.put("password", password); + args.put("roles", roles); + return create(name.toLowerCase(), args); + } +} diff --git a/splunk/src/main/java/com/splunk/Util.java b/splunk/src/main/java/com/splunk/Util.java new file mode 100644 index 00000000..dc9b9d10 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Util.java @@ -0,0 +1,120 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.File; +import java.util.Arrays; +import java.util.List; + +/** + * The {@code Util} class contains string utilities. + */ +class Util { + /** + * Joins the strings in {@code joinees}, separated by {@code joiner}. + * + * For example, {@code list} contains the strings {@code "a"}, {@code "b"}, + * and {@code "c"}. To combine these strings as "a/b/c", use + * {@code join("/", list)}. + * + * @param joiner The string to use as the delimiter between each element. + * @param joinees The list of strings to join. + * @return The combined strings in {@code joinees} separated by the + * {@code joiner} delimiter. + */ + public static String join(String joiner, List<String> joinees) { + if (joinees.isEmpty()) { + return ""; + } else { + StringBuilder joined = new StringBuilder(); + joined.append(joinees.get(0)); + for (String s : joinees.subList(1, joinees.size())) { + joined.append(joiner); + joined.append(s); + } + return joined.toString(); + } + } + + /** + * Joins the strings in {@code joinees}, separated by {@code joiner}. + * + * For example, {@code list} contains the strings {@code "a"}, {@code "b"}, + * and {@code "c"}. To combine these strings as "a/b/c", use + * {@code join("/", list)}. + * + * @param joiner The string to use as the delimiter between each element. + * @param joinees The array of strings to join. + * @return The combined strings in {@code joinees} separated by the + * {@code joiner} delimiter. + */ + public static String join(String joiner, String[] joinees) { + return join(joiner, Arrays.asList(joinees)); + } + + /** + * Searches a given string ({@code template}) for a substring + * ({@code toFind}) and returns the portion of the string that follows the + * substring. If the {@code toFind} string is not found in {@code template}, + * an alternative string ({@code defaultTo}) is returned. + * <br> + * For example: + * <br> + * {@code substringAfter("This is a test", "is a ", "abcd")} + * returns {@code "test"}. + * <br> + * {@code substringAfter("This is a test", "boris", + * "abcd")} returns {@code "abcd"}. + * + * @param template The string to search in. + * @param toFind The substring to search for. + * @param defaultTo The alternative string to return if {@code toFind} is + * not found. + * @return The substring of {@code template} that follows {@code toFind}, + * or {@code defaultTo} if {@code toFind} is not found. + */ + public static String substringAfter(String template, String toFind, String defaultTo) { + int toFindLength = toFind.length(); + int toFindOffset = template.indexOf(toFind); + int substringOffset = toFindOffset + toFindLength; + String returnValue; + if (toFindOffset == -1) { // toFind not found in template + returnValue = defaultTo; + } else { + returnValue = template.substring(substringOffset); + } + return returnValue; + } + + /** + * Throws an IllegalArgumentException if the specified namespace + * is a wildcarded namespace. + */ + public static void ensureNamespaceIsExact(Args namespace) { + String app = (String)namespace.get("app"); + String owner = (String)namespace.get("owner"); + + boolean wildcardedApp = (app == null || app.equals("-")); + boolean wildcardedOwner = (owner == null || owner.equals("-")); + boolean isExact = !wildcardedApp && !wildcardedOwner; + + if (!isExact) { + throw new IllegalArgumentException( + "An exact namespace must be provided."); + } + } +} diff --git a/splunk/com/splunk/Value.java b/splunk/src/main/java/com/splunk/Value.java similarity index 61% rename from splunk/com/splunk/Value.java rename to splunk/src/main/java/com/splunk/Value.java index e792719c..812bfcad 100644 --- a/splunk/com/splunk/Value.java +++ b/splunk/src/main/java/com/splunk/Value.java @@ -1,5 +1,5 @@ /* - * Copyright 2011 Splunk, Inc. + * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain @@ -23,15 +23,15 @@ import java.util.regex.Pattern; /** - * Value conversion helper functions. + * The {@code Value} class contains helper functions for value conversion. */ class Value { /** - * Convert the given {@code String} to a boolean value. + * Converts a {@code String} to a boolean value. * * @param value Value to convert. - * @return boolean value. + * @return Boolean value. */ static boolean toBoolean(String value) { if (value == null) return false; @@ -48,7 +48,7 @@ static boolean toBoolean(String value) { } /** - * Convert the given {@code String} to a numeric byte count. + * Converts a {@code String} to a numeric byte count. * * @param value Value to convert. * @return Count of bytes. @@ -71,52 +71,54 @@ else if (value.endsWith("GB")) return Long.parseLong(value) * multiplier; } - private static SimpleDateFormat dateFormat = null; + private static SimpleDateFormat[] dateFormat = null; private static Pattern datePattern = null; /** - * Convert the given {@code String} to a {@code Date} value. + * Converts a {@code String} to a {@code Date} value. * * @param value Value to convert. * @return Date value. */ - static Date toDate(String value) { + static synchronized Date toDate(String value) { if (dateFormat == null) { - dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ"); - dateFormat.setLenient(true); + dateFormat = new SimpleDateFormat[6]; + dateFormat[0] = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ"); + dateFormat[0].setLenient(true); + dateFormat[1] = new SimpleDateFormat("E MMM d HH:mm:ss z y"); + dateFormat[1].setLenient(true); + dateFormat[2] = new SimpleDateFormat("EEE MMM dd HH:mm:ss y"); + dateFormat[2].setLenient(true); + dateFormat[3] = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z"); + dateFormat[3].setLenient(true); + dateFormat[4] = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX"); + dateFormat[4].setLenient(true); + dateFormat[5] = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX"); + dateFormat[5].setLenient(true); } if (datePattern == null) { String pattern = "(.*)\\.\\d+([\\-+]\\d+):(\\d+)"; datePattern = Pattern.compile(pattern); } - Date result; - try { - // Must first remove the colon (':') from the timezone - // field, or SimpleDataFormat will not parse correctly. - // Eg: 2010-01-01T12:00:00+01:00 => 2010-01-01T12:00:00+0100 - Matcher matcher = datePattern.matcher(value); - value = matcher.replaceAll("$1$2$3"); - result = dateFormat.parse(value); + + for (SimpleDateFormat simpleDateFormat: dateFormat) { + try { + + Matcher matcher = datePattern.matcher(value); + value = matcher.replaceAll("$1$2$3"); + return simpleDateFormat.parse(value); + } + catch (ParseException e) {} } - catch (ParseException e) { - throw new RuntimeException(e.getMessage()); + try { + return new Date(Long.parseLong(value)*1000); + } catch (Exception e) { + throw new RuntimeException(e.getMessage(), e); } - return result; - } - - /** - * Convert the given {@code String}, representing a date from the epoch, - * to a {@code Date} value. - * - * @param value Value to convert. - * @return Date value. - */ - static Date toDateFromEpoch(String value) { - return new Date(Long.parseLong(value)*1000); } /** - * Convert the given {@code String} to a {@code float} value. + * Converts a {@code String} to a {@code float} value. * * @param value Value to convert. * @return {@code float} value. @@ -126,7 +128,7 @@ static float toFloat(String value) { } /** - * Convert the given {@code String} to an {@code int} value. + * Converts a {@code String} to an {@code int} value. * * @param value Value to convert. * @return {@code int} value. @@ -136,7 +138,7 @@ static int toInteger(String value) { } /** - * Convert the given {@code String} to a {@code long} value. + * Converts a {@code String} to a {@code long} value. * * @param value Value to convert. * @return {@code long} value. diff --git a/splunk/src/main/java/com/splunk/WindowsActiveDirectoryInput.java b/splunk/src/main/java/com/splunk/WindowsActiveDirectoryInput.java new file mode 100644 index 00000000..e43dc310 --- /dev/null +++ b/splunk/src/main/java/com/splunk/WindowsActiveDirectoryInput.java @@ -0,0 +1,170 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code WindowsActiveDirectoryInput} class represents a Windows Active + * Directory data input. + */ +public class WindowsActiveDirectoryInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The Windows Active Directory input endpoint. + */ + WindowsActiveDirectoryInput(Service service, String path) { + super(service, path); + } + + /** + * Returns the index name of this Windows Active Directory input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index", null); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.WindowsActiveDirectory; + } + + /** + * Indicates whether the directory path subtree is being monitored for + * this Windows Active Directory input. + * + * @return {@code true} if the directory path subtree is being monitored, + * {@code false} if not. + */ + public boolean getMonitorSubtree() { + return getBoolean("monitorSubtree"); + } + + /** + * Returns the starting location in the directory path for this Windows + * Active Directory input. If not specified, the root of the directory + * tree is used. + * + * @return The starting location in the directory path, or {@code null} if + * not specified. + */ + public String getStartingNode() { + return getString("startingNode", null); + } + + /** + * Returns the fully-qualified domain name of a valid, network-accessible + * domain controller. If not specified, the local machine is used. + * + * @return The fully-qualified domain name, or {@code null} if not + * specified. + */ + public String getTargetDc() { + return getString("targetDc", null); + } + + /** + * Sets whether this input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets whether to monitor the subtrees of the given directory tree + * path. + * + * @param monitorSubtree {@code true} to monitor subtrees, {@code false} + * if not. + */ + public void setMonitorSubtree(boolean monitorSubtree) { + setCacheValue("monitorSubtree", monitorSubtree); + } + + /** + * Sets the starting Active Directory directory to start monitoring. If this + * value is not specified, Splunk attempts to start monitoring at the root + * of the directory tree. + * + * @param startingNode The starting Active Directory directory. + */ + public void setStartingNode(String startingNode) { + setCacheValue("startingNode", startingNode); + } + + /** + * Sets the fully-qualified domain name of a valid, network-accessible + * domain controller. If this value is not specified, Splunk obtains the + * local computer's domain controller. + * + * @param targetDc The fully-qualified domain name. + */ + public void setTargetDc(String targetDc) { + setCacheValue("targetDc", targetDc); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("monitorSubtree")) { + args = Args.create(args).add( + "monitorSubtree", getMonitorSubtree()); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("monitorSubtree")) { + setCacheValue( + "monitorSubtree", getMonitorSubtree()); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/WindowsEventLogInput.java b/splunk/src/main/java/com/splunk/WindowsEventLogInput.java new file mode 100644 index 00000000..3b733a0d --- /dev/null +++ b/splunk/src/main/java/com/splunk/WindowsEventLogInput.java @@ -0,0 +1,162 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code WindowsEventLogInput} class represents a Windows Event Log data + * input. + */ +public class WindowsEventLogInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The Windows Event Log input endpoint. + */ + WindowsEventLogInput(Service service, String path) { + super(service, path); + } + + /** + * Returns a list of secondary hosts used for monitoring. To list the main + * host, use the {@code getLookupHost} method. + * @see #getLookupHost + * + * @return A comma-separated list of additional hosts used in monitoring, + * or {@code null} if not specified. + */ + public String getHosts() { + return getString("hosts", null); + } + + /** + * Returns the index name of this Windows Event Log input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index", null); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.WindowsEventLog; + } + + /** + * Returns the list of event log names to gather data from for this Windows + * Event Log input. + * + * @return The list of event log names, or {@code null} if not specified. + */ + public String [] getLogs() { + return getStringArray("logs", null); + } + + /** + * Returns the collection name of this Windows Event Log input. This name + * appears in the configuration file, the source, and the sourcetype of + * the indexed data. If the value is "localhost", it will use native event + * log collection; otherwise, it will use WMI. + * + * @return The collection name. + */ + public String getLocalName() { + return getString("name"); + } + + /** + * Returns the main host of this Windows Event Log input. To list secondary + * hosts, use the {@code getHosts} method. + * @see #getHosts + * + * @return The main host. + */ + public String getLookupHost() { + return getString("lookup_host"); + } + + /** + * Sets a list of secondary hosts to be used for monitoring. Specify the + * main host using the {@code setLookupHost} method. + * @see #setLookupHost + * + * @param hosts The comma-separated list of additional hosts. + */ + public void setHosts(String hosts) { + setCacheValue("hosts", hosts); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets the list of event log names to gather data from. + * + * @param logs The list of event log names. + */ + public void setLogs(String logs) { + setCacheValue("logs", logs); + } + + /** + * Sets the main host from which to monitor log events. To specify + * additional hosts to use for monitoring, use the {@code setHosts} method. + * @see #setHosts + * + * @param lookup_host The main host. + */ + public void setLookupHost(String lookup_host) { + setCacheValue("lookup_host", lookup_host); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("lookup_host")) { + args = Args.create(args).add("lookup_host", getLookupHost()); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attribute as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("lookup_host")) { + setCacheValue("lookup_host", getLookupHost()); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/WindowsPerfmonInput.java b/splunk/src/main/java/com/splunk/WindowsPerfmonInput.java new file mode 100644 index 00000000..9177b0f0 --- /dev/null +++ b/splunk/src/main/java/com/splunk/WindowsPerfmonInput.java @@ -0,0 +1,176 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * The {@code WindowsPerfmonInput} class represents a Windows Performance + * Monitor (Perfmon) data input. + */ +public class WindowsPerfmonInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The Windows Perfmon input endpoint. + */ + WindowsPerfmonInput(Service service, String path) { + super(service, path); + } + + /** + * Returns a list of monitored counters for this Windows Perfmon input. + * An asterisk (*) is equivalent to all counters. + * + * @return A string array list of counters, or {@code null} if not + * specified. + */ + public String[] getCounters() { + return getStringArray("counters", null); + } + + /** + * Returns the index name of this Windows Perfmon input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index", null); + } + + /** + * Returns the counter instances of this Windows Perfmon input. An asterisk + * (*) is equivalent to all instances. + * + * @return A string array of counter instances, or {@code null} if not + * specified. + */ + public String[] getInstances() { + return getStringArray("instances", null); + } + + /** + * Returns the interval at which to poll the performance counters for this + * Windows Perfmon input. + * + * @return The polling interval, in seconds. + */ + public int getInterval() { + return getInteger("interval"); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.WindowsPerfmon; + } + + /** + * Returns the performance monitor object for this Windows + * Perfmon input (for example, "Process", "Server", or "PhysicalDisk"). + * + * @return A string containing the performance monitor object. + */ + public String getObject() { + return getString("object"); + } + + /** + * Sets the counters to monitor. + * + * @param counters An array of counters to monitor. + */ + public void setCounters(String[] counters) { + setCacheValue("counters", counters); + } + + /** + * Sets a counter to monitor. A wildcard value of an asterisk (*) means + * all counters. Use this method to set a single counter rather than an + * array. + * + * @param counter The counter to monitor. + */ + public void setCounters(String counter) { + setCacheValue("counters", new String [] { counter }); + } + + /** + * Sets whether this input is enabled or disabled. + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets the counter instances to monitor. + * + * @param instances The counter instances to monitor. + */ + public void setInstances(String[] instances) { + setCacheValue("instances", instances); + } + + /** + * Sets a counter instance to monitor. A wildcard value of an asterisk (*) + * means all instances. Use this method to set a single instance rather than + * an array. + * + * @param instance A counter instance to monitor. + */ + public void setInstances(String instance) { + setCacheValue("instances", new String [] { instance }); + } + + /** + * Sets the frequency to poll the performance counters. + * + * @param interval The polling frequency, in seconds. + */ + public void setInterval(int interval) { + setCacheValue("interval", interval); + } + + /** + * Sets the performance monitor object (for example, "Process", "Server", or + * "PhysicalDisk"). + * + * @param object The performance monitor object. + */ + public void setObject(String object) { + setCacheValue("object", object); + } +} diff --git a/splunk/src/main/java/com/splunk/WindowsRegistryInput.java b/splunk/src/main/java/com/splunk/WindowsRegistryInput.java new file mode 100644 index 00000000..3d78500d --- /dev/null +++ b/splunk/src/main/java/com/splunk/WindowsRegistryInput.java @@ -0,0 +1,261 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code WindowsRegistryInput} class represents a Windows Registry data + * input. + */ +public class WindowsRegistryInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The Windows Registry input endpoint. + */ + WindowsRegistryInput(Service service, String path) { + super(service, path); + } + + /** + * Indicates whether this Windows Registry input has an established + * baseline. + * + * @return {@code true} if this Windows Registry input has an established + * baseline, {@code false} if not. + */ + public boolean getBaseline() { + return getBoolean("baseline"); + } + + /** + * Returns the regular expression (regex) that is compared to process + * names when including or excluding events for this Windows Registry input. + * Changes are only collected if a process name matches this regex. + * + * @return The process names regex. + */ + public String getProc() { + return getString("proc"); + } + + /** + * Returns the hive name to monitor for this Windows Registry input. + * + * @return The hive name to monitor. + */ + public String getHive() { + return getString("hive"); + } + + /** + * Returns the index name for this Windows Registry input. + * + * @return The index name. + */ + public String getIndex() { + return getString("index"); + } + + /** + * Returns the input kind for this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.WindowsRegistry; + } + + /** + * Indicates whether this Windows Registry input monitors all + * sub-nodes under a given hive. + * + * @return {@code true} if this Windows Registry input monitors all + * sub-nodes under a given hive, {@code false} if not. + */ + public boolean getMonitorSubnodes() { + return getBoolean("monitorSubnodes", false); + } + + /** + * Returns the regular expressions (regexes) that are compared to registry + * event types for this Windows Registry input. Only types that match + * at least one of the regexes are monitored. + * + * @return An array of regex strings for event types. + */ + public String[] getType() { + if (toUpdate.containsKey("type")) { + String value = (String)toUpdate.get("type"); + if (value.contains("|")) { + return value.split("\\|"); + } + else { + return new String[]{value}; + } + } + else { + // Before Splunk 6, the type was returned in a form like ["create", "delete"]. + // In Splunk 6, it has changed to create|delete, which is symmetric with the values taken + // by setType. + if (service.versionIsEarlierThan("6.0.0")) { + return getStringArray("type", new String[] {}); + } else { + String types = getString("type", null); + if (types == null) { + return new String[]{}; + } else { + return types.split("\\|"); + } + } + } + } + + /** + * Sets whether to establish a baseline value for the registry keys. + * + * @param baseline {@code true} to establish a baseline value, {@code false} + * if not. + */ + public void setBaseline(boolean baseline) { + setCacheValue("baseline", baseline); + } + + /** + * Sets whether this input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the registry hive under which to monitor for changes. + * + * @param hive The registry hive. + */ + public void setHive(String hive) { + setCacheValue("hive", hive); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets whether to monitor the subnodes of the given registry hive. + * + * @param monitorSubnodes {@code true} for this Windows Registry input to + * monitor all sub-nodes, {@code false} if not. + */ + public void setMonitorSubnodes(boolean monitorSubnodes) { + // In Splunk 6, monitor subnodes is a trailing string on hive. + if (service.versionIsAtLeast("6.0.0")) { + if (getHive().endsWith("\\\\?.*")) { + if (!monitorSubnodes) { + setHive(getHive().substring(0, getHive().length()-5)); + } + } else { + if (monitorSubnodes) { + setHive(getHive() + "\\\\?.*"); + } + } + } else { + // In Splunk 5 and earlier, it's a separate field. + setCacheValue("monitorSubnodes", monitorSubnodes); + } + } + + /** + * Sets the regular expression (regex) that is compared to process + * names when including or excluding events for this Windows Registry input. + * Changes are only collected if a process name matches this regex. + * + * @param proc The process names regex. + */ + public void setProc(String proc) { + setCacheValue("proc", proc); + } + + /** + * Sets the regular expressions (regexes) that are compared to registry + * event types for this Windows Registry input. Only types that match + * at least one regex are monitored. + * + * @param regexes An array of regex strings for event types. + */ + public void setType(String[] regexes) { + String val = Util.join("|", regexes); + setCacheValue("type", val); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // Add required arguments if not already present + if (!args.containsKey("baseline")) { + args = Args.create(args).add("baseline", getBaseline()); + } + if (!args.containsKey("hive")) { + args = Args.create(args).add("hive", getHive()); + } + if (!args.containsKey("proc")) { + args = Args.create(args).add("proc", getProc()); + } + if (!args.containsKey("type")) { + args = Args.create(args).add("type", Util.join("|", getType())); + } + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attributes as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("baseline")) { + setCacheValue("baseline", getBaseline()); + } + if (toUpdate.size() > 0 && !toUpdate.containsKey("hive")) { + setCacheValue("hive", getHive()); + } + if (toUpdate.size() > 0 && !toUpdate.containsKey("proc")) { + setCacheValue("proc", getProc()); + } + if (toUpdate.size() > 0 && !toUpdate.containsKey("type")) { + setCacheValue("type", Util.join("|", getType())); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/WindowsWmiInput.java b/splunk/src/main/java/com/splunk/WindowsWmiInput.java new file mode 100644 index 00000000..7b4911bc --- /dev/null +++ b/splunk/src/main/java/com/splunk/WindowsWmiInput.java @@ -0,0 +1,274 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +/** + * The {@code WindowsWmiInput} class represents a Windows Management + * Instrumentation (WMI) data input. + */ +public class WindowsWmiInput extends Input { + + /** + * Class constructor. + * + * @param service The connected {@code Service} instance. + * @param path The Windows WMI input endpoint. + */ + WindowsWmiInput(Service service, String path) { + super(service, path); + } + + /** + * Returns the WMI class name of this WMI input. + * + * @return The WMI class name. + */ + public String getClasses() { + return getString("classes"); + } + + /** + * Returns the properties (fields) collected for this class for this WMI + * input. + * + * @return The list of properties collected for this class, or {@code null} + * if not specified. + */ + public String [] getFields() { + return getStringArray("fields", null); + } + + /** + * Returns the index name of this WMI input. + * + * @return The index name, or {@code null} if not specified. + */ + public String getIndex() { + return getString("index", null); + } + + /** + * Returns a list of the WMI class instances for this WMI input. + * + * @return A list of the WMI class instances, or {@code null} if not + * specified. + */ + public String [] getInstances() { + return getStringArray("instances", null); + } + + /** + * Returns the interval at which WMI input providers are queried for this + * WMI input. + * + * @return The WMI query interval, in seconds. + */ + public int getInterval() { + return getInteger("interval"); + } + + /** + * Returns the input kind of this input. + * + * @return The input kind. + */ + public InputKind getKind() { + return InputKind.WindowsWmi; + } + + /** + * Returns the main server for this WMI input. To list secondary servers, + * use the {@code getServers} method. + * @see #getServers + * + * @return The main server. + */ + public String getLookupHost() { + return getString("lookup_host"); + } + + /** + * Returns the collection name for this WMI input. This name appears in + * configuration file, the source, and the sourcetype of the indexed data. + * + * @return The collection name. + */ + public String getLocalName() { + return getString("name"); + } + + /** + * Returns a list of secondary servers used for monitoring. To list the main + * server, use the {@code getLookupHost} method. + * @see #getLookupHost + * + * @return A comma-separated list of additional servers, or {@code null} + * if not specified. + */ + public String getServers() { + return getString("server", null); + } + + /** + * Returns the query string for this WMI input. + * + * @return The query string. + */ + public String getWql() { + return getString("wql"); + } + + /** + * Sets the WMI class name. + * + * @param classes A valid WMI class name. + */ + public void setClasses(String classes) { + setCacheValue("classes", classes); + } + + /** + * Sets whether this input is enabled or disabled. + * <p> + * <b>Note:</b> Using this method requires you to restart Splunk before this + * setting takes effect. To avoid restarting Splunk, use the + * {@code Entity.disable} and {@code Entity.enable} methods instead, which + * take effect immediately. + * + * @param disabled {@code true} to disable this input, {@code false} to + * enable it. + */ + public void setDisabled(boolean disabled) { + setCacheValue("disabled", disabled); + } + + /** + * Sets the properties (fields) that you want to gather from the given + * class. + * + * @param fields An array of properties (fields) to gather. + */ + public void setFields(String[] fields) { + setCacheValue("fields", fields); + } + + /** + * Sets a property (field) that you want to gather from the given + * class. Use this method to set a single field rather than an array. + * + * @param field A property (field) to gather. + */ + public void setFields(String field) { + setCacheValue("fields", new String [] { field }); + } + + /** + * Sets the index in which to store all generated events. + * + * @param index The index name. + */ + public void setIndex(String index) { + setCacheValue("index", index); + } + + /** + * Sets the counter instances to monitor. + * + * @param instances The counter instances to monitor. + */ + public void setInstances(String[] instances) { + setCacheValue("instances", instances); + } + + /** + * Sets a counter instance to monitor. Use this method to set a single + * instance rather than an array. + * + * @param instance A counter instance to monitor. + */ + public void setInstances(String instance) { + setCacheValue("instances", new String [] { instance }); + } + + /** + * Sets the frequency at which the WMI providers are queried. + * + * @param interval The polling frequency, in seconds. + */ + public void setInterval(int interval) { + setCacheValue("interval", interval); + } + + /** + * Sets the main server from which to monitor log events. To specify + * additional servers to monitor using WMI, use the {@code setServers} + * method. + * @see #setServers + * + * @param lookup_host The main server. + */ + public void setLookupHost(String lookup_host) { + setCacheValue("lookup_host", lookup_host); + } + + /** + * Sets secondary servers that you want to gather data from. Use this + * method if you need to gather more than a single server. To specify the + * main server, use the {@code setLookupHost} method. + * @see #setLookupHost + * + * @param servers A comma-separated list of additional servers. + */ + public void setServers(String servers) { + setCacheValue("server", servers); + } + + /** + * {@inheritDoc} + */ + @Override public void update(Map<String, Object> args) { + // If not present in the update keys, add required attributes + if (!args.containsKey("classes")) + args = Args.create(args).add("classes", getClasses()); + if (!args.containsKey("interval")) + args = Args.create(args).add("interval", getInterval()); + if (!args.containsKey("lookup_host")) + args = Args.create(args).add( + "lookup_host", getLookupHost()); + super.update(args); + } + + /** + * {@inheritDoc} + */ + @Override public void update() { + // If not present in the update keys, add required attributes as long + // as one pre-existing update pair exists + if (toUpdate.size() > 0 && !toUpdate.containsKey("classes")) { + setCacheValue("classes", getClasses()); + } + if (toUpdate.size() > 0 && !toUpdate.containsKey("interval")) { + setCacheValue("interval", getInterval()); + } + if (toUpdate.size() > 0 && !toUpdate.containsKey("lookup_host")) { + setCacheValue("lookup_host", getLookupHost()); + } + super.update(); + } +} diff --git a/splunk/src/main/java/com/splunk/Xml.java b/splunk/src/main/java/com/splunk/Xml.java new file mode 100644 index 00000000..ef582f72 --- /dev/null +++ b/splunk/src/main/java/com/splunk/Xml.java @@ -0,0 +1,79 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.io.InputStream; +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import org.w3c.dom.Document; +import org.xml.sax.ErrorHandler; +import org.xml.sax.SAXException; +import org.xml.sax.SAXParseException; + +/** + * The {@code Xml} class represents a collection of XML utilities. + */ +public class Xml { + + /** + * Parses the given input stream and returns it as an XML document object + * model (DOM). + * + * @param input The {@code InputStream} to parse. + * @return The XML DOM. + */ + public static Document parse(InputStream input) { + return parse(input, false); + } + + /** + * Parses the given input stream and returns it as an XML document object + * model (DOM). + * + * @param input The {@code InputStream} to parse. + * @param silent Suppress logging of parse errors + * @return The XML DOM. + */ + public static Document parse(InputStream input, boolean silent) { + try { + DocumentBuilderFactory factory = + DocumentBuilderFactory.newInstance(); + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + factory.setExpandEntityReferences(false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setNamespaceAware(false); + DocumentBuilder builder = factory.newDocumentBuilder(); + if (silent) + builder.setErrorHandler(NO_OP_ERROR_HANDLER); + + return builder.parse(input); + } + catch (Exception e) { + throw new RuntimeException(e.getMessage(), e); + } + } + + private static final ErrorHandler NO_OP_ERROR_HANDLER = new ErrorHandler() { + @Override public void warning(SAXParseException exception) throws SAXException { } + + @Override public void error(SAXParseException exception) throws SAXException { } + + @Override public void fatalError(SAXParseException exception) throws SAXException { } + }; +} + diff --git a/splunk/src/main/java/com/splunk/modularinput/Argument.java b/splunk/src/main/java/com/splunk/modularinput/Argument.java new file mode 100755 index 00000000..1a171a60 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/Argument.java @@ -0,0 +1,216 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Node; + +import javax.xml.parsers.DocumentBuilderFactory; + +/** + * The {@code Argument} class represents an argument to a modular input kind. + * + * {@code Argument} is meant to be used with {@code Scheme} to generate an XML definition of the modular input + * kind that Splunk understands. + */ +public class Argument { + private static DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + + public enum DataType { BOOLEAN, NUMBER, STRING }; + + // Name used to identify this argument in Splunk. + protected String name; + + // A human readable description of the argument. + protected String description = null; + + // A string specifying how the argument should be validated, if using internal validation. If using + // external validation, this will be ignored. + protected String validation = null; + + // The data type of this field, one of boolean, number, or string. + protected DataType dataType = DataType.STRING; + + // Must this argument be specified when editing an existing modular input of this kind? + protected boolean requiredOnEdit = false; + + // Must this argument be specified when creating an existing modular input of this kind? + protected boolean requiredOnCreate = false; + + public Argument(String name) { + this.name = name; + } + + /** + * Gets the name that Splunk uses to represent this argument. + * + * @return The argument's name. + */ + public String getName() { + return this.name; + } + + /** + * Sets the name that Splunk will use to represent this argument. + * + * @param name + * The name that Splunk will use to represent this argument. + */ + public void setName(String name) { + this.name = name; + } + + /** + * Gets the human readable description of this argument. + * + * @return The argument's description. + */ + public String getDescription() { + return this.description; + } + + /** + * Sets the human readable description of this argument. + * + * @param description + * The human readable description of this argument. + */ + public void setDescription(String description) { + this.description = description; + } + + /** + * Gets the validation to be used on this argument, if using internal validation. + * + * @return The validation used on the argument. + */ + public String getValidation() { + return this.validation; + } + + /** + * Sets the validation string that internal validation should use on this argument. + * + * @param validation + * The validation string that internal validation should use on this argument. + */ + public void setValidation(String validation) { + this.validation = validation; + } + + /** + * Gets the data type of this argument. + * + * @return The data type of the argument. + */ + public DataType getDataType() { + return this.dataType; + } + + /** + * Sets the data type of this argument. + * + * @param dataType + * The data type of this argument. + */ + public void setDataType(DataType dataType) { + this.dataType = dataType; + } + + /** + * Returns whether a value for this argument must be specified when editing an existing modular input of this kind. + * + * @return {@code true} if a value for this argument must be specified when editing an existing modular input of this kind, + * {@code false} if not. + */ + public boolean isRequiredOnEdit() { + return this.requiredOnEdit; + } + + /** + * Sets whether a value for this argument must be specified when editing an existing modular input of this kind. + * + * @param requiredOnEdit + * {@code true} if a value for this argument must be specified when editing an existing modular input of this kind, + * {@code false} if not. + */ + public void setRequiredOnEdit(boolean requiredOnEdit) { + this.requiredOnEdit = requiredOnEdit; + } + + /** + * Returns whether a value for this argument must be specified when creating a modular input of this kind. + * + * @return {@code true} if a value for this argument must be specified when creating a modular input of this kind, + * {@code false} if not. + */ + public boolean isRequiredOnCreate() { + return this.requiredOnCreate; + } + + /** + * Sets whether a value for this argument must be specified when creating a modular input of this kind. + * + * @param requiredOnCreate + * {@code true} if a value for this argument must be specified when creating a modular input of this kind, + * {@code false} if not. + */ + public void setRequiredOnCreate(boolean requiredOnCreate) { + this.requiredOnCreate = requiredOnCreate; + } + + /** + * Returns an {@code Element} object representing this argument that can be added to another XML document for the {@code Scheme}. + * + * @param doc + * The XML document. + * @param parent + * The parent object. + */ + public void addToDocument(Document doc, Node parent) { + Element arg = doc.createElement("arg"); + arg.setAttribute("name", this.name); + + if (this.description != null) { + Element description = doc.createElement("description"); + description.appendChild(doc.createTextNode(this.description)); + arg.appendChild(description); + } + + if (this.validation != null) { + Element validation = doc.createElement("validation"); + validation.appendChild(doc.createTextNode(this.validation)); + arg.appendChild(validation); + } + + Element dataType = doc.createElement("data_type"); + dataType.appendChild(doc.createTextNode(this.dataType.toString().toLowerCase())); + arg.appendChild(dataType); + + Element requiredOnEdit = doc.createElement("required_on_edit"); + requiredOnEdit.appendChild(doc.createTextNode(Boolean.toString(this.requiredOnEdit))); + arg.appendChild(requiredOnEdit); + + Element requiredOnCreate = doc.createElement("required_on_create"); + requiredOnCreate.appendChild(doc.createTextNode(Boolean.toString(this.requiredOnCreate))); + arg.appendChild(requiredOnCreate); + + parent.appendChild(arg); + } + +} diff --git a/splunk/src/main/java/com/splunk/modularinput/Event.java b/splunk/src/main/java/com/splunk/modularinput/Event.java new file mode 100755 index 00000000..9ec18350 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/Event.java @@ -0,0 +1,304 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamWriter; +import java.util.Date; + +/** + * The {@code Event} class represents an event or fragment of an event to be written by this modular input to Splunk. + * + * To write an {@code Event} to an XML stream, call its {@code writeTo} method with an {@code XMLStreamWriter} object to write to. + * The {@code Event} must have at least the data field set or {@code writeTo} will throw a {@code MalformedDataException}. All other + * fields are optional. If you omit the time field, the {@code writeTo} method will fill in the current time when it is called. + * + * Typically, you will also want to call {@code setStanza} to specify which instance of the modular input kind this event + * should go to, {@code setTime} to set the timestamp, and {@code setSource}, {@code setHost}, and {@code setSourceType} + * specify where this event came from. + */ +public class Event { + protected Date time = null; + protected String data; + protected String source = null; + protected String sourceType = null; + protected String index = null; + protected String host = null; + protected boolean done = true; + protected boolean unbroken = true; + protected String stanza = null; + + public Event() {} + + // Helper method to write a single field to an XMLStreamWriter object only if it is not null. + protected void writeFieldTo(XMLStreamWriter out, String name, String value) throws XMLStreamException { + if (value != null) { + out.writeStartElement(name); + out.writeCharacters(value); + out.writeEndElement(); + } + } + + /** + * Writes this event to the given {@code XMLStreamWriter}. + * + * @param out The {@code XMLStreamWriter} to append to. + * @throws XMLStreamException if there is a problem in the {@code XMLStreamWriter}. + * @throws MalformedDataException if you have not specified data for this event. + */ + public void writeTo(XMLStreamWriter out) throws XMLStreamException, MalformedDataException { + if (data == null) { + throw new MalformedDataException("Events must have at least the data field set to be written to XML."); + } + + out.writeStartElement("event"); + if (getStanza() != null) { + out.writeAttribute("stanza", getStanza()); + } + out.writeAttribute("unbroken", isUnbroken() ? "1" : "0"); + + if (this.time != null) { + writeFieldTo(out, "time", String.format("%.3f", time.getTime() / 1000D)); + } + + writeFieldTo(out, "source", getSource()); + writeFieldTo(out, "sourcetype", getSourceType()); + writeFieldTo(out, "index", getIndex()); + writeFieldTo(out, "host", getHost()); + writeFieldTo(out, "data", getData()); + + if (isDone()) { + out.writeStartElement("done"); + out.writeEndElement(); + } + + out.writeEndElement(); + out.writeCharacters("\r\n"); + out.flush(); + } + + /** + * Gets a {@code java.util.Date} object giving the timestamp that should be sent with this event. If this field is null, + * Splunk will assign the time at which the event is indexed as its timestamp. + * + * @return A {@code java.util.Date} object giving the time assigned to this Event, or null if Splunk should apply a default + * timestamp. + */ + public Date getTime() { + return this.time; + } + + /** + * Sets a {@code java.util.Date} object giving the timestamp that should be sent with this event. If this field is null, + * Splunk will assign the time at which the event is indexed as its timestamp. + * + * @param time The {@code java.util.Date} which should be used as this event's timestamp, or null to have Splunk use a + * default timestamp. + */ + public void setTime(Date time) { + this.time = time; + } + + /** + * Gets the text of the event that Splunk should index. + * + * @return A String containing the event text. + */ + public String getData() { + return this.data; + } + + /** + * Sets the text of the event that Splunk should index. + * + * @param data A String containing the event text. + */ + public void setData(String data) { + this.data = data; + } + + /** + * Gets the file, service, or other producer that this {@code Event} comes from. For lines in log files, it is + * typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source. + * + * @return A String giving the source of this event, or null to have Splunk guess. + */ + public String getSource() { + return this.source; + } + + /** + * Sets the file, service, or other producer that this {@code Event} comes from. For lines in log files, it is + * typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source. + * + * @param source A String to be used as the source of this event, or null to have Splunk guess. + */ + public void setSource(String source) { + this.source = source; + } + + /** + * Gets a classification of this event. For example, all different web server logs might be assigned + * the same source type, or different source types can be assigned to distinct classes of events that all have + * the same source. If it is omitted, Splunk will guess a sensible name for the source type. + * + * @return The source type currently set on this event, or null if Splunk is to guess a source. + */ + public String getSourceType() { + return this.sourceType; + } + + /** + * Sets a classification of this event. For example, all different web server logs might be assigned + * the same source type, or different source types can be assigned to distinct classes of events that all have + * the same source. If this field is omitted, Splunk will make a guess as to the source type. + * + * @param sourceType A String to use as the source type for this event, or null to have Splunk guess. + */ + public void setSourceType(String sourceType) { + this.sourceType = sourceType; + } + + /** + * Gets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default + * index where events will be written. + * + * @return The index this event is specified to write to, or null if it will be written to the default index. + */ + public String getIndex() { + return this.index; + } + + /** + * Sets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default + * index where events will be written. + * + * @param index The name of the index to write to, or null to have Splunk write to the default index. + */ + public void setIndex(String index) { + this.index = index; + } + + /** + * Gets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use + * the host from which it directly received the event. + * + * @return A String giving the host name of the event source, or null to use the host Splunk receives the event from. + */ + public String getHost() { + return this.host; + } + + /** + * Sets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use + * the host from which it directly received the event. + * + * @param host A String giving the host name of the event source, or null to use the host Splunk receives + * the event from. + */ + public void setHost(String host) { + this.host = host; + } + + /** + * Sets a value indicating whether this is the last piece of an event broken across multiple {@code Event} objects. + * + * Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available + * one at a time, they can be sent (in events with {@code setUnbroken(false)} called on them) as hunks. At the end of the + * event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event + * received will be taken to be part of another event. + * + * By default, done is {@code true} and unbroken is {@code true}, so if you do not touch these fields, you will send one complete + * event per {@code Event} object. + * + * @param done Is this the last hunk of an event broken across multiple {@code Event} objects? + */ + public void setDone(boolean done) { + this.done = done; + } + + /** + * Gets a value indicating whether this is the last piece of an event broken across multiple {@code Event} objects. + * + * Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available + * one at a time, they can be sent (in events with setUnbroken(false) called on them) as hunks. At the end of the + * event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event + * received will be taken to be part of another event. + * + * By default, done is {@code true} and unbroken is {@code true}, so if you do not touch these fields, you will send one complete + * event per {@code Event} object. + * + * @return Is this the last hunk of an event broken across multiple {@code Event} objects? + */ + public boolean isDone() { + return this.done; + } + + /** + * Sets a value indicating whether this event is completely encapsulated in this {@code Event} object. + * + * Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to {@code true}, then this event is + * assumed to be a complete event, not a piece of one. By default, unbroken is {@code true}. If you set unbroken to {@code false}, + * you need to call {@code setDone(true)} on the last hunk of the complete event for Splunk to know to terminate it. + * + * @param unbroken Is this event completely encapsulated in this {@code Event} object? + */ + public void setUnbroken(boolean unbroken) { + this.unbroken = unbroken; + } + + /** + * Gets a value indicating whether this event is completely encapsulated in this {@code Event} object. + * + * Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to {@code true}, then this event is + * assumed to be a complete event, not a piece of one. By default, unbroken is {@code true}. If you set unbroken to {@code false}, + * you need to call {@code setDone(true)} on the last hunk of the complete event for Splunk to know to terminate it. + * + * @return Is this event completely encapsulated in this {@code Event} object? + */ + public boolean isUnbroken() { + return this.unbroken; + } + + /** + * Gets the name of the input this event should be sent to. + * + * A single modular input script can feed events to multiple instances of the modular input. In this case, each + * event must be marked with the name of the input it should be sent to. This is also the name of the configuration + * stanza that describes that input. + * + * @return The name of the input this event should be sent to. + */ + public String getStanza() { + return this.stanza; + } + + /** + * Sets the name of the input this event should be sent to. + * + * A single modular input script can feed events to multiple instances of the modular input. In this case, each + * event must be marked with the name of the input it should be sent to. This is also the name of the configuration + * stanza that describes that input. + * + * @param stanza The name of the input this event should be sent to. + */ + public void setStanza(String stanza) { + this.stanza = stanza; + } + + +} diff --git a/splunk/src/main/java/com/splunk/modularinput/EventWriter.java b/splunk/src/main/java/com/splunk/modularinput/EventWriter.java new file mode 100755 index 00000000..c6ce3425 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/EventWriter.java @@ -0,0 +1,206 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; + +import javax.xml.stream.XMLOutputFactory; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamWriter; +import javax.xml.transform.*; +import javax.xml.transform.dom.DOMSource; +import javax.xml.transform.stream.StreamResult; +import java.io.*; +import java.util.logging.Level; + +/** + * The {@code EventWriter} class encapsulates writing events and error messages to Splunk from a modular input. + * + * Its two important methods are {@code writeEvent}, which takes an {@code Event} object, and log, which takes a severity + * and an error message. + */ +public class EventWriter { + private XMLStreamWriter outputStreamWriter; + private Writer rawOutputStreamWriter; + private Writer errorStreamWriter; + + private boolean headerWritten = false; + + private boolean hadIOException = false; + + // The severities that Splunk understands for log messages from modular inputs. + public static String DEBUG = "DEBUG"; + public static String INFO = "INFO"; + public static String WARN = "WARN"; + public static String ERROR = "ERROR"; + public static String FATAL = "FATAL"; + + /** + * Wrap a UTF-8 OutputStreamWriter around an OutputStream, chomping the error that the Java spec asserts + * cannot actually happen. + * + * @param stream an OutputStream to wrap. + * @return a Writer object wrapping the stream. + */ + private static Writer wrapWriter(OutputStream stream) { + try { + return new OutputStreamWriter(stream, "UTF-8"); + } catch (UnsupportedEncodingException e) { + throw new AssertionError("Somehow your system doesn't support UTF-8"); + } + } + + public EventWriter() throws XMLStreamException { + this(wrapWriter(System.out), wrapWriter(System.err)); + } + + public EventWriter(Writer outputWriter, Writer errorWriter) throws XMLStreamException { + this.rawOutputStreamWriter = outputWriter; + this.outputStreamWriter = XMLOutputFactory.newInstance().createXMLStreamWriter(outputWriter); + this.errorStreamWriter = errorWriter; + } + + /** + * Clears the error state on this {@code EventWriter}. + * + * {@code EventWriter} does not throw {@code IOException} errors, but does not ignore them entirely either. Instead it operates + * the same way as {@code PrintStream} in the standard library. You can always check if an {@code IOException} has been thrown + * by calling {@code checkError}. + */ + protected void clearError() { + hadIOException = false; + } + + /** + * Declares that this {@code EventWriter} had an {@code IOException}. + * + * {@code EventWriter} does not throw {@code IOException} errors, but does not ignore them entirely either. Instead it operates + * the same way as {@code PrintStream} in the standard library. You can always check if an {@code IOException} has been thrown + * by calling {@code checkError}. + */ + protected void setError() { + hadIOException = true; + } + + /** + * Returns whether there was an {@code IOException} on this EventWriter. + * + * {@code EventWriter} does not throw {@code IOException} errors, but does not ignore them entirely either. Instead it operates + * the same way as {@code PrintStream} in the standard library. You can always check if an {@code IOException} has been thrown + * by calling {@code checkError}. + * @return boolean value + */ + public boolean checkError() { + return hadIOException; + } + + /** + * Thread safe version of {@code writeEvent}. + * @see #writeEvent + * @param event The Event instance + * @throws MalformedDataException The MalformedDataException instance + */ + public synchronized void synchronizedWriteEvent(Event event) throws MalformedDataException { + writeEvent(event); + } + + /** + * Writes an {@code Event} object to Splunk. This method is not thread safe. If you need a thread safe version, use + * {@code synchronizedWriteEvent}. + * + * If you try to write an {@code Event} with null data, throws {@code MalformedDataException}. + * + * @see #synchronizedWriteEvent + * @param event The {@code Event} object to write. + * @throws MalformedDataException The MalformedDataException instance + */ + public void writeEvent(Event event) throws MalformedDataException { + try { + if (!headerWritten) { + outputStreamWriter.writeStartElement("stream"); + headerWritten = true; + } + event.writeTo(outputStreamWriter); + outputStreamWriter.flush(); + } catch (MalformedDataException e) { + log(WARN, e.toString()); + throw e; + } catch (XMLStreamException e) { + log(ERROR, e.toString()); + } + } + + /** + * Thread safe version of {@code log}. + * @see #log + * @param severity String value + * @param errorMessage String value + */ + public synchronized void synchronizedLog(String severity, String errorMessage) { + log(severity, errorMessage); + } + + /** + * Logs messages about the state of this modular input to Splunk. These messages will show up in Splunk's + * internal logs. + * + * @see #synchronizedLog + * @param severity The severity (e.g., {@code EventWriter.WARN}, {@code EventWriter.FATAL}) of this message. + * @param errorMessage The message that should appear in the logs. + */ + public void log(String severity, String errorMessage) { + try { + errorStreamWriter.write(severity + " " + errorMessage + "\n"); + errorStreamWriter.flush(); + } catch (IOException e) { + setError(); + } + } + + /** + * Writes the closing {@code </stream>} tag to make this XML well formed. + * + */ + public void close() { + try { + this.outputStreamWriter.writeEndElement(); + } catch (XMLStreamException e) { + log(ERROR, e.toString()); + } + } + + /** + * Writes an org.w3c.dom.Document object containing XML to the output stream. + */ + void writeXmlDocument(Document document) throws TransformerException, XMLStreamException, IOException { + TransformerFactory transformerFactory = TransformerFactory.newInstance(); + Transformer transformer = null; + transformer = transformerFactory.newTransformer(); + transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); + transformer.setOutputProperty(OutputKeys.INDENT, "yes"); + transformer.setOutputProperty(OutputKeys.VERSION, "1.0"); + transformer.setOutputProperty(OutputKeys.STANDALONE, "yes"); + + DOMSource source = new DOMSource(document); + StringWriter buffer = new StringWriter(); + StreamResult result = new StreamResult(buffer); + transformer.transform(source, result); + rawOutputStreamWriter.write(result.getWriter().toString()); + rawOutputStreamWriter.flush(); + } + +} diff --git a/splunk/src/main/java/com/splunk/modularinput/InputDefinition.java b/splunk/src/main/java/com/splunk/modularinput/InputDefinition.java new file mode 100755 index 00000000..f7431e78 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/InputDefinition.java @@ -0,0 +1,225 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; +import org.w3c.dom.Node; +import org.xml.sax.SAXException; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import java.io.IOException; +import java.io.InputStream; +import java.util.Collection; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +/** + * The {@code InputDefinition} class encodes the XML defining inputs that Splunk passes to + * a modular input script as a Java object. + */ +public class InputDefinition { + // We use a map to hold all parameters such as server host, server URI, etc. instead of individual fields + // so that additions to the input definition contract in the future won't break this implementation. It also + // simplifies the parsing code below. + private Map<String,String> metadata; + + private Map<String, Map<String, Parameter>> inputs; + + private final String serverHostField = "server_host"; + private final String serverUriField = "server_uri"; + private final String checkpointDirField = "checkpoint_dir"; + private final String sessionKeyField = "session_key"; + + // Package private on purpose + InputDefinition() { + inputs = new HashMap<String, Map<String, Parameter>>(); + metadata = new HashMap<String, String>(); + } + + /** + * Gets the name of the field to fetch. + * + * In future versions of Splunk, there may be additional fields on the {@code InputDefinition}. {@code getField} permits + * access to them in case you are constrained to an old version of the Splunk SDK for Java. + * + * @param fieldName The name of the field to fetch. + * @return The field. + */ + public String getField(String fieldName) { + return this.metadata.get(fieldName); + } + + /** + * Sets the name of the server on which this modular input is being run. + * @param serverHost String value + */ + public void setServerHost(String serverHost) { + this.metadata.put(serverHostField, serverHost); + } + + /** + * Gets the name of the server on which this modular input is being run. + * + * @return The name of the server on which this modular input is being run. + */ + public String getServerHost() { + return this.metadata.get(serverHostField); + } + + /** + * Sets the URI to reach the server on which this modular input is being run. + * + * @param serverUri The URI to reach the server on which this modular input is being run. + */ + public void setServerUri(String serverUri) { + this.metadata.put(serverUriField, serverUri); + } + + /** + * Gets the URI to the server on which this modular input is being run. + * + * @return The URI to the server on which this modular input is being run. + */ + public String getServerUri() { + return this.metadata.get(serverUriField); + } + + /** + * Sets the path to which to write checkpoint files. + * + * @param checkpointDir The path to which to write checkpoint files. + */ + public void setCheckpointDir(String checkpointDir) { + this.metadata.put(checkpointDirField, checkpointDir); + } + + /** + * Gets the path to which to write checkpoint files for restarting inputs. + * + * @return The path to which to write checkpoint files for restarting inputs. + */ + public String getCheckpointDir() { + return this.metadata.get(checkpointDirField); + } + + /** + * Sets a session key that can be used to access splunkd's REST API. + * + * @param sessionKey A session key that can be used to access splunkd's REST API. + */ + public void setSessionKey(String sessionKey) { + this.metadata.put(sessionKeyField, sessionKey); + } + + /** + * Sets a session providing access to splunkd's REST API on this host. + * + * @return A session key providing access to splunkd's REST API on this host. + */ + public String getSessionKey() { + return this.metadata.get(sessionKeyField); + } + + /** + * Adds an input to the set of inputs on this {@code InputDefinition}. + * + * @param name The name of this input (e.g., foobar://this-input-name). + * @param parameters A collection of {@code Parameter} objects giving the settings for this input. + */ + public void addInput(String name, Collection<Parameter> parameters) { + Map<String, Parameter> paramMap = new HashMap<String, Parameter>(); + + for (Parameter p : parameters) { + paramMap.put(p.getName(), p); + } + + this.inputs.put(name, paramMap); + } + + /** + * @return A map of all the inputs specified in this {@code InputDefinition}. + */ + public Map<String, Map<String, Parameter>> getInputs() { + return this.inputs; + } + + /** + * Parses a stream containing XML into an InputDefinition. + * + * @param stream The stream containing XML to parse. + * @return An {@code InputDefinition} object. + * @throws ParserConfigurationException If there are errors in setting up the parser (which indicates system + * configuration issues). + * @throws IOException If there is an error in reading from the stream. + * @throws SAXException When the XML is invalid. + * @throws MalformedDataException When the XML does specify a valid set of inputs. + */ + public static InputDefinition parseDefinition(InputStream stream) throws ParserConfigurationException, + IOException, SAXException, MalformedDataException { + DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setIgnoringElementContentWhitespace(true); + documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + documentBuilderFactory.setExpandEntityReferences(false); + documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); + DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); + Document doc = documentBuilder.parse(stream); + + InputDefinition definition = new InputDefinition(); + for (Node node = doc.getDocumentElement().getFirstChild(); node != null; node = node.getNextSibling()) { + if (node.getNodeType() == Node.TEXT_NODE) { + continue; + } else if (node.getNodeName().equals("configuration")) { + for (Node child = node.getFirstChild(); child != null; child = child.getNextSibling()) { + if (child.getNodeType() == Node.TEXT_NODE) { + continue; + } + if (!child.getNodeName().equals("stanza")) { + throw new MalformedDataException("Expected stanza element; found " + child.getNodeName()); + } + String name = child.getAttributes().getNamedItem("name").getNodeValue(); + List<Parameter> parameter = Parameter.nodeToParameterList(child); + definition.addInput(name, parameter); + } + } else { + definition.metadata.put( + node.getNodeName(), + XmlUtil.textInNode(node, "Expected a text value in element " + node.getNodeName()) + ); + } + } + + return definition; + } + + @Override + public boolean equals(Object other) { + if (!(other instanceof InputDefinition)) { + return false; + } + InputDefinition that = (InputDefinition)other; + return this.metadata.equals(that.metadata) && this.inputs.equals(that.inputs); + } + + @Override + public int hashCode() { + return this.metadata.hashCode() ^ (this.getInputs() == null ? 0 : this.getInputs().hashCode()); + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/MalformedDataException.java b/splunk/src/main/java/com/splunk/modularinput/MalformedDataException.java new file mode 100755 index 00000000..b95dd8f3 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/MalformedDataException.java @@ -0,0 +1,27 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +/** + * Exception thrown when parsing XML that is syntactically valid, but does not + * match the schema expected by the Splunk SDK for Java. + */ +public class MalformedDataException extends Exception { + public MalformedDataException(String s) { + super(s); + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/MultiValueParameter.java b/splunk/src/main/java/com/splunk/modularinput/MultiValueParameter.java new file mode 100755 index 00000000..39c3ce57 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/MultiValueParameter.java @@ -0,0 +1,83 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import java.util.ArrayList; +import java.util.List; + +/** + * The {@code MultiValueParameter} class represents a parameter containing multiple values that is passed as part of a definition + * of a modular input instance. {@code MultiValueParameter} objects correspond to XML fragments of the form: + * + * <pre> + * {@code + * <param_list name="multiValue"> + * <value>value1</value> + * <value>value2</value> + * </param_list> + * } + * </pre> + */ +public class MultiValueParameter extends Parameter { + private final String name; + private final List<String> values; + + // Note: package private constructor by design so parameters cannot be instantiated by the user. + MultiValueParameter(String name) { + this.name = name; + this.values = new ArrayList<String>(); + } + + /** + * Gets the name of this parameter. + * + * @return The name of this parameter. + */ + public String getName() { + return this.name; + } + + /** + * Gets a list of all values of this parameter. + * + * @return A list of all values of this parameter. + */ + public List<String> getValues() { + return this.values; + } + + // Package private by design. + void appendValue(String value) { + this.values.add(value); + } + + @Override + public boolean equals(Object other) { + if (!(other instanceof MultiValueParameter)) { + return false; + } else { + MultiValueParameter that = (MultiValueParameter)other; + return this.values.equals(that.values) && this.name.equals(that.name); + } + } + + @Override + public int hashCode() { + return (this.name == null ? 0 : this.name.hashCode()) ^ + (this.values == null ? 0 : this.values.hashCode()); + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/NonblockingInputStream.java b/splunk/src/main/java/com/splunk/modularinput/NonblockingInputStream.java new file mode 100755 index 00000000..e7b7e689 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/NonblockingInputStream.java @@ -0,0 +1,41 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import java.io.IOException; +import java.io.InputStream; + +/** + * The {@code NonblockingInputStream} class is a stream wrapper that acts as though + * the underlying stream has terminated every time it blocks. + */ +public class NonblockingInputStream extends InputStream { + private final InputStream stream; + + public NonblockingInputStream(InputStream stream) { + this.stream = stream; + } + + @Override + public int read() throws IOException { + if (stream.available() != 0) { + return stream.read(); + } else { + return -1; + } + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/Parameter.java b/splunk/src/main/java/com/splunk/modularinput/Parameter.java new file mode 100755 index 00000000..23cb8585 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/Parameter.java @@ -0,0 +1,98 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Node; + +import java.util.ArrayList; +import java.util.List; + +/** + * The {@code Parameter} class is a base class for parameters of modular inputs. It has two subclasses: {@code SingleValueParameter} + * and {@code MultiValueParameter}. + * + * All parameters should be constructed with the static {@code nodeToParameterList} method, which takes an XML {@code org.w3c.dom.Node} + * object as its argument and returns a list of {@code Parameter} objects, single valued or multi valued as needed. + */ +public abstract class Parameter { + public abstract String getName(); + + // Package private to enforce using the nodeToParameterList function to create Parameter objects. + Parameter() { + super(); + } + + /** + * Generates a list of {@code Parameter} objects from an {@code org.w3c.dom.Node} object containing a set of parameters. The node + * may be any element, but is expected to contain elements param or param_list, as in + * + * <pre> + * {@code + * <stanza name="foobar://aaa"> + * <param name="param1">value1</param> + * <param name="param2">value2</param> + * <param name="disabled">0</param> + * <param name="index">default</param> + * <param_list name="multiValue"> + * <value>value1</value> + * <value>value2</value> + * </param_list> + * </stanza> + * } + * </pre> + * + * @param node An {@code org.w3c.dom.Node} object containing the parameter list as children. + * @return A list of Parameter objects extracted from the XML. + * @throws com.splunk.modularinput.MalformedDataException If the XML does not specify a valid parameter list. + */ + public static List<Parameter> nodeToParameterList(Node node) throws MalformedDataException { + List<Parameter> parameters = new ArrayList<Parameter>(); + + for (Node child = node.getFirstChild(); child != null; child = child.getNextSibling()) { + if (child.getNodeType() == Node.TEXT_NODE) { + continue; + } + if ("param".equals(child.getNodeName())) { + // This is a single value parameter + String name = child.getAttributes().getNamedItem("name").getNodeValue(); + String value = XmlUtil.textInNode(child, "Element param with name=\"" + name + + "\" did not contain text."); + parameters.add(new SingleValueParameter(name, value)); + } else if ("param_list".equals(child.getNodeName())) { + String name = child.getAttributes().getNamedItem("name").getNodeValue(); + MultiValueParameter parameter = new MultiValueParameter(name); + for (Node valueNode = child.getFirstChild(); valueNode != null; valueNode = valueNode.getNextSibling()) { + if (valueNode.getNodeType() == Node.TEXT_NODE) continue; + if (!"value".equals(valueNode.getNodeName())) { + throw new MalformedDataException("Expected a value element in parameter named " + + child.getNodeName() + "; found " + valueNode.getNodeName()); + } else { + parameter.appendValue(XmlUtil.textInNode( + valueNode, + "value element in parameter named " + child.getNodeName() + " did not contain text." + )); + } + } + parameters.add(parameter); + } else { + throw new MalformedDataException("Bad parameter element named " + child.getNodeName()); + } + } + + return parameters; + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/Scheme.java b/splunk/src/main/java/com/splunk/modularinput/Scheme.java new file mode 100755 index 00000000..b160c22a --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/Scheme.java @@ -0,0 +1,244 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import java.util.ArrayList; +import java.util.List; + + +/** + * The {@code Scheme} class represents the metadata for a modular input kind. + * + * A {@code Scheme} specifies a title, description, several options of how Splunk should run modular inputs of this + * kind, and a set of arguments which define a particular modular input's properties. + * + * The primary use of {@code Scheme} is to abstract away the construction of XML to feed to Splunk. + */ +public class Scheme { + private static DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + + public enum StreamingMode { SIMPLE, XML }; + + // Name of this module input kind. <tt>title</tt> will be used as the URL scheme when + // specifying particular modular inputs. For example, if <tt>title</tt> is <tt>"abc"</tt>, + // a particular modular input of this kind would be referenced as <tt>abc://some_name</tt>. + protected String title; + + // Human readable description of this modular input kind. + protected String description = null; + + // Should this script be called by Splunk to validate the configuration of modular inputs of this kind? + // If false, then Splunk does some basic sanity checking. + protected boolean useExternalValidation = true; + + // Should all modular inputs of this kind share a single instance of this script? + protected boolean useSingleInstance = false; + + // Will events be streamed to Splunk from this modular input in simple text or in XML? XML is the default + // and should be preferred unless you have a really good reason to choose otherwise. + protected StreamingMode streamingMode = StreamingMode.XML; + + // A List of all the arguments that this modular input kind takes. + protected List<Argument> arguments; + + public Scheme(String title) { + this.title = title; + this.arguments = new ArrayList<Argument>(); + } + + /** + * Gets the title of this modular input kind. + * + * @return The title of this modular input kind. + */ + public String getTitle() { + return title; + } + + /** + * Sets the title of this modular input kind. + * + * @param title The title of this modular input kind. + */ + public void setTitle(String title) { + this.title = title; + } + + /** + * Gets the human readable description of this modular input kind. + * + * @return The human readable description of this modular input kind. + */ + public String getDescription() { + return description; + } + + /** + * Sets the human readable description of this modular input kind. + * + * @param description The human readable description of this modular input kind. + */ + public void setDescription(String description) { + this.description = description; + } + + /** + * Returns whether Splunk should use the modular input kind script to validate the arguments + * of a particular modular input or use the validation predicates specified by the arguments. + * + * @return {@code true} if Splunk should use the modular input kind script to validate the arguments + * of a particular modular input, {@code false} if it should use the validation predicates specified by the arguments. + */ + public boolean isUseExternalValidation() { + return useExternalValidation; + } + + /** + * Specifies whether Splunk should use the modular input kind script to validate the arguments + * of a particular modular input (true) or use the validation predicates specified by the arguments (false). + * + * @param useExternalValidation {@code true} if Splunk should use the modular input kind script to validate the arguments + * of a particular modular input, {@code false} if it should use the validation predicates specified by the arguments. + */ + public void setUseExternalValidation(boolean useExternalValidation) { + this.useExternalValidation = useExternalValidation; + } + + /** + * Returns whether Splunk should run all modular inputs of this kind via one instance of the script + * or start an instance for each modular input. + * + * @return {@code true} if Splunk should run all modular inputs of this kind via one instance of the script, + * {@code false} if it should start an instance for each modular input. + */ + public boolean isUseSingleInstance() { + return useSingleInstance; + } + + /** + * Specifies whether Splunk should run all modular inputs of this kind via one instance of the script + * or start an instance for each modular input. + * + * @param useSingleInstance {@code true} if Splunk should run all modular inputs of this kind via one instance of the script, + * {@code false} if it should start an instance for each modular input. + */ + public void setUseSingleInstance(boolean useSingleInstance) { + this.useSingleInstance = useSingleInstance; + } + + /** + * Returns whether this modular input kind will send events to Splunk as XML (the default and preferred + * value) or plain text. + * + * @return The streaming mode. + */ + public StreamingMode getStreamingMode() { + return streamingMode; + } + + /** + * Specifies whether this modular input kind will send events to Splunk as XML (the default and preferred + * value) or plain text. + * + * @param streamingMode The streaming mode. + */ + public void setStreamingMode(StreamingMode streamingMode) { + this.streamingMode = streamingMode; + } + + /** + * Returns all the arguments to this modular input kind. + * + * @return A list of all the arguments to this modular input kind. + */ + public List<Argument> getArguments() { + return arguments; + } + + /** + * Replaces the current list of arguments with the specified one. + * + * @param arguments The list of arguments with which to replace the current + * list of arguments. + */ + public void setArguments(List<Argument> arguments) { + this.arguments = new ArrayList<Argument>(arguments); + } + + /** + * Appends an argument to the arguments that this modular input kind takes. + * + * @param argument The argument to append to the arguments. + */ + public void addArgument(Argument argument) { + this.arguments.add(argument); + } + + /** + * Generates an XML encoding of this scheme to be passed to Splunk. + * + * @return An {@code org.w3c.dom.Document} object containing the XML of this scheme. + * @throws ParserConfigurationException If there was a problem configuring the XML libraries. + */ + Document toXml() throws ParserConfigurationException { + DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); + Document doc = documentBuilder.newDocument(); + + Element root = doc.createElement("scheme"); + doc.appendChild(root); + + Element title = doc.createElement("title"); + title.appendChild(doc.createTextNode(this.title)); + root.appendChild(title); + + if (this.description != null) { + Element description = doc.createElement("description"); + description.appendChild(doc.createTextNode(this.description)); + root.appendChild(description); + } + + Element useExternalValidation = doc.createElement("use_external_validation"); + useExternalValidation.appendChild(doc.createTextNode(Boolean.toString(this.useExternalValidation))); + root.appendChild(useExternalValidation); + + Element useSingleInstance = doc.createElement("use_single_instance"); + useSingleInstance.appendChild(doc.createTextNode(Boolean.toString(this.useSingleInstance))); + root.appendChild(useSingleInstance); + + Element streamingMode = doc.createElement("streaming_mode"); + streamingMode.appendChild(doc.createTextNode(this.streamingMode == StreamingMode.SIMPLE ? "simple" : "xml")); + root.appendChild(streamingMode); + + Element endpoint = doc.createElement("endpoint"); + root.appendChild(endpoint); + + Element args = doc.createElement("args"); + endpoint.appendChild(args); + + for (Argument arg : this.arguments) { + arg.addToDocument(doc, args); + } + + return doc; + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/Script.java b/splunk/src/main/java/com/splunk/modularinput/Script.java new file mode 100755 index 00000000..96447c73 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/Script.java @@ -0,0 +1,168 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; +import org.w3c.dom.Node; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.stream.XMLStreamException; +import java.io.*; + +/** + * The {@code Script} class is an abstract base class for implementing modular inputs. Subclasses + * should override {@code getScheme} and {@code streamEvents}, and optional {@code configureValidator} if the modular + * input is using external validation. + */ +public abstract class Script { + /** + * Encodes all the common behavior of modular inputs. You should have no reason + * to override this method in most cases. + * + * @param args An array of command line arguments passed to this script. + * @return An integer to be used as the exit value of this program. + */ + public int run(String[] args) { + EventWriter eventWriter; + try { + eventWriter = new EventWriter(); + return run(args, eventWriter, System.in); + } catch (XMLStreamException e) { + System.err.print(stackTraceToLogEntry(e)); + return 1; + } + } + + /** + * Encodes all the common behavior of modular inputs. You should have no reason + * to override this method in most cases. + * + * @param args An array of command line arguments passed to this script. + * @param eventWriter An {@code EventWriter}. + * @param in An {@code InputStream}. + * @return An integer to be used as the exit value of this program. + */ + public int run(String[] args, EventWriter eventWriter, InputStream in) { + try { + if (args.length == 0) { + // This script is running as an input. Input definitions will be passed on stdin as XML, and + // the script will write events on stdout and log entries on stderr. + InputDefinition inputDefinition = InputDefinition.parseDefinition(in); + streamEvents(inputDefinition, eventWriter); + eventWriter.close(); + return 0; + } else if (args[0].toLowerCase().equals("--scheme")) { + // Splunk has requested XML specifying the scheme for this modular input. Return it and exit. + Scheme scheme = getScheme(); + if (scheme == null) { + eventWriter.log("FATAL", "Modular input script returned a null scheme."); + return 1; + } else { + eventWriter.writeXmlDocument(scheme.toXml()); + return 0; + } + } else if (args[0].toLowerCase().equals("--validate-arguments")) { + NonblockingInputStream stream = new NonblockingInputStream(in); + ValidationDefinition validationDefinition = ValidationDefinition.parseDefinition(stream); + + try { + validateInput(validationDefinition); + return 0; + } catch (Exception e) { + DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setIgnoringElementContentWhitespace(true); + DocumentBuilder documentBuilder; + documentBuilder = documentBuilderFactory.newDocumentBuilder(); + + Document document = documentBuilder.newDocument(); + + Node error = document.createElement("error"); + document.appendChild(error); + + Node message = document.createElement("message"); + error.appendChild(message); + + Node text = document.createTextNode(e.getLocalizedMessage()); + message.appendChild(text); + + eventWriter.writeXmlDocument(document); + + return 1; + } + } else { + StringBuilder sb = new StringBuilder(); + sb.append("ERROR Invalid arguments to modular input script:"); + for (String arg : args) { + sb.append(" "); + sb.append(arg); + } + eventWriter.log(EventWriter.ERROR, sb.toString()); + return 1; + } + } catch (Exception e) { + eventWriter.log(EventWriter.ERROR, stackTraceToLogEntry(e)); + return 1; + } + } + + protected String stackTraceToLogEntry(Exception e) { + // Concatenate all the lines of the exception's stack trace with \\ between them. + StringBuilder sb = new StringBuilder(); + for (StackTraceElement s : e.getStackTrace()) { + sb.append(s.toString()); + sb.append("\\\\"); + } + return sb.toString(); + } + + /** + * Gets the scheme that defines the parameters understood by this modular input. + * + * @return A {@code Scheme} object representing the parameters for this modular input. + */ + public abstract Scheme getScheme(); + + /** + * Handles external validation for modular input kinds. When Splunk + * called a modular input script in validation mode, it will pass in an XML document + * giving information about the Splunk instance (so you can call back into it if needed) + * and the name and parameters of the proposed input. + * + * If this function does not throw an exception, the validation is assumed to succeed. Otherwise + * any error thrown will be turned into a string and logged back to Splunk. + * + * The default implementation always passes. + * + * @param definition The parameters for the proposed input passed by splunkd. + * @throws Exception The exception instance + */ + public void validateInput(ValidationDefinition definition) throws Exception {} + + /** + * Streams events into Splunk. It should do all of its output via + * {@code EventWriter} rather than assuming that there is a console attached. + * + * @param inputs InputDefinition instance + * @param ew An object with methods to write events and log messages to Splunk. + * @throws MalformedDataException The MalformedDataException instance + * @throws XMLStreamException The XMLStreamException instance + * @throws IOException The IOException instance + */ + public abstract void streamEvents(InputDefinition inputs, EventWriter ew) + throws MalformedDataException, XMLStreamException, IOException; +} diff --git a/splunk/src/main/java/com/splunk/modularinput/SingleValueParameter.java b/splunk/src/main/java/com/splunk/modularinput/SingleValueParameter.java new file mode 100755 index 00000000..1874a32e --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/SingleValueParameter.java @@ -0,0 +1,121 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +/** + * The {@code SingleValueParameter} class represents a parameter as part of a modular input instance that + * contains only a single value. This corresponds to XML fragments of the form: + * + * <pre> + * {@code + * <param name="param1">value11</param> + * } + * </pre> + */ +public class SingleValueParameter extends Parameter { + private final String name; + private final String value; + + // Package private by design. + SingleValueParameter(String name, String value) { + this.name = name; + this.value = value; + } + + /** + * @return the name of this parameter. + */ + public String getName() { + return this.name; + } + + /** + * Returns the parameter as found (as a String), without trying to coerce it to another type. + * + * If your field is Boolean or numeric, use {@code getBoolean} or one of {@code getInt}, {@code getLong}, + * {@code getFloat}, and {@code getDouble} instead. + * + * @return The value of this parameter as a String. + */ + public String getValue() { + return this.value; + } + + /** + * Tries to coerce the value of this parameter to a Boolean. A range of values (true, t, on, 1, y, yes) are + * interpreted as {@code true}, and a similar range (false, f, off, 0, no, n) as {@code false}. Everything + * else, including null, results in a {@code MalformedDataException}. + * + * @return The value of this parameter coerced to a Boolean. + * @throws MalformedDataException If the value cannot be coerced to a boolean. + */ + public boolean getBoolean() throws MalformedDataException { + return XmlUtil.normalizeBoolean(getValue()); + } + + /** + * Coerces the value of this field to an int. + * + * @return An int parsed from this parameter's value. + */ + public int getInt() { + return Integer.parseInt(getValue()); + } + + /** + * Coerces the value of this field to a long. + * + * @return A long parsed from this parameter's value. + */ + public long getLong() { + return Long.parseLong(getValue()); + } + + /** + * Coerces the value of this field to a float. + * + * @return A float parsed from this parameter's value. + */ + public float getFloat() { + return Float.parseFloat(getValue()); + } + + /** + * Coerces the value of this field to a double. + * + * @return A double parsed from this parameter's value. + */ + public double getDouble() { + return Double.parseDouble(getValue()); + } + + @Override + public boolean equals(Object other) { + if (!(other instanceof SingleValueParameter)) { + return false; + } else { + SingleValueParameter that = (SingleValueParameter)other; + return this.getValue().equals(that.getValue()) && this.getName().equals(that.getName()); + } + } + + @Override + public int hashCode() { + return (this.name == null ? 0 : this.name.hashCode()) ^ + (this.value == null ? 0 : this.value.hashCode()); + } +} diff --git a/splunk/src/main/java/com/splunk/modularinput/ValidationDefinition.java b/splunk/src/main/java/com/splunk/modularinput/ValidationDefinition.java new file mode 100755 index 00000000..3ce60106 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/ValidationDefinition.java @@ -0,0 +1,239 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Document; +import org.w3c.dom.Node; +import org.xml.sax.SAXException; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import java.io.IOException; +import java.io.InputStream; +import java.util.Collection; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +/** + * The {@code ValidationDefinition} class represents the XML sent by Splunk for external validation of a new modular input. + */ +public class ValidationDefinition { + private Map<String, String> metadata; + + private Map<String, Parameter> parameters; + + private final String serverHostField = "server_host"; + private final String serverUriField = "server_uri"; + private final String checkpointDirField = "checkpoint_dir"; + private final String sessionKeyField = "session_key"; + private final String nameField = "name"; + + // Package private on purpose. + ValidationDefinition() { + super(); + metadata = new HashMap<String, String>(); + } + + /** + * Sets the name of the server on which this modular input is being run. + * + * @param serverHost The name of the server on which this modular input is being run. + */ + void setServerHost(String serverHost) { + this.metadata.put(serverHostField, serverHost); + } + + /** + * Gets the name of the server on which this modular input is being run. + * + * @return The name of the server on which this modular input is being run. + */ + public String getServerHost() { + return this.metadata.get(serverHostField); + } + + /** + * Sets the URI to reach the server on which this modular input is being run. + * + * @param serverUri The URI to reach the server on which this modular input is being run. + */ + void setServerUri(String serverUri) { + this.metadata.put(serverUriField, serverUri); + } + + /** + * Gets the URI to the server on which this modular input is being run. + * + * @return The URI to the server on which this modular input is being run. + */ + public String getServerUri() { + return this.metadata.get(serverUriField); + } + + /** + * Sets the path to write checkpoint files in. + * + * @param checkpointDir The path to write checkpoint files in. + */ + void setCheckpointDir(String checkpointDir) { + this.metadata.put(checkpointDirField, checkpointDir); + } + + /** + * Gets the path to write checkpoint files for restarting inputs in. + * + * @return The path to write checkpoint files for restarting inputs in. + */ + public String getCheckpointDir() { + return this.metadata.get(checkpointDirField); + } + + /** + * Sets a session key that can be used to access splunkd's REST API. + * + * @param sessionKey A session key that can be used to access splunkd's REST API. + */ + void setSessionKey(String sessionKey) { + this.metadata.put(sessionKeyField, sessionKey); + } + + /** + * Gets a session key providing access to splunkd's REST API on this host. + * + * @return A session key providing access to splunkd's REST API on this host. + */ + public String getSessionKey() { + return this.metadata.get(sessionKeyField); + } + + /** + * Sets the name of the proposed modular input instance. + * + * @param name The name of the proposed modular input instance. + */ + void setName(String name) { + this.metadata.put(nameField, name); + } + + /** + * Gets the name of the proposed modular input instance. + * + * @return The name of the proposed modular input instance. + */ + public String getName() { + return this.metadata.get(nameField); + } + + /** + * Sets a list of {@code Parameter} objects giving the proposed configuration. + * + * @param parameters A list of {@code Parameter} objects giving the proposed configuration. + */ + public void setParameters(Collection<Parameter> parameters) { + Map<String, Parameter> paramMap = new HashMap<String, Parameter>(); + for (Parameter p : parameters) { + paramMap.put(p.getName(), p); + } + this.parameters = paramMap; + } + + /** + * @return The parameters on the proposed input. + */ + public Map<String, Parameter> getParameters() { + return this.parameters; + } + + /** + * Create a ValidationDefinition from a provided stream containing XML. The XML typically will look like + * + * <pre> + * {@code + * <items> + * <server_host>myHost</server_host> + * <server_uri>https://127.0.0.1:8089</server_uri> + * <session_key>123102983109283019283</session_key> + * <checkpoint_dir>/opt/splunk/var/lib/splunk/modinputs</checkpoint_dir> + * <item name="myScheme"> + * <param name="param1">value1</param> + * <param_list name="param2"> + * <value>value2</value> + * <value>value3</value> + * <value>value4</value> + * </param_list> + * </item> + * </items> + * } + * </pre> + * + * @param stream containing XML to parse. + * @return a ValidationDefinition. + * @throws ParserConfigurationException if there are errors in setting up the parser (which indicates system + * configuration issues). + * @throws IOException if there is an error in reading from the stream. + * @throws SAXException when the XML is invalid. + * @throws MalformedDataException when the XML does not meet the required schema. + */ + public static ValidationDefinition parseDefinition(InputStream stream) throws ParserConfigurationException, + IOException, SAXException, MalformedDataException { + DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setIgnoringElementContentWhitespace(true); + documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + documentBuilderFactory.setExpandEntityReferences(false); + documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); + DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); + Document doc = documentBuilder.parse(stream); + + ValidationDefinition definition = new ValidationDefinition(); + for (Node node = doc.getDocumentElement().getFirstChild(); node != null; node = node.getNextSibling()) { + if (node.getNodeType() == Node.TEXT_NODE || node.getNodeType() == Node.COMMENT_NODE) { + continue; + } else if (node.getNodeName().equals("item")) { + String name = node.getAttributes().getNamedItem("name").getNodeValue(); + definition.setName(name); + + List<Parameter> parameter = Parameter.nodeToParameterList(node); + definition.setParameters(parameter); + } else { + definition.metadata.put( + node.getNodeName(), + XmlUtil.textInNode(node, "Expected a text value in element " + node.getNodeName()) + ); + } + } + + return definition; + } + + @Override + public boolean equals(Object other) { + if (!(other instanceof ValidationDefinition)) { + return false; + } + ValidationDefinition that = (ValidationDefinition)other; + return this.metadata.equals(that.metadata) && this.parameters.equals(that.parameters); + } + + @Override + public int hashCode() { + return this.metadata.hashCode() ^ (this.parameters == null ? 0 : this.parameters.hashCode()); + } + +} diff --git a/splunk/src/main/java/com/splunk/modularinput/XmlUtil.java b/splunk/src/main/java/com/splunk/modularinput/XmlUtil.java new file mode 100755 index 00000000..3082aa47 --- /dev/null +++ b/splunk/src/main/java/com/splunk/modularinput/XmlUtil.java @@ -0,0 +1,72 @@ +/* + * Copyright 2013 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk.modularinput; + +import org.w3c.dom.Node; +import org.w3c.dom.Text; + +/** + * The {@code XmlUtil} class contains utility functions for handling XML that are used in several places. + */ +class XmlUtil { + + /** + * Given an {@code org.w3c.dom.Node} which is an element containing text, returns the text. If there + * is anything but text inside the element, throws a {@code MalformedDataException} with {@code errorMessage} as the reason. + * + * @param node The {@code Node} object to pull text out of. + * @param errorMessage The reason provided if there is something besides text in the element. + * @return A String of the text in the element. + * @throws MalformedDataException When there is anything besides text in the element. + */ + static String textInNode(Node node, String errorMessage) throws MalformedDataException { + Node child = node.getFirstChild(); + if (null == child) { + return ""; + } else if (child.getNodeType() != Node.TEXT_NODE) { + throw new MalformedDataException(errorMessage); + } else { + return ((Text) child).getData(); + } + } + + /** + * Coerces all the forms of Boolean Splunk may return to proper Booleans. + * + * @param s A String containing the Boolean from Splunk. + * @return A Java Boolean. + * @throws MalformedDataException If the string can't be coerced to a Boolean. + */ + static boolean normalizeBoolean(String s) throws MalformedDataException { + if (s == null) { + throw new MalformedDataException("Cannot interpret null as a boolean."); + } + + String value = s.trim().toLowerCase(); + + if (value.equals("true") || value.equals("t") || value.equals("on") || + value.equals("yes") || value.equals("y") || value.equals("1")) { + return true; + } else if (value.equals("false") || value.equals("f") || value.equals("off") || + value.equals("no") || value.equals("n") || value.equals("0")) { + return false; + } else { + throw new MalformedDataException("Cannot interpret string \"" + value + "\" as a boolean."); + } + + } +} diff --git a/splunk/src/test/java/com/splunk/ApplicationTest.java b/splunk/src/test/java/com/splunk/ApplicationTest.java new file mode 100644 index 00000000..df8afe2a --- /dev/null +++ b/splunk/src/test/java/com/splunk/ApplicationTest.java @@ -0,0 +1,235 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.*; +import org.w3c.dom.Document; +import org.w3c.dom.Node; +import org.w3c.dom.NodeList; + +import javax.xml.parsers.DocumentBuilderFactory; +import java.io.*; + +public class ApplicationTest extends SDKTestCase { + private String applicationName; + private Application application; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + removeTestApplications(); + + applicationName = createTemporaryName(); + application = service.getApplications().create(applicationName); + } + + + @After + @Override + public void tearDown() throws Exception { + removeTestApplications(); + + // Clear the restart message that deleting apps causes in splunkd. + // It's fine to keep going despite it. + clearRestartMessage(); + + super.tearDown(); + } + + private void removeTestApplications() { + final EntityCollection<Application> apps = service.getApplications(); + for (Application app : apps.values()) { + final String appName = app.getName(); + if (appName.startsWith("delete-me")) { + app.remove(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + apps.refresh(); + return !apps.containsKey(appName); + } + }); + } + } + } + + @Test + public void testForEmptySetup() { + final String setupXml = application.setup().getSetupXml(); + // Newly created applications now has a setup stub. + Assert.assertTrue(setupXml.contains("stub")); + } + + @Test + public void testForSetupPresent() throws Exception { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("has_setup_xml"); + Assert.assertTrue(service.getApplications().containsKey("has_setup_xml")); + Application applicationWithSetupXml = service.getApplications().get("has_setup_xml"); + + ApplicationSetup applicationSetup = applicationWithSetupXml.setup(); + Assert.assertEquals("has_setup_xml", applicationSetup.getName()); + Assert.assertFalse(applicationSetup.getRefresh()); + + String setupXml = applicationSetup.getSetupXml(); + Document parsedSetupXml = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse( + new ByteArrayInputStream(setupXml.getBytes("UTF-8"))); + parsedSetupXml.getDocumentElement().normalize(); + + Assert.assertEquals(parsedSetupXml.getDocumentElement().getNodeName(), "SetupInfo"); + + NodeList blocks = parsedSetupXml.getDocumentElement().getElementsByTagName("block"); + Assert.assertEquals(1, blocks.getLength()); + Node block = blocks.item(0); + Assert.assertEquals("block", block.getNodeName()); + } + + @Test + public void testArchive() { + ApplicationArchive archive = application.archive(); + Assert.assertEquals(applicationName, archive.getAppName()); + { + String filePath = archive.getFilePath(); + Assert.assertTrue(filePath.contains("/") || filePath.contains("\\")); + Assert.assertTrue(filePath.endsWith(applicationName + ".spl")); + } + Assert.assertFalse(archive.getRefresh()); + Assert.assertTrue(archive.getUrl() != null); + } + + @Test + public void testFields() { + // Initially, should be empty. + Assert.assertEquals(null, application.getAuthor()); + Assert.assertTrue(application.getCheckForUpdates()); + Assert.assertFalse(application.isConfigured()); + Assert.assertTrue(application.isVisible()); + Assert.assertFalse(application.stateChangeRequiresRestart()); + Assert.assertFalse(application.getRefresh()); + + String authorString = "Boris the mad baboon"; + application.setAuthor(authorString); + application.setCheckForUpdates(false); + String descriptionString = "Meep the nudebranch!"; + application.setDescription(descriptionString); + String labelString = "Hugga wugga"; + application.setLabel(labelString); + String versionString = "VII"; + application.setVersion(versionString); + application.setConfigured(true); + application.setVisible(false); + + application.update(); + application.refresh(); + + Assert.assertEquals(authorString, application.getAuthor()); + Assert.assertFalse(application.getCheckForUpdates()); + Assert.assertEquals(descriptionString, application.getDescription()); + Assert.assertEquals(labelString, application.getLabel()); + Assert.assertEquals(versionString, application.getVersion()); + Assert.assertTrue(application.isConfigured()); + Assert.assertFalse(application.isVisible()); + } + + @Test + public void testUpdate() { + if (service.getApplications().get("wc") == null) { + System.out.println("WARNING: Must have app wc installed on splunkd to run ApplicationTest.testUpdate"); + return; + } + + // Set the version of wc to something small, + // then wait for splunkd to pull its update information from splunkbase. + + Application gettingStarted = service.getApplications().get("wc"); + String originalVersion = gettingStarted.getVersion(); + try { + // Decrease the app's version + gettingStarted.setVersion("0.1"); + gettingStarted.update(); + + // The easiest way to force Splunk to check for new versions of apps + // is to restart it. Otherwise who knows how long it will be... + uncheckedSplunkRestart(); + gettingStarted = service.getApplications().get("wc"); + + // Wait until Splunk sees that an update for the app is available + // NOTE: This typically takes about 15s + final Application gettingStartedReference = gettingStarted; + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 100; } + @Override + public boolean predicate() { + return gettingStartedReference.getUpdate().getChecksum() != null; + } + }); + + // Verify expected properties of the update + ApplicationUpdate update = gettingStarted.getUpdate(); + Assert.assertEquals("315d8e92a0227aa75bbca1b8f33b4970", update.getChecksum()); + Assert.assertEquals("md5", update.getChecksumType()); + Assert.assertEquals("https://apps.splunk.com/app/1541/", update.getHomepage()); + Assert.assertEquals(39879, update.getSize()); + Assert.assertEquals("wc - word count", update.getUpdateName()); + Assert.assertEquals( + "https://apps.splunk.com/app/1541/package/1.0/none/", + update.getAppUrl() + ); + Assert.assertEquals("1.0", update.getVersion()); + Assert.assertFalse(update.isImplicitIdRequired()); + } finally { + // Restore the app's original version + gettingStarted.setVersion(originalVersion); + gettingStarted.update(); + } + } + + @Test + public void testEmptyUpdate() { + ApplicationUpdate update = application.getUpdate(); + Assert.assertNull(update.getChecksum()); + Assert.assertNull(update.getChecksumType()); + Assert.assertNull(update.getHomepage()); + Assert.assertEquals(-1, update.getSize()); + Assert.assertNull(update.getUpdateName()); + Assert.assertNull(update.getAppUrl()); + Assert.assertNull(update.getVersion()); + Assert.assertFalse(update.isImplicitIdRequired()); + } + + @Test + public void testListApplications() { + boolean found = false; + for (Application app : service.getApplications().values()) { + if (app.getName().equals(applicationName)) { + found = true; + } + } + Assert.assertTrue(found); + } + + @Test + public void testContains() { + Assert.assertTrue(service.getApplications().containsKey(applicationName)); + } + +} diff --git a/splunk/src/test/java/com/splunk/ArgsTest.java b/splunk/src/test/java/com/splunk/ArgsTest.java new file mode 100644 index 00000000..c408f790 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ArgsTest.java @@ -0,0 +1,26 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import junit.framework.TestCase; + +public class ArgsTest extends TestCase { + public void testCreateArgsWithNull() { + Args emptyArgs = Args.create(null); + assertTrue(emptyArgs.isEmpty()); + } +} diff --git a/splunk/src/test/java/com/splunk/AtomFeedTest.java b/splunk/src/test/java/com/splunk/AtomFeedTest.java new file mode 100644 index 00000000..e534e21a --- /dev/null +++ b/splunk/src/test/java/com/splunk/AtomFeedTest.java @@ -0,0 +1,99 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import com.google.gson.Gson; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; +import static junit.framework.TestCase.assertEquals; +import static junit.framework.TestCase.assertNull; + +import java.io.InputStream; +import java.util.*; + +/** + * Test the parsing of Atom feeds. + * + * All the raw XML to parse is in the data/atom/ directory, and the expected + * behavior is specified in the data/atom_test_data.json file. + */ +@RunWith(Parameterized.class) +public class AtomFeedTest { + private static Gson reader = new Gson(); + private static Map<String, Object> expectedData = reader.fromJson( + SDKTestCase.streamToString( + SDKTestCase.openResource( + "/data/atom_test_data.json")), + Map.class); + + private Map<String, Object> expectedFeed; + private String testName; + private InputStream xmlStream; + + public AtomFeedTest(String testName) { + this.testName = testName; + this.expectedFeed = (Map<String, Object>)expectedData.get(testName); + this.xmlStream = SDKTestCase.openResource("/data/atom/" + testName + ".xml"); + } + + @Test + public void testAtomFeed() { + Map<String, Object> expectedMetadata = (Map<String, Object>)expectedFeed.get("metadata"); + AtomFeed actualFeed = AtomFeed.parseStream(this.xmlStream); + + assertEquals(expectedMetadata.get("itemsPerPage"), actualFeed.itemsPerPage); + assertEquals(expectedMetadata.get("startIndex"), actualFeed.startIndex); + assertEquals(expectedMetadata.get("totalResults"), actualFeed.totalResults); + + // The generator header is ignored by AtomFeed, so we don't test it. + + List<Map<String, Object>> expectedEntries = (List<Map<String, Object>>)expectedFeed.get("entries"); + List<AtomEntry> actualEntries = (List<AtomEntry>)actualFeed.entries; + for (int i = 0; i < actualEntries.size(); i++) { + AtomEntry actualEntry = actualEntries.get(i); + Map<String, Object> expectedEntry = expectedEntries.get(i); + assertEquals(expectedEntry.get("id"), actualEntry.id); + assertEquals(expectedEntry.get("title"), actualEntry.title); + assertEquals(expectedEntry.get("updated"), actualEntry.updated); + // "author" is not parsed. + Map<String, String> expectedLinks = (Map<String, String>)expectedEntry.get("links"); + for (String linkName : actualEntry.links.keySet()) { + assertEquals(expectedLinks.get(linkName), actualEntry.links.get(linkName)); + } + if (expectedEntry.containsKey("content")) { + Map<String, Object> expectedContent = (Map<String, Object>)expectedEntry.get("content"); + for (String key : actualEntry.content.keySet()) { + if (!key.startsWith("eai:")) { + assertEquals("Mismatch on " + key, expectedContent.get(key), actualEntry.content.get(key)); + } + } + } else { + assertNull(actualEntry.content); + } + } + } + + @Parameterized.Parameters(name="{0}") + public static Collection<Object[]> testCases() { + Collection<Object[]> cases = new ArrayList<Object[]>(); + for (String key : (Set<String>)expectedData.keySet()) { + cases.add(new Object[] { key }); + } + return cases; + } +} diff --git a/splunk/src/test/java/com/splunk/ConfigurationTest.java b/splunk/src/test/java/com/splunk/ConfigurationTest.java new file mode 100644 index 00000000..b68670a1 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ConfigurationTest.java @@ -0,0 +1,136 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class ConfigurationTest extends SDKTestCase { + private Service appService; + private String applicationName; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + // We cannot straightforwardly delete confs, + // so instead we create a temporary application, + // reconnect using its namespace, then delete it + // when we're done. + applicationName = createTemporaryName(); + service.getApplications().create(applicationName); + + // We cannot easily change the namespace of service, + // so rather than fight with it, we create a new + // service with the right namespace and work from it + // instead. Then we'll return to service in tearDown + // to clean up. + + // NOTE: If you ever have to put a restart into + // the configuration tests, then you will need + // to explicitly re-login appService, since it will + // not be re-logged in by the call to restartSplunk. + Args applicationArgs = new Args(command.opts); + applicationArgs.put("sharing", "app"); + applicationArgs.put("owner", "nobody"); + applicationArgs.put("app", applicationName); + appService = Service.connect(applicationArgs); + } + + @After + @Override + public void tearDown() throws Exception { + appService.logout(); + + final EntityCollection<Application> apps = service.getApplications(); + apps.remove(applicationName); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return !apps.refresh().containsKey(applicationName); + } + }); + clearRestartMessage(); + + super.tearDown(); + } + + @Test + public void testStandardFilesExist() { + ConfCollection confs = appService.getConfs(); + Assert.assertTrue(confs.containsKey("eventtypes")); + Assert.assertTrue(confs.containsKey("indexes")); + Assert.assertTrue(confs.containsKey("inputs")); + Assert.assertTrue(confs.containsKey("props")); + Assert.assertTrue(confs.containsKey("transforms")); + Assert.assertTrue(confs.containsKey("savedsearches")); + + for (Entity stanza : confs.get("indexes").values()) { + Assert.assertNotNull(stanza); + Assert.assertNotNull(stanza.getName()); + Assert.assertNotNull(stanza.getPath()); + } + } + + @Test + public void testCreateConf() { + ConfCollection confs = appService.getConfs(); + String confName = createTemporaryName(); + + Assert.assertFalse("New configuration name already used.", confs.containsKey(confName)); + EntityCollection<Entity> conf = confs.create(confName); + Assert.assertTrue("New configuration doesn't show up after creation.", confs.containsKey(confName)); + Assert.assertEquals("New configuration is not empty.", 0, conf.size()); + } + + @Test + public void testCreateAndDeleteStanza() { + ConfCollection confs = appService.getConfs(); + String confName = createTemporaryName(); + EntityCollection<Entity> conf = confs.create(confName); + + String stanzaName = createTemporaryName(); + Assert.assertFalse("Stanza already exists.", conf.containsKey(stanzaName)); + Entity stanza = conf.create(stanzaName); + + Assert.assertTrue("Stanza doesn't show up after creation.", conf.containsKey(stanzaName)); + Assert.assertEquals("Stanza contains something besides eai: and disabled attributes when first created.", 5, stanza.size()); + + stanza.remove(); + conf.refresh(); + Assert.assertFalse("Stanza not deleted by remove()", conf.containsKey(stanzaName)); + } + + @Test + public void testWriteToStanza() { + ConfCollection confs = appService.getConfs(); + String confName = createTemporaryName(); + EntityCollection<Entity> conf = confs.create(confName); + String stanzaName = createTemporaryName(); + Entity stanza = conf.create(stanzaName); + + Assert.assertEquals("Stanza begins with only eai:* and disabled in it.", 5, stanza.size()); + Args args = new Args(); + args.put("test-key", "42"); + stanza.update(args); + Assert.assertEquals("Stanza has right size after write.", 6, stanza.size()); + Assert.assertEquals("Read from key gives right value.", "42", stanza.get("test-key")); + } +} diff --git a/splunk/src/test/java/com/splunk/CookieTest.java b/splunk/src/test/java/com/splunk/CookieTest.java new file mode 100644 index 00000000..d11cda76 --- /dev/null +++ b/splunk/src/test/java/com/splunk/CookieTest.java @@ -0,0 +1,234 @@ +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.net.HttpCookie; +import java.util.HashMap; +import java.util.Map; + +import org.junit.*; + +public class CookieTest extends SDKTestCase { + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + // Cookies were not around before version 6.2 + Assume.assumeTrue(service.versionIsAtLeast("6.2")); + } + + @Test + public void testGotCookieOnLogin() { + Map<String, Object> args = getStandardArgs(); + args.put("scheme", (String) command.opts.get("scheme")); + args.put("username", (String) command.opts.get("username")); + args.put("password", (String) command.opts.get("password")); + Service s = new Service(args); + + s.login(); + + Assert.assertNotEquals(s.stringifyCookies().length(), 0); + } + + @Test + public void testLoginWithCookie() { + String validCookie = service.stringifyCookies(); + + Map<String, Object> args = getStandardArgs(); + args.put("cookie", validCookie); + + Service s = new Service(args); + + // Ensure we can perform some action. + // In particular we don't expect an unauthenticated error. + s.getSettings().refresh(); + + // Make sure we're still using the same token. + // In particular we don't want to trigger auto-login functionality + // that may get a new cookie. + Assert.assertEquals(s.stringifyCookies(), validCookie); + } + + @Test + public void testLoginWithCookieFromAnotherService() { + String validCookie = service.stringifyCookies(); + + Map<String, Object> args = getStandardArgs(); + args.put("cookie", validCookie); + + Service s = new Service(args); + + // Ensure we can perform some action. + // In particular we don't expect an unauthenticated error. + s.getSettings().refresh(); + + // Make sure we're still using the same token. + // In particular we don't want to trigger auto-login functionality + // that may get a new cookie. + Assert.assertEquals(s.stringifyCookies(), validCookie); + + // Now we should be able to login with only a cookie + args.remove("username"); + args.remove("password"); + Service s2 = new Service(args); + + s2.getApplications(); + } + + @Test(expected=HttpException.class) + public void testLoginFailsWithBadCookie() { + Map<String, Object> args = getStandardArgs(); + args.put("cookie", "bad=cookie"); + + Service s = new Service(args); + + s.getSettings().refresh(); + } + + @Test(expected=HttpException.class) + public void testAuthenticationFailsWithNoCookieOrLogin() { + Service s = new Service(service.getHost(), service.getPort()); + + s.getSettings().refresh(); + } + + @Test + public void testLoginWithMultipleCookies() { + String validCookie = service.stringifyCookies(); + + Map<String, Object> args = getStandardArgs(); + args.put("cookie", validCookie); + + Service s = new Service(args); + + s.addCookie("bad=cookie"); + + s.getSettings().refresh(); + } + + @Test + public void testLoginWithOtherCookies() { + String otherCookies = "load=balancer;"; + service.logout(); + service.cookieStore.removeAll(); + service.cookieStore.add(otherCookies); + service.login(); + service.getApplications(); + service.cookieStore.removeAll(); + } + + @Test + public void testUsingAuthTokenAndOtherCookie(){ + String validToken = service.getToken(); + Assert.assertTrue(validToken.startsWith("Splunk ")); + String otherCookies = "load=balancer;"; + Map<String, Object> args = new HashMap<>(); + args.put("cookie", otherCookies); + args.put("host",service.getHost()); + args.put("port", service.getPort()); + Service s = new Service(args); + s.setToken(validToken); + s.getApplications(); + Assert.assertEquals(otherCookies.trim(),s.cookieStore.getCookies().trim()); + } + + @Test + public void testLoginWithMultipleInvalidCookies() { + String validCookie = service.stringifyCookies(); + + Map<String, Object> args = getStandardArgs(); + + Service s = new Service(args); + + s.addCookie("bad=cookie"); + s.addCookie(validCookie); + s.addCookie("another_bad=cookie"); + + s.getSettings().refresh(); + } + + @Test + public void testLoginWithMultipleCookiesReversed() { + String validCookie = service.stringifyCookies(); + + Map<String, Object> args = getStandardArgs(); + args.put("cookie", "bad=cookie"); + Service s = new Service(args); + + s.addCookie(validCookie); + + s.getSettings().refresh(); + } + + @Test + public void testHttpServiceWithValidCookie() { + String validCookie = service.stringifyCookies(); + + HttpService httpService; + + httpService = new HttpService( + (String)command.opts.get("host"), + (Integer)command.opts.get("port"), + (String)command.opts.get("scheme") + ); + + httpService.addCookie(validCookie); + + httpService.get("/services/authentication/users"); + + Assert.assertEquals(validCookie, httpService.stringifyCookies()); + } + + @Test(expected=HttpException.class) + public void testHttpServiceWithInvalidCookie() { + HttpService httpService; + + httpService = new HttpService( + (String)command.opts.get("host"), + (Integer)command.opts.get("port"), + (String)command.opts.get("scheme") + ); + + httpService.addCookie("bad=cookie"); + + httpService.get("/services/authentication/users"); + } + + @Test(expected=HttpException.class) + public void testHttpServiceWithNoCookie() { + HttpService httpService; + + httpService = new HttpService( + (String)command.opts.get("host"), + (Integer)command.opts.get("port"), + (String)command.opts.get("scheme") + ); + + httpService.get("/services/authentication/users"); + } + + private Map<String, Object> getStandardArgs() { + Map<String, Object> args = new HashMap<String, Object>(); + args.put("host", (String)command.opts.get("host")); + args.put("port", (Integer) command.opts.get("port")); + + return args; + } + +} diff --git a/splunk/src/test/java/com/splunk/DataModelTest.java b/splunk/src/test/java/com/splunk/DataModelTest.java new file mode 100644 index 00000000..2a8585e8 --- /dev/null +++ b/splunk/src/test/java/com/splunk/DataModelTest.java @@ -0,0 +1,545 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Test; + +import java.util.*; + +public class DataModelTest extends SDKTestCase { + @After + public void tearDown() throws Exception { + Collection<DataModel> dataModels = service.getDataModels().values(); + for (DataModel d : dataModels) { + if (d.getName().startsWith("delete-me")) { + d.remove(); + } + } + + super.tearDown(); + } + + @Test + public void testDataModelCollectionCreateAndDelete() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/empty_data_model.json"))); + + int initialN = dataModels.size(); + + DataModel dataModel = dataModels.create(createTemporaryName(), args); + Assert.assertEquals(initialN+1, dataModels.size()); + + dataModel.remove(); + dataModels.refresh(); + Assert.assertEquals(initialN, dataModels.size()); + } + + @Test + public void testDataModelObjectFetchNotNull() { + DataModelCollection dataModelCollection = service.getDataModels(); + DataModel model = dataModelCollection.get("internal_audit_logs"); + DataModelObject searches = model.getObject("searches"); + + Assert.assertNotNull(searches); + } + + @Test + public void testDataModelWithZeroObjects() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/empty_data_model.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + Assert.assertEquals(0, model.getObjects().size()); + + // Make sure this works after refresh as well. + model.refresh(); + Assert.assertEquals(0, model.getObjects().size()); + } + + @Test + public void testDataModelWithOneObject() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/object_with_one_search.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + Assert.assertEquals(1, model.getObjects().size()); + + // Make sure this works after refresh as well. + model.refresh(); + Assert.assertEquals(1, model.getObjects().size()); + } + + @Test + public void testDataModelWithTwoObjects() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/object_with_two_searches.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + Assert.assertEquals(2, model.getObjects().size()); + + // Make sure this works after refresh as well. + model.refresh(); + Assert.assertEquals(2, model.getObjects().size()); + } + + @Test + public void testGetAndContainsObjectWork() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/object_with_two_searches.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + Assert.assertTrue(model.containsObject("search1")); + Assert.assertTrue(model.containsObject("search2")); + + DataModelObject search1 = model.getObject("search1"); + Assert.assertNotNull(search1); + Assert.assertEquals("\u0bf5\u0bf1\u0bf0\u0bef - search 1", search1.getDisplayName()); + + DataModelObject search2 = model.getObject("search2"); + Assert.assertNotNull(search2); + Assert.assertEquals("\u0bf5\u0bf1\u0bf0\u0bef - search 2", search2.getDisplayName()); + } + + @Test + public void testDataModelWithUnicodeAttributes() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + String modelName = createTemporaryName(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/model_with_unicode_headers.json"))); + DataModel model = dataModels.create(modelName, args); + + Assert.assertEquals(modelName, model.getName()); + Assert.assertEquals("\u1029\u1699\u0bf5", model.getDisplayName()); + Assert.assertEquals("\u0bf5\u0bf1\u0bf0\u0bef", model.getDescription()); + } + + @Test + public void testDataModelWithEmptyAttributes() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + String modelName = createTemporaryName(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/model_with_empty_headers.json"))); + DataModel model = dataModels.create(modelName, args); + + Assert.assertEquals(modelName, model.getName()); + Assert.assertEquals("", model.getDisplayName()); + Assert.assertEquals("", model.getDescription()); + } + + @Test + public void testAccelerationSettings() { + Args serviceArgs = new Args(); + serviceArgs.put("host", service.getHost()); + serviceArgs.put("port", service.getPort()); + serviceArgs.put("scheme", service.getScheme()); + serviceArgs.put("token", service.getToken()); + + serviceArgs.put("owner", "nobody"); + serviceArgs.put("app", "search"); + Service nonprivateService = new Service(serviceArgs); + + EntityCollection<DataModel> dataModels = nonprivateService.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_with_test_objects.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + final String crontabA = "*/5 * * * *"; + final String crontabB = "* * * * *"; + + model.setAcceleration(true); + model.setEarliestAcceleratedTime("-2mon"); + model.setAccelerationCronSchedule(crontabA); + model.update(); + + Assert.assertTrue(model.isAccelerated()); + Assert.assertEquals("-2mon", model.getEarliestAcceleratedTime()); + Assert.assertEquals(crontabA, model.getAccelerationCronSchedule()); + Assert.assertFalse(model.isManualRebuilds()); + + model.update(); // An empty update should also work + model.refresh(); + + Assert.assertTrue(model.isAccelerated()); + Assert.assertEquals("-2mon", model.getEarliestAcceleratedTime()); + Assert.assertEquals(crontabA, model.getAccelerationCronSchedule()); + Assert.assertFalse(model.isManualRebuilds()); + + model.setAcceleration(false); + model.setEarliestAcceleratedTime("-1mon"); + model.setAccelerationCronSchedule(crontabB); + model.update(); + + Assert.assertFalse(model.isAccelerated()); + Assert.assertEquals("-1mon", model.getEarliestAcceleratedTime()); + Assert.assertEquals(crontabB, model.getAccelerationCronSchedule()); + Assert.assertFalse(model.isManualRebuilds()); + + model.setManualRebuilds(true); + // Acceleration must be set, or splunkd will crash + model.setAcceleration(false); + model.update(); + + Assert.assertFalse(model.isAccelerated()); + Assert.assertEquals("-1mon", model.getEarliestAcceleratedTime()); + Assert.assertEquals(crontabB, model.getAccelerationCronSchedule()); + Assert.assertTrue(model.isManualRebuilds()); + } + + @Test + public void testObjectMetadata() { + DataModelCollection models = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_with_test_objects.json"))); + DataModel model = models.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("event1"); + Assert.assertNotNull(object); + + Assert.assertEquals("event1 \u1029\u1699", object.getDisplayName()); + Assert.assertEquals("event1", object.getName()); + Assert.assertEquals(model, object.getDataModel()); + } + + @Test + public void testParentOnChild() { + DataModelCollection models = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_with_test_objects.json"))); + DataModel model = models.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("event1"); + Assert.assertNotNull(object); + + object.getParent(); + } + + @Test + public void testLineage() { + DataModelCollection models = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/inheritance_test_data.json"))); + DataModel model = models.create(createTemporaryName(), args); + + Collection<DataModelObject> children; + + DataModelObject object = model.getObject("level_0"); + Assert.assertNotNull(object); + Assert.assertArrayEquals(new String[]{"level_0"}, object.getLineage()); + Assert.assertEquals("BaseEvent", object.getParentName()); + + object = model.getObject("level_1"); + Assert.assertNotNull(object); + Assert.assertArrayEquals(new String[]{"level_0", "level_1"}, object.getLineage()); + Assert.assertEquals("level_0", object.getParentName()); + + object = model.getObject("level_2"); + Assert.assertNotNull(object); + Assert.assertArrayEquals(new String[]{"level_0", "level_1", "level_2"}, object.getLineage()); + Assert.assertEquals("level_1", object.getParentName()); + } + + @Test + public void testObjectFields() { + DataModelCollection models = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/inheritance_test_data.json"))); + DataModel model = models.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("level_2"); + Assert.assertNotNull(object); + Assert.assertEquals(5, object.getAutoExtractedFields().size()); + + DataModelField f = object.getField("_time"); + Assert.assertEquals("BaseEvent", f.getOwnerName()); + Assert.assertArrayEquals(new String[]{"BaseEvent"}, f.getOwnerLineage()); + Assert.assertEquals(FieldType.TIMESTAMP, f.getType()); + Assert.assertEquals("_time", f.getName()); + Assert.assertEquals("_time", f.getDisplayName()); + Assert.assertEquals(false, f.isRequired()); + Assert.assertEquals(false, f.isMultivalued()); + Assert.assertEquals(false, f.isHidden()); + Assert.assertEquals(false, f.isEditable()); + Assert.assertEquals("", f.getComment()); + + f = object.getField("level_2"); + Assert.assertEquals("level_2", f.getOwnerName()); + Assert.assertArrayEquals(new String[]{"level_0", "level_1", "level_2"}, f.getOwnerLineage()); + Assert.assertEquals(FieldType.OBJECTCOUNT, f.getType()); + Assert.assertEquals("level_2", f.getName()); + Assert.assertEquals("level 2", f.getDisplayName()); + Assert.assertEquals(false, f.isRequired()); + Assert.assertEquals(false, f.isMultivalued()); + Assert.assertEquals(false, f.isHidden()); + Assert.assertEquals(false, f.isEditable()); + Assert.assertEquals("", f.getComment()); + } + + @Test + public void testOutputObjectFields() { + DataModelCollection models = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_for_pivot.json"))); + DataModel model = models.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("test_data"); + Assert.assertEquals(5, object.getAutoExtractedFields().size()); + Assert.assertEquals(10, object.getFields().size()); + Assert.assertTrue(object.containsField("has_boris")); + Assert.assertTrue(object.containsField("_time")); + } + + + @Test + public void testCreateLocalAccelerationJob() { + DataModelCollection models = service.getDataModels(); + + String dataModelName = createTemporaryName(); + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/inheritance_test_data.json"))); + DataModel model = models.create(dataModelName, args); + + DataModelObject object = model.getObject("level_2"); + Assert.assertNotNull(object); + + final Job accelerationJob = object.createLocalAccelerationJob(); + + try { + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return accelerationJob.isReady(); + } + }); + + Assert.assertEquals( + "| datamodel " + dataModelName + " level_2 search | tscollect", + accelerationJob.getSearch() + ); + } finally { + accelerationJob.cancel(); + } + } + + @Test + public void testCreateLocalAccelerationJobWithEarliestTime() { + DataModelCollection models = service.getDataModels(); + + String dataModelName = createTemporaryName(); + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/inheritance_test_data.json"))); + DataModel model = models.create(dataModelName, args); + + DataModelObject object = model.getObject("level_2"); + Assert.assertNotNull(object); + + final Job accelerationJob = object.createLocalAccelerationJob("-1d"); + try { + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return accelerationJob.isReady(); + } + }); + + Assert.assertEquals( + "| datamodel " + dataModelName + " level_2 search | tscollect", + accelerationJob.getSearch() + ); + } finally { + accelerationJob.cancel(); + } + // I don't have a good way of getting a date two weeks ago in Java, so + // the earliest time part of this is simply untested. + } + + @Test + public void testConstraints() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_with_test_objects.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("event1"); + Assert.assertNotNull(object); + + Assert.assertEquals(1, object.getConstraints().size()); + boolean only_one = true; + for (DataModelConstraint c : object.getConstraints()) { + Assert.assertTrue(only_one); + only_one = false; + Assert.assertEquals("event1", c.getOwner()); + Assert.assertEquals("uri=\"*.php\" OR uri=\"*.py\"\n" + + "NOT (referer=null OR referer=\"-\")", c.getQuery()); + } + } + + @Test + public void testCalculations() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_with_test_objects.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("event1"); + Assert.assertNotNull(object); + + Map<String, DataModelCalculation> calculations = object.getCalculations(); + Assert.assertEquals(4, calculations.size()); + + EvalDataModelCalculation c = (EvalDataModelCalculation)calculations.get("93fzsv03wa7"); + Assert.assertEquals("event1", c.getOwner()); + Assert.assertArrayEquals(new String[]{"event1"}, c.getLineage()); + Assert.assertEquals("", c.getComment()); + Assert.assertEquals(true, c.isEditable()); + Assert.assertEquals( + "if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\")", + c.getExpression() + ); + Assert.assertEquals(1, c.getGeneratedFields().size()); + DataModelField f = c.getGeneratedField("new_field"); + Assert.assertNotNull(f); + Assert.assertEquals("My New Field", f.getDisplayName()); + + LookupDataModelCalculation lc = (LookupDataModelCalculation)calculations.get("sr3mc8o3mjr"); + Assert.assertEquals("event1", lc.getOwner()); + Assert.assertArrayEquals(new String[]{"event1"}, lc.getLineage()); + Assert.assertEquals("", lc.getComment()); + Assert.assertEquals(true, lc.isEditable()); + List<LookupDataModelCalculation.LookupFieldMapping> expectedFieldMappings = + new ArrayList<LookupDataModelCalculation.LookupFieldMapping>(); + expectedFieldMappings.add(new LookupDataModelCalculation.LookupFieldMapping() {{ + inputField = "host"; + lookupField = "a_lookup_field"; + }}); + Assert.assertEquals("dnslookup", lc.getLookupName()); + + RegexpDataModelCalculation rc = (RegexpDataModelCalculation)calculations.get("a5v1k82ymic"); + Assert.assertEquals(2, rc.getGeneratedFields().size()); + Assert.assertEquals("_raw", rc.getInputField()); + Assert.assertEquals(" From: (?<from>.*) To: (?<to>.*) ", rc.getExpression()); + + GeoIPDataModelCalculation gc = (GeoIPDataModelCalculation)calculations.get("pbe9bd0rp4"); + Assert.assertEquals("\u1029\u1699\u0bf5 comment of pbe9bd0rp4", gc.getComment()); + Assert.assertEquals(5, gc.getGeneratedFields().size()); + Assert.assertEquals("output_from_reverse_hostname", gc.getInputField()); + } + + @Test + public void testRunQuery() { + DataModel dataModel = service.getDataModels().get("internal_audit_logs"); + DataModelObject searches = dataModel.getObject("searches"); + + Job job = null; + try { + final Job j = searches.runQuery(); + job = j; + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return j.isReady(); + } + }); + Assert.assertEquals("| datamodel " + dataModel.getName() + " " + searches.getName() + " search", job.getSearch()); + } finally { + if (job != null) { + job.cancel(); + } + } + + job = null; + try { + job = searches.runQuery("| head 3", new JobArgs() {{ + setEnableLookups(false); + put("status_buckets", "5"); + }}); + final Job j = job; + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return j.isReady(); + } + }); + Assert.assertEquals("| datamodel " + dataModel.getName() + " " + searches.getName() + " search| head 3", job.getSearch()); + Assert.assertEquals(5, job.getInteger("statusBuckets")); + } finally { + if (job != null) { + job.cancel(); + } + } + } + + @Test + public void testBaseSearchProperlyParsed() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/model_with_multiple_types.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("search1"); + Assert.assertNotNull(object); + Assert.assertTrue(object instanceof DataModelSearch); + DataModelSearch s = (DataModelSearch)object; + + Assert.assertEquals("BaseSearch", s.getParentName()); + Assert.assertEquals("search index=_internal | head 10", s.getBaseSearch()); + } + + @Test + public void testBaseTransactionProperlyParsed() { + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/model_with_multiple_types.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + DataModelObject object = model.getObject("transaction1"); + Assert.assertNotNull(object); + Assert.assertTrue(object instanceof DataModelTransaction); + DataModelTransaction t = (DataModelTransaction)object; + + Assert.assertArrayEquals(new String[] {"event1"}, t.getObjectsToGroup().toArray()); + Assert.assertArrayEquals(new String[] {"host", "from"}, t.getGroupByFields().toArray()); + + Assert.assertEquals("25s", t.getMaxPause()); + Assert.assertEquals("100m", t.getMaxSpan()); + } +} + diff --git a/splunk/src/test/java/com/splunk/DeploymentClientTest.java b/splunk/src/test/java/com/splunk/DeploymentClientTest.java new file mode 100644 index 00000000..47167597 --- /dev/null +++ b/splunk/src/test/java/com/splunk/DeploymentClientTest.java @@ -0,0 +1,67 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class DeploymentClientTest extends SDKTestCase { + @Test + public void testDeploymentClient() throws Exception { + DeploymentClient deploymentClient = service.getDeploymentClient(); + String uri = deploymentClient.getTargetUri(); + if (uri == null) { + System.out.println("WARNING: No DeploymentClient entities to test"); + return; + } + + // Try to disable & enable with standard methods (which should fail) + try { + deploymentClient.disable(); + Assert.fail("Expected disable to fail."); + } catch (UnsupportedOperationException e) { + // Expected + } + try { + deploymentClient.enable(); + Assert.fail("Expected enable to fail."); + } catch (UnsupportedOperationException e) { + // Expected + } + + // Try to disable & enable with setters + deploymentClient.setDisabled(true); + // TODO: Should there be an update here? + deploymentClient.setDisabled(false); + // TODO: Should there be an update here? + + deploymentClient.reload(); + + // Probe via setter + deploymentClient.setTargetUri("1.2.3.4:8080"); + deploymentClient.update(); + Assert.assertEquals("1.2.3.4:8080", deploymentClient.getTargetUri()); + + // Prove via argument map + deploymentClient.update(new Args("targetUri", uri)); + Assert.assertEquals(uri, deploymentClient.getTargetUri()); + + // Ensure getters throw no exceptions + deploymentClient.getServerClasses(); + deploymentClient.getTargetUri(); + } +} diff --git a/splunk/src/test/java/com/splunk/DeploymentServerClassTest.java b/splunk/src/test/java/com/splunk/DeploymentServerClassTest.java new file mode 100644 index 00000000..94dc00e8 --- /dev/null +++ b/splunk/src/test/java/com/splunk/DeploymentServerClassTest.java @@ -0,0 +1,177 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class DeploymentServerClassTest extends SDKTestCase { + private EntityCollection<DeploymentServerClass> classes; + private String serverClassName; + private DeploymentServerClass serverClass; + + @Before @Override + public void setUp() throws Exception { + super.setUp(); + + classes = service.getDeploymentServerClasses(); + + // Create a temporary deployment serverclass. + serverClassName = createTemporaryName(); + serverClass = classes.create(serverClassName); + // NOTE: We cannot delete server classes via the + // REST API, so randomly named ones will just accumulate. + } + + @Test + public void testCreate() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + Assert.assertTrue(classes.containsKey(serverClassName)); + } + + @Test + public void testDisable() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + if (serverClass.isDisabled()) { + serverClass.enable(); + serverClass.refresh(); + Assert.assertFalse(serverClass.isDisabled()); + } + + serverClass.disable(); + serverClass.refresh(); + Assert.assertTrue(serverClass.isDisabled()); + } + + @Test + public void testEnable() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + if (!serverClass.isDisabled()) { + serverClass.disable(); + serverClass.refresh(); + Assert.assertTrue(serverClass.isDisabled()); + } + + serverClass.enable(); + serverClass.refresh(); + Assert.assertFalse(serverClass.isDisabled()); + } + + @Test + public void testBlacklist() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + String[] blacklist = {"bad1.splunk.com", "bad2.splunk.com"}; + + for (int i = 0; i < blacklist.length; i++) { + serverClass.setBlacklistByIndex(i, blacklist[i]); + } + + serverClass.update(); + serverClass.refresh(); + + for (int i = 0; i < blacklist.length; i++) { + Assert.assertEquals(blacklist[i], serverClass.getBlacklistByIndex(i)); + } + + Assert.assertEquals(Util.join(",", blacklist), serverClass.getBlacklist()); + } + + @Test + public void testWhitelist() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + String[] whitelist = {"bad1.splunk.com", "bad2.splunk.com"}; + + for (int i = 0; i < whitelist.length; i++) { + serverClass.setWhitelistByIndex(i, whitelist[i]); + } + + serverClass.update(); + serverClass.refresh(); + + for (int i = 0; i < whitelist.length; i++) { + Assert.assertEquals(whitelist[i], serverClass.getWhitelistByIndex(i)); + } + + Assert.assertEquals(Util.join(",", whitelist), serverClass.getWhitelist()); + } + + @Test + public void testContinueMatching() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + Assert.assertFalse(serverClass.getContinueMatching()); + serverClass.setContinueMatching(true); + serverClass.update(); + serverClass.refresh(); + Assert.assertTrue(serverClass.getContinueMatching()); + } + + @Test + public void testEndpoint() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + serverClass.setEndPoint("boris the mad baboon"); + serverClass.update(); + serverClass.refresh(); + Assert.assertEquals("boris the mad baboon", serverClass.getEndpoint()); + } + + @Test + public void testFilterType() { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } + + serverClass.setFilterType("whitelist"); + serverClass.update(); + serverClass.refresh(); + Assert.assertEquals("whitelist", serverClass.getFilterType()); + + serverClass.setFilterType("blacklist"); + serverClass.refresh(); + Assert.assertEquals("blacklist", serverClass.getFilterType()); + } +} + diff --git a/tests/com/splunk/DeploymentServerTest.java b/splunk/src/test/java/com/splunk/DeploymentServerTest.java similarity index 52% rename from tests/com/splunk/DeploymentServerTest.java rename to splunk/src/test/java/com/splunk/DeploymentServerTest.java index 89d226a2..ba75489f 100644 --- a/tests/com/splunk/DeploymentServerTest.java +++ b/splunk/src/test/java/com/splunk/DeploymentServerTest.java @@ -16,22 +16,31 @@ package com.splunk; +import org.junit.Assert; import org.junit.Test; -public class DeploymentServerTest extends SplunkTestCase { - @Test public void testDeploymentServer() throws Exception { - Service service = connect(); +public class DeploymentServerTest extends SDKTestCase { + @Test + public void testDeploymentServer() throws Exception { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } EntityCollection<DeploymentServer> deploymentServers = service.getDeploymentServers(); if (deploymentServers.values().size() == 0) { - System.out.println("WARNING: Deployment Server not configured"); + System.out.println("WARNING: No DeploymentServer entities to test"); return; } - for (DeploymentServer deploymentServer: deploymentServers.values()) { - assertTrue(deploymentServer.getWhiteList0().length() > 0); - deploymentServer.getCheckNew(); + for (DeploymentServer deploymentServer : deploymentServers.values()) { + // Ensure getters throw no exceptions + deploymentServer.isDisabled(); + Assert.assertTrue(deploymentServer.getWhitelistByIndex(0).length() > 0); + for (int i=0; i<10; i++) { + deploymentServer.getWhitelistByIndex(i); + } } } } diff --git a/tests/com/splunk/DeploymentTenantTest.java b/splunk/src/test/java/com/splunk/DeploymentTenantTest.java similarity index 56% rename from tests/com/splunk/DeploymentTenantTest.java rename to splunk/src/test/java/com/splunk/DeploymentTenantTest.java index 8a9d5e4b..153b1064 100644 --- a/tests/com/splunk/DeploymentTenantTest.java +++ b/splunk/src/test/java/com/splunk/DeploymentTenantTest.java @@ -16,22 +16,31 @@ package com.splunk; +import org.junit.Assert; import org.junit.Test; -public class DeploymentTenantTest extends SplunkTestCase { - @Test public void testDeploymentTenant() throws Exception { - Service service = connect(); +public class DeploymentTenantTest extends SDKTestCase { + @Test + public void testDeploymentTenant() throws Exception { + if (service.versionIsAtLeast("6.0")) { + // WORKAROUND (DVPL-2993): The deployment server has changed in Splunk 6, and is not yet supported. + return; + } EntityCollection<DeploymentTenant> deploymentTenants = service.getDeploymentTenants(); if (deploymentTenants.values().size() == 0) { - System.out.println("WARNING: Deployment Tenant not configured"); + System.out.println("WARNING: No DeploymentTenant entities to test"); return; } - + for (DeploymentTenant deploymentTenant: deploymentTenants.values()) { - assertTrue(deploymentTenant.getWhiteList0().length() > 0); - deploymentTenant.getCheckNew(); + // Ensure getters throw no exceptions + deploymentTenant.isDisabled(); + Assert.assertTrue(deploymentTenant.getWhitelistByIndex(0).length() > 0); + for (int i=0; i<10; i++) { + deploymentTenant.getWhitelistByIndex(i); + } } } } diff --git a/splunk/src/test/java/com/splunk/DistributedConfTest.java b/splunk/src/test/java/com/splunk/DistributedConfTest.java new file mode 100644 index 00000000..24829488 --- /dev/null +++ b/splunk/src/test/java/com/splunk/DistributedConfTest.java @@ -0,0 +1,105 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class DistributedConfTest extends SDKTestCase { + DistributedConfiguration conf; + + @Before @Override + public void setUp() throws Exception { + super.setUp(); + + conf = service.getDistributedConfiguration(); + } + + @Test + // We want to continue testing deprecated getters and setters + @SuppressWarnings("deprecation") + public void testSetAutoAddServers() { + + String originalBlacklistNames = conf.getBlacklistNames(); + String newBlacklistNames = "boris,hilda,edward"; + + String originalBlacklistUrls = conf.getBlacklistUrls(); + String newBlacklistUrls = "*.google.com,*.yahoo.com"; + + int originalTimeoutFrequency = conf.getCheckTimedOutServersFrequency(); + int newTimeoutFrequency = originalTimeoutFrequency + 50; + + boolean originalRemoveTimedOutServers = conf.getRemovedTimedOutServers(); + boolean newRemoveTimesOutServers = !originalRemoveTimedOutServers; + + boolean originalShareBundles = conf.getShareBundles(); + boolean newShareBundles = !originalShareBundles; + + int originalStatusTimeout = conf.getStatusTimeout(); + int newStatusTimeout = originalStatusTimeout + 50; + + try { + + conf.setBlacklistNames(newBlacklistNames); + conf.setBlacklistURLs(newBlacklistUrls); + conf.setCheckTimedOutServersFrequency(newTimeoutFrequency); + conf.setRemoveTimedOutServers(newRemoveTimesOutServers); + conf.setShareBundles(newShareBundles); + conf.setStatusTimeout(newStatusTimeout); + + conf.refresh(); + + Assert.assertEquals(newBlacklistNames, conf.getBlacklistNames()); + Assert.assertEquals(newBlacklistUrls, conf.getBlacklistUrls()); + Assert.assertEquals(newTimeoutFrequency, conf.getCheckTimedOutServersFrequency()); + Assert.assertEquals(newRemoveTimesOutServers, conf.getRemovedTimedOutServers()); + Assert.assertEquals(newShareBundles, conf.getShareBundles()); + Assert.assertEquals(newStatusTimeout, conf.getStatusTimeout()); + + } finally { + conf.setBlacklistNames(originalBlacklistNames); + conf.setBlacklistURLs(originalBlacklistUrls); + conf.setCheckTimedOutServersFrequency(originalTimeoutFrequency); + conf.setRemoveTimedOutServers(originalRemoveTimedOutServers); + conf.setShareBundles(originalShareBundles); + conf.setStatusTimeout(originalStatusTimeout); + } + } + + @Test + public void testDisableAndEnable() { + Assert.assertEquals(conf.isDistSearchEnabled(), !conf.isDisabled()); + + // Ensure that distributed search is enabled so we know + // that disable works. + if (conf.isDisabled()) { + conf.enable(); + splunkRestart(); + } + + conf.disable(); + splunkRestart(); + conf.refresh(); + Assert.assertTrue(conf.isDisabled()); + + conf.enable(); + splunkRestart(); + conf.refresh(); + Assert.assertTrue(conf.isDistSearchEnabled()); + } +} diff --git a/splunk/src/test/java/com/splunk/DistributedPeerTest.java b/splunk/src/test/java/com/splunk/DistributedPeerTest.java new file mode 100644 index 00000000..1b627f89 --- /dev/null +++ b/splunk/src/test/java/com/splunk/DistributedPeerTest.java @@ -0,0 +1,198 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.*; + +@Ignore +/** + * To execute these test we need a separate splunk instance. Post splunk6.4, it is no longer allowed to connect to + * self as a peer because of name conflicts. + */ +public class DistributedPeerTest extends SDKTestCase { + EntityCollection<DistributedPeer> peers; + String temporaryUsername; + String temporaryPassword; + User temporaryUser; + + @Before @Override + public void setUp() throws Exception { + super.setUp(); + + + temporaryUsername = createTemporaryName(); + temporaryPassword = createTemporaryName(); + temporaryUser = service.getUsers().create(temporaryUsername, temporaryPassword, "admin"); + + // To create search peers sanely, we need to have + // distributed search enabled. + if (service.getDistributedConfiguration().isDisabled()) { + service.getDistributedConfiguration().enable(); + splunkRestart(); + } + + peers = service.getDistributedPeers(); + + // If the splunkd instance is already connected to + // itself as a peer, delete that reference. + if (peers.containsKey(nameOfPeer())) { + peers.remove(nameOfPeer()); + } + } + + private DistributedPeer connectToSelfAsPeer() { + Args args = new Args(); + args.put("remoteUsername", temporaryUsername); + args.put("remotePassword", temporaryPassword); + DistributedPeer peer = peers.create(nameOfPeer(), args); + return peer; + } + + private String nameOfPeer() { + return command.opts.get("host") + ":" + + String.valueOf(command.opts.get("port")); + } + + @After @Override + public void tearDown() throws Exception { + temporaryUser.remove(); + + String name = nameOfPeer(); + if (peers.containsKey(name)) { + peers.remove(name); + } + Assert.assertFalse(peers.containsKey(name)); + + } + + @Test + public void testCreatePeer() { + DistributedPeer peer = connectToSelfAsPeer(); + Assert.assertTrue(peers.containsKey(peer.getName())); + } + + @Test + public void testDeletePeer() { + DistributedPeer peer = connectToSelfAsPeer(); + String name = peer.getName(); + Assert.assertTrue(peers.containsKey(name)); + + peer.remove(); + + peers.refresh(); + Assert.assertFalse(peers.containsKey(name)); + } + + @Test + public void testPeerHasSaneValues() { + DistributedPeer peer = connectToSelfAsPeer(); + + // Since our only search peer is the splunkd instance + // itself, we can correlate most of the fields. + Assert.assertEquals(nameOfPeer(), peer.getTitle()); + Assert.assertEquals(service.getInfo().getBuild(), peer.getBuild()); + Assert.assertEquals(service.getInfo().getGuid(), peer.getGuid()); + Assert.assertEquals(service.getInfo().getServerName(), peer.getPeerName()); + Assert.assertEquals("configured", peer.getPeerType()); + Assert.assertEquals("Initial", peer.getReplicationStatus()); + Assert.assertEquals("Duplicate Servername", peer.getStatus()); + Assert.assertEquals(service.getInfo().getVersion(), peer.getVersion()); + Assert.assertFalse(peer.isDisabled()); + Assert.assertTrue(peer.isHttps()); + + // Except for these two, which I don't know how to find + // elsewhere in splunkd. + peer.getBundleVersions(); + peer.getLicenseSignature(); + } + + @Test + public void testDisablePeer() { + final DistributedPeer peer = connectToSelfAsPeer(); + + // Make sure the peer is enabled first, so we know that disable + // is actually doing something. + if (peer.isDisabled()) { + peer.enable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + peer.refresh(); + return !peer.isDisabled(); + } + }); + } + + peer.disable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override public boolean predicate() { + peer.refresh(); + return peer.isDisabled(); + } + }); + } + + @Test + public void testEnablePeer() { + final DistributedPeer peer = connectToSelfAsPeer(); + + // First make sure the peer is disabled so we can + // tell if enable is actually doing anything. + if (!peer.isDisabled()) { + peer.disable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + peer.refresh(); + return peer.isDisabled(); + } + }); + } + + // Enable the peer + peer.enable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + peer.refresh(); + return !peer.isDisabled(); + } + }); + } + + @Test + public void testSetFieldsOnPeer() { + // The only fields that can be set on a search peer + // are remoteUsername and remotePassword. Unfortunately + // they cannot be fetched afterwards, so it's impossible + // to test them. + final DistributedPeer peer = connectToSelfAsPeer(); + + String newPassword = createTemporaryName(); + temporaryUser.setPassword(newPassword); + temporaryUser.update(); + + peer.setRemoteUsername(temporaryUsername); + peer.setRemotePassword(newPassword); + peer.update(); + + // The only assertion we can make is that Splunk + // did not return an error. + } +} + + diff --git a/splunk/src/test/java/com/splunk/EntityTest.java b/splunk/src/test/java/com/splunk/EntityTest.java new file mode 100644 index 00000000..4760685f --- /dev/null +++ b/splunk/src/test/java/com/splunk/EntityTest.java @@ -0,0 +1,117 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Map; + +import org.junit.Assert; +import org.junit.Test; + +public class EntityTest extends SDKTestCase { + private static final String QUERY = "search index=_internal | head 10"; + + private static final String KEY = "isSavedSearch"; + private static final String VALUE = "0"; + + @Test + public void testMapOverrides() { + Entity entity = service.getJobs().create(QUERY); + + Assert.assertFalse(entity.isEmpty()); + Assert.assertEquals(VALUE, entity.get(KEY)); + Assert.assertTrue(entity.containsKey(KEY)); + Assert.assertTrue(entity.containsValue(VALUE)); + Assert.assertTrue(entity.keySet().contains(KEY)); + Assert.assertTrue(entity.values().contains(VALUE)); + for (Map.Entry<String, Object> e : entity.entrySet()) { + Assert.assertTrue(entity.containsKey(e.getKey())); + Assert.assertTrue(entity.containsValue(e.getValue())); + } + + try { + entity.put(null, null); + Assert.fail("Expected UnsupportedOperationException."); + } catch (UnsupportedOperationException e) { + // Good + } + + try { + entity.putAll(null); + Assert.fail("Expected UnsupportedOperationException."); + } catch (UnsupportedOperationException e) { + // Good + } + + try { + entity.clear(); + Assert.fail("Expected UnsupportedOperationException."); + } catch (UnsupportedOperationException e) { + // Good + } + + try { + entity.remove(null); + Assert.fail("Expected UnsupportedOperationException."); + } catch (UnsupportedOperationException e) { + // Good + } + } + + @Test + public void testResourceCollection() { + IndexCollection indexes = service.getIndexes(); + + try { + indexes.clear(); + Assert.fail("Should've thrown"); + } + catch (Exception ex) { + Assert.assertTrue(true); + } + + try { + indexes.entrySet(); + Assert.fail("Should've thrown"); + } + catch (Exception ex) { + Assert.assertTrue(true); + } + + try { + indexes.put("hello", null); + Assert.fail("Should've thrown"); + } + catch (Exception ex) { + Assert.assertTrue(true); + } + + try { + indexes.putAll(null); + Assert.fail("Should've thrown"); + } + catch (Exception ex) { + Assert.assertTrue(true); + } + + Index main = indexes.get("main"); + Assert.assertTrue(indexes.containsValue(main)); + Assert.assertTrue(indexes.equals(indexes.items)); + Assert.assertTrue(indexes.hashCode() != 0); + Assert.assertTrue(indexes.keySet().contains("main")); + Assert.assertTrue(indexes.valueSize("main") == 1); + } +} diff --git a/splunk/src/test/java/com/splunk/EventTypesTest.java b/splunk/src/test/java/com/splunk/EventTypesTest.java new file mode 100644 index 00000000..5e98e860 --- /dev/null +++ b/splunk/src/test/java/com/splunk/EventTypesTest.java @@ -0,0 +1,110 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class EventTypesTest extends SDKTestCase { + private String eventTypeName; + private EventType eventType; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + eventTypeName = createTemporaryName(); + + Args args = new Args(); + args.put("search", "index=_internal *"); + args.put("description", "Test event type."); + args.put("disabled", true); + args.put("priority", 2); + eventType = service.getEventTypes().create(eventTypeName, args); + } + + @After + @Override + public void tearDown() throws Exception { + if (service.getEventTypes().containsKey(eventTypeName)) { + eventType.remove(); + } + Assert.assertFalse(service.getEventTypes().containsKey(eventTypeName)); + + super.tearDown(); + } + + @Test + public void testList() { + EntityCollection<EventType> eventTypes = service.getEventTypes(); + Assert.assertFalse("No event types in system.", eventTypes.size() == 0); + + for (EventType eventType : eventTypes.values()) { + eventType.getDescription(); + eventType.getPriority(); + eventType.getSearch(); + Assert.assertNotNull(eventType.getTags()); + } + } + + @Test + public void testInitializedProperly() { + Assert.assertEquals( + "Wrong search in event type", + "index=_internal *", + eventType.getSearch() + ); + Assert.assertEquals( + "Wrong description in event type", + "Test event type.", + eventType.getDescription() + ); + Assert.assertTrue("Event type not created disabled.", eventType.isDisabled()); + Assert.assertEquals( + "Event type created with wrong priority.", + 2, eventType.getPriority() + ); + } + + @Test + public void testSetEventTypeProperties() { + eventType.setDescription("abcd"); + eventType.setDisabled(false); + eventType.setPriority(3); + eventType.setSearch("index=_internal foo"); + eventType.update(); + + Assert.assertEquals("abcd", eventType.getDescription()); + Assert.assertFalse(eventType.isDisabled()); + Assert.assertEquals(3, eventType.getPriority()); + Assert.assertEquals("index=_internal foo", eventType.getSearch()); + } + + @Test + public void testEnableDisable() { + Assert.assertTrue(eventType.isDisabled()); + + eventType.enable(); + Assert.assertFalse(eventType.isDisabled()); + + eventType.disable(); + Assert.assertTrue(eventType.isDisabled()); + } +} diff --git a/splunk/src/test/java/com/splunk/ExportResultsReaderTest.java b/splunk/src/test/java/com/splunk/ExportResultsReaderTest.java new file mode 100644 index 00000000..0c460372 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ExportResultsReaderTest.java @@ -0,0 +1,113 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import com.google.gson.Gson; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; + +import javax.xml.stream.XMLStreamException; +import java.io.IOException; +import java.io.InputStream; +import java.util.*; + +import static junit.framework.TestCase.assertNotNull; + +/** + * Test loading of data from the export endpoints. + * + * All the relevant data is in the data/export/ directory (for raw XML to be parsed) + * and the data/export_test_data.json file (for the expected results of parsing). + */ +@RunWith(Parameterized.class) +public class ExportResultsReaderTest { + private static Gson reader = new Gson(); + private static Map<String, Object> expectedData = reader.fromJson( + SDKTestCase.streamToString( + SDKTestCase.openResource( + "/data/export_test_data.json")), + Map.class + ); + + private String version; + + public ExportResultsReaderTest(String version) { + this.version = version; + } + + @Parameterized.Parameters(name="from version {0}") + public static Collection<Object[]> testCases() { + Collection<Object[]> cases = new ArrayList<Object[]>(); + for (String version : (Set<String>)expectedData.keySet()) { + cases.add(new Object[] {version}); + } + return cases; + } + + @Test + public void testExportWithoutPreview() throws IOException, XMLStreamException { + Map<String, Object> thisVersion = (Map<String, Object>)expectedData.get(this.version); + if (!thisVersion.containsKey("without_preview")) { + return; // No test case + } + Map<String, Object> expectedResultsSet = (Map<String, Object>)thisVersion.get("without_preview"); + List<Map<String, Object>> expectedEvents = (List<Map<String, Object>>)expectedResultsSet.get("results"); + + InputStream xmlStream = new ExportResultsStream( + SDKTestCase.openResource( + "/data/export/" + this.version + "/export_results.xml")); + ResultsReaderXml resultsReader = new ResultsReaderXml(xmlStream); + + ResultsReaderTestFromExpectedFile.verifyResultsReader(resultsReader, expectedEvents); + } + + @Test + public void testExportWithPreview() throws IOException { + Map<String, Object> thisVersion = (Map<String, Object>)expectedData.get(this.version); + if (!thisVersion.containsKey("with_preview")) { + return; // No test case + } + List<Map<String, Object>> expectedResultsSets = (List<Map<String, Object>>)thisVersion.get("with_preview"); + + InputStream xmlStream = SDKTestCase.openResource( + "/data/export/" + this.version + "/export_results.xml"); + // Some kind of results reader here... + + for (Map<String, Object> expectedResultsSet : expectedResultsSets) { + assertNotNull(expectedResultsSet); + // check that this results set matches the corresponding part of the reader + } + } + + @Test + public void testExportNonreporting() throws IOException, XMLStreamException { + // TODO: This test fails on Windows due to XML attributes being out of order + Map<String, Object> thisVersion = (Map<String, Object>)expectedData.get(this.version); + if (!thisVersion.containsKey("nonreporting")) { + return; // No test case + } + Map<String, Object> expectedResultsSet = (Map<String, Object>)thisVersion.get("nonreporting"); + List<Map<String, Object>> expectedEvents = (List<Map<String, Object>>)expectedResultsSet.get("results"); + + InputStream xmlStream = SDKTestCase.openResource( + "/data/export/" + this.version + "/nonreporting.xml"); + ResultsReaderXml resultsReader = new ResultsReaderXml(xmlStream); + + ResultsReaderTestFromExpectedFile.verifyResultsReader(resultsReader, expectedEvents); + } +} diff --git a/splunk/src/test/java/com/splunk/FiredAlertsTest.java b/splunk/src/test/java/com/splunk/FiredAlertsTest.java new file mode 100644 index 00000000..7d4d9dc0 --- /dev/null +++ b/splunk/src/test/java/com/splunk/FiredAlertsTest.java @@ -0,0 +1,132 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class FiredAlertsTest extends SDKTestCase { + private String indexName; + private Index index; + private String savedSearchName; + private SavedSearch savedSearch; + + @Before + public void setUp() throws Exception { + super.setUp(); + + indexName = createTemporaryName(); + Assert.assertFalse(service.getIndexes().containsKey(indexName)); + + index = service.getIndexes().create(indexName); + assertEventuallyTrue(new EventuallyTrueBehavior() { + { pauseTime = 500; tries = 50; } + + @Override + public boolean predicate() { + index.refresh(); + return !index.isDisabled(); + } + }); + + savedSearchName = createTemporaryName(); + + String searchString = "search index=" + indexName; + Args args = new Args(); + args.put("alert_type", "always"); + args.put("alert.severity", "3"); + args.put("alert.suppress", "0"); + args.put("alert.track", "1"); + args.put("dispatch.earliest_time", "-1h"); + args.put("dispatch.latest_time", "now"); + args.put("is_scheduled", "1"); + args.put("cron_schedule", "* * * * *"); + savedSearch = service.getSavedSearches().create( + savedSearchName, searchString, args + ); + } + + @After + @Override + public void tearDown() throws Exception { + if (service.versionIsAtLeast("5.0.0") && System.getenv("TRAVIS") == null) { + index.remove(); + } + + for (Job job : savedSearch.history()) { + job.cancel(); + } + savedSearch.remove(); + + super.tearDown(); + } + + @Test + public void testAlertsShowUp() { + Assert.assertFalse( + "Found alerts before sending any events.", + service.getFiredAlertGroups().containsKey(savedSearchName) + ); + + // Send events + index.submit(createTimestamp() + " Boris the mad baboon runs amok!"); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == 1; + } + }); + + try { + savedSearch.dispatch(); // Force the search to run now. + } catch (InterruptedException e) {} + + final EntityCollection<FiredAlertGroup> firedAlertGroups = + service.getFiredAlertGroups(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + { pauseTime = 2000; tries = 100; } + + @Override + public boolean predicate() { + firedAlertGroups.refresh(); + return firedAlertGroups.containsKey(savedSearchName); + } + }); + + FiredAlertGroup firedAlertGroup = + service.getFiredAlertGroups().get(savedSearchName); + Assert.assertNotNull(firedAlertGroup); + Assert.assertEquals(1, firedAlertGroup.getAlerts().size()); + + for (FiredAlert firedAlert : firedAlertGroup.getAlerts().values()) { + firedAlert.getAction(); + firedAlert.getAlertType(); + firedAlert.getExpirationTime(); + firedAlert.getParsedExpirationTime(); + firedAlert.getSavedSearchName(); + firedAlert.getSeverity(); + firedAlert.getSid(); + firedAlert.getTriggeredAlertCount(); + firedAlert.getTriggerTime(); + firedAlert.getTriggerTimeRendered(); + firedAlert.isDigestMode(); + } + } +} diff --git a/splunk/src/test/java/com/splunk/HttpExceptionTest.java b/splunk/src/test/java/com/splunk/HttpExceptionTest.java new file mode 100644 index 00000000..3d0a4592 --- /dev/null +++ b/splunk/src/test/java/com/splunk/HttpExceptionTest.java @@ -0,0 +1,43 @@ +package com.splunk; + +import org.junit.BeforeClass; +import org.junit.Test; + +import java.io.ByteArrayInputStream; +import java.io.InputStream; + +import static org.junit.Assert.assertEquals; + +public class HttpExceptionTest { + + private static final String responseMessage = "Splunk VERY FATAL error"; + private static final String responseMessageXML = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" + + "<response><messages><msg type=\"FATAL\">" + + responseMessage + + "</msg></messages></response>"; + + private static ResponseMessage xmlResponse; + private static ResponseMessage stringResponse; + + @BeforeClass + public static void setUp() { + InputStream inXml = new ByteArrayInputStream(responseMessageXML.getBytes()); + xmlResponse = new ResponseMessage(503, inXml); + InputStream inString = new ByteArrayInputStream(responseMessage.getBytes()); + stringResponse = new ResponseMessage(503, inString); + } + + @Test + public void testCreateFromXML() { + HttpException e = HttpException.create(xmlResponse); + assertEquals("Couldn't parse XML error details", responseMessage, e.getDetail()); + assertEquals("create() modified response status code", 503, e.getStatus()); + } + + @Test + public void testCreateFromString() { + HttpException e = HttpException.create(stringResponse); + assertEquals("Raw response message was modified", responseMessage, e.getDetail()); + assertEquals("create() modified response status code", 503, e.getStatus()); + } +} diff --git a/splunk/src/test/java/com/splunk/HttpServiceTest.java b/splunk/src/test/java/com/splunk/HttpServiceTest.java new file mode 100644 index 00000000..283f1b99 --- /dev/null +++ b/splunk/src/test/java/com/splunk/HttpServiceTest.java @@ -0,0 +1,242 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +import javax.net.ssl.*; +import java.io.ByteArrayOutputStream; +import java.security.SecureRandom; +import java.security.cert.X509Certificate; +import java.security.NoSuchAlgorithmException; + +public class HttpServiceTest extends SDKTestCase { + private HttpService httpService; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + httpService = new HttpService( + (String)command.opts.get("host"), + (Integer)command.opts.get("port"), + (String)command.opts.get("scheme") + ); + } + + @Test + public void testHttpServiceWithHostIP(){ + HttpService service = new HttpService("127.0.0.1"); + ResponseMessage response = service.get("/"); + Assert.assertEquals(200, response.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(response.getContent())); + } + + @Test + public void testHttpServiceWithHostIPv6(){ + // IPv6 Host without the [] brackets + HttpService service = new HttpService("::1"); + ResponseMessage response = service.get("/"); + Assert.assertEquals(200, response.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(response.getContent())); + + // IPv6 Host with the [] brackets + HttpService newService = new HttpService("[::1]"); + ResponseMessage resp = newService.get("/"); + Assert.assertEquals(200, resp.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(resp.getContent())); + } + + @Test + public void testGet() { + ResponseMessage response = httpService.get("/"); + Assert.assertEquals(200, response.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(response.getContent())); + } + + @Test + public void testSend() { + RequestMessage request = new RequestMessage("GET"); + ResponseMessage response = service.send("/services", request); + Assert.assertEquals(200, response.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(response.getContent())); + } + + @Test + public void testRequestMessage() { + RequestMessage request = new RequestMessage("GET"); + Assert.assertTrue(request.checkMethod(request.getMethod())); + request.setMethod("POST"); + Assert.assertTrue(request.checkMethod(request.getMethod())); + Assert.assertEquals(request.getMethod(), "POST"); + + ByteArrayOutputStream stream = new ByteArrayOutputStream(); + try { + stream.write("HELLO".getBytes("UTF-8")); + } catch (Exception e) { + Assert.fail("Exception!"); + } + + Assert.assertNull(request.getContent()); + request.setContent(stream); + Assert.assertNotNull(request.getContent()); + } + + @Test + public void testResponseMessage() { + ResponseMessage response = new ResponseMessage(200); + Assert.assertEquals(response.getStatus(), 200); + Assert.assertTrue(response.getHeader() != null); + } + + @Test(expected = IllegalArgumentException.class) + public void testSSLSocketFactorySetNull(){ + HttpService.setSSLSocketFactory(null); + } + + + + @Test + public void testSSLSocketFactory() { + try { + SSLSocketFactory factory = Service.getSSLSocketFactory(); + SSLSocket socket = (SSLSocket) factory.createSocket((String)command.opts.get("host"), 8089); + String[] protocols = socket.getEnabledProtocols(); + Assert.assertTrue(protocols.length > 0); + } + catch (Exception e) { + Assert.assertNull(e); + } + } + + public void validateSSLSocketFactory(SSLSocketFactory factory) { + // Backup the old value + SSLSocketFactory old = Service.getSSLSocketFactory(); + + Service.setSSLSocketFactory(factory); + Service s = new Service(service.getHost()); + s.login(service.getUsername(), service.getPassword()); + Assert.assertEquals(service.getUsername(), s.getUsername()); + Assert.assertEquals(service.getPassword(), s.getPassword()); + Assert.assertEquals(service.getInfo().keySet(), s.getInfo().keySet()); + Assert.assertEquals(service.getInfo().getVersion(), s.getInfo().getVersion()); + + // Restore the old value + Service.setSSLSocketFactory(old); + } + + @Test + public void testCustomSSLSocketFactories() { + try { + SSLContext sslContext = SSLContext.getInstance("TLS"); + TrustManager[] byPassTrustManagers = new TrustManager[] { + new X509TrustManager() { + public X509Certificate[] getAcceptedIssuers() { + return new X509Certificate[0]; + } + public void checkClientTrusted(X509Certificate[] chain, String authType) {} + public void checkServerTrusted(X509Certificate[] chain, String authType) {} + } + }; + sslContext.init(null, byPassTrustManagers, new SecureRandom()); + SSLSocketFactory TLSOnlySSLFactory = sslContext.getSocketFactory(); + Service.setSSLSocketFactory(TLSOnlySSLFactory); + + validateSSLSocketFactory(TLSOnlySSLFactory); + } + catch (Exception e) { + Assert.assertNull(e); + } + + try { + SSLContext sslContext = SSLContext.getInstance("SSL"); + TrustManager[] byPassTrustManagers = new TrustManager[] { + new X509TrustManager() { + public X509Certificate[] getAcceptedIssuers() { + return new X509Certificate[0]; + } + public void checkClientTrusted(X509Certificate[] chain, String authType) {} + public void checkServerTrusted(X509Certificate[] chain, String authType) {} + } + }; + sslContext.init(null, byPassTrustManagers, new SecureRandom()); + SSLSocketFactory SSLOnlySSLFactory = sslContext.getSocketFactory(); + Service.setSSLSocketFactory(SSLOnlySSLFactory); + + validateSSLSocketFactory(SSLOnlySSLFactory); + } + catch (Exception e) { + // Swallow exceptions for Java 8, since we know SSLv3 is disabled + // by default + if (getJavaVersion() < 8) { + Assert.assertNull(e); + } + } + } + + public void validateSSLProtocol(Service s, SSLSecurityProtocol securityProtocol) { + // Backup the old value + SSLSecurityProtocol old = Service.getSslSecurityProtocol(); + + Service.setSslSecurityProtocol(securityProtocol); + + s.login(service.getUsername(), service.getPassword()); + Assert.assertEquals(service.getUsername(), s.getUsername()); + Assert.assertEquals(service.getPassword(), s.getPassword()); + Assert.assertEquals(service.getInfo().keySet(), s.getInfo().keySet()); + Assert.assertEquals(service.getInfo().getVersion(), s.getInfo().getVersion()); + + // Restore the value + Service.setSslSecurityProtocol(old); + } + + @Test + public void testSSLSecurityProtocols() { + Service s = new Service(service.getHost()); + + Integer javaVersion = getJavaVersion(); + Assert.assertNotNull(javaVersion); + + // TLSv1.1 and TLSv1.2 were added in Java 7 + if (javaVersion >= 7) { + String[] supportedProtos = new String[0]; + try { + supportedProtos = SSLContext.getDefault().getSupportedSSLParameters().getProtocols(); + } catch (NoSuchAlgorithmException e) { + } + + for (String proto : supportedProtos) { + if (proto.equals(SSLSecurityProtocol.TLSv1_2.toString())) { + validateSSLProtocol(s, SSLSecurityProtocol.TLSv1_2); + } else if (proto.equals(SSLSecurityProtocol.TLSv1_1.toString())) { + validateSSLProtocol(s, SSLSecurityProtocol.TLSv1_1); + } + } + } + + // TLSv1 is supported in Java 6-8, always check + validateSSLProtocol(s, SSLSecurityProtocol.TLSv1); + + // SSLv3 is disabled by default in Java 8 + if (javaVersion < 8) { + validateSSLProtocol(s, SSLSecurityProtocol.SSLv3); + } + } +} diff --git a/splunk/src/test/java/com/splunk/IndexTest.java b/splunk/src/test/java/com/splunk/IndexTest.java new file mode 100644 index 00000000..56d6670a --- /dev/null +++ b/splunk/src/test/java/com/splunk/IndexTest.java @@ -0,0 +1,876 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import junit.framework.AssertionFailedError; + +import org.junit.*; + +import java.io.*; +import java.net.Socket; +import java.util.HashMap; +import java.util.Map; + +public class IndexTest extends SDKTestCase { + private String indexName; + private Index index; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + indexName = createTemporaryName(); + index = service.getIndexes().create(indexName); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return service.getIndexes().containsKey(indexName); + } + }); + } + + @After + @Override + public void tearDown() throws Exception { + if (service.versionIsAtLeast("5.0.0")) { + if (service.getIndexes().containsKey(indexName) && System.getenv("TRAVIS") == null) { + try { + index.remove(); + } catch(HttpException he) { + if (he.getStatus() == 400) { + uncheckedSplunkRestart(); + index.remove(); + } else { + throw he; + } + } + } + } else { + // Can't delete indexes via the REST API. Just let them build up. + } + + // At least in CI the test exists with a required restart + uncheckedSplunkRestart(); + + super.tearDown(); + } + + @Test + public void testAttachWithCookieHeader() throws IOException { + Assume.assumeTrue(System.getenv("TRAVIS") == null); + if (service.versionIsEarlierThan("6.2")) { + // Cookies not implemented before version 6.2 + return; + } + // Check that their are Splunk Auth cookies at all + Assert.assertTrue(service.hasSplunkAuthCookies()); + + // Make a service that only has that cookie + String validCookie = service.stringifyCookies(); + Args args = new Args(); + args.put("cookie", validCookie); + final Service s = new Service(args); + + // Get the index with our service that only has a cookie + Index localIndex = s.getIndexes().get(indexName); + final int oldResultCountOfIndex = getResultCountOfIndex(s); + final int oldIndexTotalEventCount = index.getTotalEventCount(); + + Assert.assertEquals(0, oldResultCountOfIndex); + Assert.assertEquals(0, oldIndexTotalEventCount); + + Socket socket = localIndex.attach(); + + OutputStream ostream = socket.getOutputStream(); + Writer out = new OutputStreamWriter(ostream, "UTF-8"); + out.write(createTimestamp() + " Hello world!\u0150\r\n"); + out.write(createTimestamp() + " Goodbye world!\u0150\r\n"); + + out.flush(); + socket.close(); + + localIndex.refresh(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 60; } + + @Override + public boolean predicate() { + index.refresh(); + return getResultCountOfIndex(s) == oldResultCountOfIndex + 2; + } + }); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return tec == oldIndexTotalEventCount + 1; + } + }); + + + } + + @Test + public void testDeletion() { + if (service.versionIsEarlierThan("5.0.0")) { + // Can't delete indexes via the REST API. + return; + } + + Assert.assertTrue(service.getIndexes().containsKey(indexName)); + + try { + index.remove(); + } catch(HttpException he) { + if (he.getStatus() == 400) { + uncheckedSplunkRestart(); + index.remove(); + } else { + throw he; + } + } + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return !service.getIndexes().containsKey(indexName); + } + }); + } + + @Test + public void testDeletionFromCollection() { + if (service.versionIsEarlierThan("5.0.0")) { + // Can't delete indexes via the REST API. + return; + } + + Assert.assertTrue(service.getIndexes().containsKey(indexName)); + + try { + service.getIndexes().remove(indexName); + } catch(HttpException he) { + if (he.getStatus() == 400) { + uncheckedSplunkRestart(); + service.getIndexes().remove(indexName); + } else { + throw he; + } + } + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return !service.getIndexes().containsKey(indexName); + } + }); + } + + @Test + public void testAttachWith() throws IOException { + final int originalEventCount = index.getTotalEventCount(); + + index.attachWith(new ReceiverBehavior() { + public void run(OutputStream stream) throws IOException { + String s = createTimestamp() + " Boris the mad baboon!\r\n"; + stream.write(s.getBytes("UTF-8")); + } + }); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 60; } + + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == originalEventCount + 1; + } + }); + } + + @Test + @SuppressWarnings("deprecation") + public void testIndexGettersThrowNoErrors() { + index.getAssureUTF8(); + index.getBloomfilterTotalSizeKB(); + index.getColdPath(); + index.getColdPathExpanded(); + index.getColdToFrozenDir(); + index.getColdToFrozenScript(); + index.getCompressRawdata(); + index.getCurrentDBSizeMB(); + index.getDefaultDatabase(); + index.getEnableRealtimeSearch(); + index.getFrozenTimePeriodInSecs(); + index.getHomePath(); + index.getHomePathExpanded(); + index.getIndexThreads(); + index.getLastInitTime(); + index.getMaxBloomBackfillBucketAge(); + index.getMaxConcurrentOptimizes(); + index.getMaxDataSize(); + index.getMaxHotBuckets(); + index.getMaxHotIdleSecs(); + index.getMaxHotSpanSecs(); + index.getMaxMemMB(); + index.getMaxMetaEntries(); + index.getMaxRunningProcessGroups(); + index.getMaxTime(); + index.getMaxTotalDataSizeMB(); + index.getMaxWarmDBCount(); + index.getMemPoolMB(); + index.getMinRawFileSyncSecs(); + index.getMinTime(); + index.getNumBloomfilters(); + index.getNumHotBuckets(); + index.getNumWarmBuckets(); + index.getPartialServiceMetaPeriod(); + index.getQuarantineFutureSecs(); + index.getQuarantinePastSecs(); + index.getRawChunkSizeBytes(); + index.getRotatePeriodInSecs(); + index.getServiceMetaPeriod(); + index.getSuppressBannerList(); + index.getSync(); + index.getSyncMeta(); + index.getThawedPath(); + index.getThawedPathExpanded(); + index.getThrottleCheckPeriod(); + index.getTotalEventCount(); + index.isDisabled(); + index.isInternal(); + + // Fields only available from 5.0 on. + if (service.versionIsAtLeast("5.0.0")) { + index.getBucketRebuildMemoryHint(); + index.getMaxTimeUnreplicatedNoAcks(); + index.getMaxTimeUnreplicatedWithAcks(); + } + } + + @Test + public void testSetters() { + int newFrozenTimePeriodInSecs = index.getFrozenTimePeriodInSecs()+1; + index.setFrozenTimePeriodInSecs(newFrozenTimePeriodInSecs); + int newMaxConcurrentOptimizes = index.getMaxConcurrentOptimizes()+1; + index.setMaxConcurrentOptimizes(newMaxConcurrentOptimizes); + String newMaxDataSize = "auto"; + index.setMaxDataSize(newMaxDataSize); + String newMaxHotBuckets = null; + if (service.versionIsEarlierThan("8.1.0")) { + int newMaxHotBucketsInt = Integer.parseInt(index.getMaxHotBuckets())+1; + newMaxHotBuckets = String.valueOf(newMaxHotBucketsInt); + } else { + newMaxHotBuckets = "auto"; + } + index.setMaxHotBuckets(newMaxHotBuckets); + int newMaxHotIdleSecs = index.getMaxHotIdleSecs()+1; + index.setMaxHotIdleSecs(newMaxHotIdleSecs); + int newMaxMemMB = index.getMaxMemMB()+1; + index.setMaxMemMB(newMaxMemMB); + int newMaxMetaEntries = index.getMaxMetaEntries()+1; + index.setMaxMetaEntries(newMaxMetaEntries); + int newMaxTotalDataSizeMB = index.getMaxTotalDataSizeMB()+1; + index.setMaxTotalDataSizeMB(newMaxTotalDataSizeMB); + int newMaxWarmDBCount = index.getMaxWarmDBCount()+1; + index.setMaxWarmDBCount(newMaxWarmDBCount); + String newMinRawFileSyncSecs = "disable"; + index.setMinRawFileSyncSecs(newMinRawFileSyncSecs); + int newPartialServiceMetaPeriod = index.getPartialServiceMetaPeriod()+1; + index.setPartialServiceMetaPeriod(newPartialServiceMetaPeriod); + int newQuarantineFutureSecs = index.getQuarantineFutureSecs()+1; + index.setQuarantineFutureSecs(newQuarantineFutureSecs); + int newQuarantinePastSecs = index.getQuarantinePastSecs()+1; + index.setQuarantinePastSecs(newQuarantinePastSecs); + int newRawChunkSizeBytes = index.getRawChunkSizeBytes()+1; + index.setRawChunkSizeBytes(newRawChunkSizeBytes); + int newRotatePeriodInSecs = index.getRotatePeriodInSecs()+1; + index.setRotatePeriodInSecs(newRotatePeriodInSecs); + int newServiceMetaPeriod = index.getServiceMetaPeriod()+1; + index.setServiceMetaPeriod(newServiceMetaPeriod); + boolean newSyncMeta = !index.getSyncMeta(); + index.setSyncMeta(newSyncMeta); + int newThrottleCheckPeriod = index.getThrottleCheckPeriod()+1; + index.setThrottleCheckPeriod(newThrottleCheckPeriod); + String coldToFrozenDir = index.getColdToFrozenDir(); + if (service.getInfo().getOsName().equals("Windows")) { + index.setColdToFrozenDir("C:\\frozenDir\\" + index.getName()); + } else { + index.setColdToFrozenDir("/tmp/foobar" + index.getName()); + } + + boolean newEnableOnlineBucketRepair = false; + String newMaxBloomBackfillBucketAge = null; + if (service.versionIsAtLeast("4.3")) { + newEnableOnlineBucketRepair = !index.getEnableOnlineBucketRepair(); + index.setEnableOnlineBucketRepair(newEnableOnlineBucketRepair); + newMaxBloomBackfillBucketAge = "20d"; + index.setMaxBloomBackfillBucketAge(newMaxBloomBackfillBucketAge); + } + + String newBucketRebuildMemoryHint = null; + int newMaxTimeUnreplicatedNoAcks = -1; + int newMaxTimeUnreplicatedWithAcks = -1; + if (service.versionIsAtLeast("5.0")) { + newBucketRebuildMemoryHint = "auto"; + index.setBucketRebuildMemoryHint(newBucketRebuildMemoryHint); + newMaxTimeUnreplicatedNoAcks = 300; + index.setMaxTimeUnreplicatedNoAcks(newMaxTimeUnreplicatedNoAcks); + newMaxTimeUnreplicatedWithAcks = 60; + index.setMaxTimeUnreplicatedWithAcks(newMaxTimeUnreplicatedWithAcks); + } + + index.update(); + index.refresh(); + + Assert.assertEquals(newFrozenTimePeriodInSecs, index.getFrozenTimePeriodInSecs()); + Assert.assertEquals(newMaxConcurrentOptimizes, index.getMaxConcurrentOptimizes()); + Assert.assertEquals(newMaxDataSize, index.getMaxDataSize()); + Assert.assertEquals(newMaxHotBuckets, index.getMaxHotBuckets()); + Assert.assertEquals(newMaxHotIdleSecs, index.getMaxHotIdleSecs()); + Assert.assertEquals(newMaxMemMB, index.getMaxMemMB()); + Assert.assertEquals(newMaxMetaEntries, index.getMaxMetaEntries()); + Assert.assertEquals(newMaxTotalDataSizeMB, index.getMaxTotalDataSizeMB()); + Assert.assertEquals(newMaxWarmDBCount, index.getMaxWarmDBCount()); + Assert.assertEquals(newMinRawFileSyncSecs, index.getMinRawFileSyncSecs()); + Assert.assertEquals(newPartialServiceMetaPeriod, index.getPartialServiceMetaPeriod()); + Assert.assertEquals(newQuarantineFutureSecs, index.getQuarantineFutureSecs()); + Assert.assertEquals(newQuarantinePastSecs, index.getQuarantinePastSecs()); + Assert.assertEquals(newRawChunkSizeBytes, index.getRawChunkSizeBytes()); + Assert.assertEquals(newRotatePeriodInSecs, index.getRotatePeriodInSecs()); + Assert.assertEquals(newServiceMetaPeriod, index.getServiceMetaPeriod()); + Assert.assertEquals(newSyncMeta, index.getSyncMeta()); + Assert.assertEquals(newThrottleCheckPeriod, index.getThrottleCheckPeriod()); + if (service.getInfo().getOsName().equals("Windows")) { + Assert.assertEquals("C:\\frozenDir\\" + index.getName(), index.getColdToFrozenDir()); + } else { + Assert.assertEquals("/tmp/foobar" + index.getName(), index.getColdToFrozenDir()); + } + if (service.versionIsAtLeast("4.3")) { + Assert.assertEquals( + newEnableOnlineBucketRepair, + index.getEnableOnlineBucketRepair() + ); + Assert.assertEquals( + newMaxBloomBackfillBucketAge, + index.getMaxBloomBackfillBucketAge() + ); + } + if (service.versionIsAtLeast("5.0")) { + Assert.assertEquals( + newBucketRebuildMemoryHint, + index.getBucketRebuildMemoryHint() + ); + Assert.assertEquals( + newMaxTimeUnreplicatedNoAcks, + index.getMaxTimeUnreplicatedNoAcks() + ); + Assert.assertEquals( + newMaxTimeUnreplicatedWithAcks, + index.getMaxTimeUnreplicatedWithAcks() + ); + } + + index.setColdToFrozenDir(coldToFrozenDir == null ? "" : coldToFrozenDir); + index.update(); + + String coldToFrozenScript = index.getColdToFrozenScript(); + index.setColdToFrozenScript("/bin/sh"); + index.update(); + Assert.assertEquals("/bin/sh", index.getColdToFrozenScript()); + index.setColdToFrozenScript(coldToFrozenScript == null ? "" : coldToFrozenScript); + index.update(); + //index.setColdToFrozenScript(coldToFrozenScript); + + if (restartRequired()) { + splunkRestart(); + } + } + + @Test + public void testEnable() { + Assert.assertFalse(index.isDisabled()); + + // Force the index to be disabled + index.disable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override public boolean predicate() { + index.refresh(); + return index.isDisabled(); + } + }); + + // Disabling an index before Splunk 6 puts Splunk into a weird state that actually + // requires a restart to get out of. + if (service.versionIsEarlierThan("6.0.0")) { + splunkRestart(); + } + + // And then enable it + index.enable(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override public boolean predicate() { + index.refresh(); + return !index.isDisabled(); + } + }); + } + + @Test + public void testSubmitOne() throws Exception { + try { + tryTestSubmitOne(); + } catch (AssertionFailedError e) { + if (e.getMessage().contains("Test timed out before true.") && + restartRequired()) { + System.out.println( + "WARNING: Splunk indicated restart required while " + + "running a test. Trying to recover..."); + splunkRestart(); + + tryTestSubmitOne(); + } else { + throw e; + } + } + } + + private void tryTestSubmitOne() { + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + index.submit(createTimestamp() + " This is a test of the emergency broadcasting system."); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 1; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == 1; + } + }); + } + + @Test + public void testSubmitOneWithNamespacedService() { + Map<String, Object> opts = new HashMap<String, Object>(command.opts); + opts.put("app", "search"); + final Service service = Service.connect(opts); + Assert.assertNotNull(service); + + final String indexName = createTemporaryName(); + final Index index = service.getIndexes().create(indexName); + + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + index.submit(createTimestamp() + " This is a test of the emergency broadcasting system."); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + + @Override + public boolean predicate() { + return getResultCountOfIndex(service, indexName) == 1; + } + }); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == 1; + } + }); + try { + index.remove(); + } catch (Exception e) { + System.out.println( + "WARNING: index " + indexName + " cannot be deleted." + + " Error: " + e.toString()); + } + } + + + @Test + public void testSubmitOneArgs() throws Exception { + try { + tryTestSubmitOneArgs(); + } catch (AssertionFailedError e) { + if (e.getMessage().contains("Test timed out before true.") && + restartRequired()) { + System.out.println( + "WARNING: Splunk indicated restart required while " + + "running a test. Trying to recover..."); + splunkRestart(); + + tryTestSubmitOne(); + } else { + throw e; + } + } + } + + private void tryTestSubmitOneArgs() { + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + Args args = Args.create("sourcetype", "mysourcetype"); + index.submit(args, createTimestamp() + " This is a test of the emergency broadcasting system."); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 1; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == 1; + } + }); + } + + @Test + public void testSubmitOneInEachCall() { + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + index.submit(createTimestamp() + " Hello world!\u0150"); + index.submit(createTimestamp() + " Goodbye world!\u0150"); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 2; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 2); + } + }); + } + + @Test + public void testSubmitMultipleInOneCall() { + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + index.submit( + createTimestamp() + " Hello world!\u0150" + "\r\n" + + createTimestamp() + " Goodbye world!\u0150"); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 2; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 2); + } + }); + } + + @Test + public void testAttach() throws IOException { + + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + Socket socket = index.attach(); + OutputStream ostream = socket.getOutputStream(); + Writer out = new OutputStreamWriter(ostream, "UTF-8"); + out.write(createTimestamp() + " Hello world!\u0150\r\n"); + out.write(createTimestamp() + " Goodbye world!\u0150\r\n"); + + out.flush(); + socket.close(); + + index.refresh(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 60; } + + @Override + public boolean predicate() { + index.refresh(); + return getResultCountOfIndex(service) == 2; + } + }); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 2); + } + }); + } + + @Test + public void testAttachArgs() throws IOException { + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + Args args = Args.create("sourcetype", "mysourcetype"); + Socket socket = index.attach(args); + OutputStream ostream = socket.getOutputStream(); + Writer out = new OutputStreamWriter(ostream, "UTF-8"); + out.write(createTimestamp() + " Hello world!\u0150\r\n"); + out.write(createTimestamp() + " Goodbye world!\u0150\r\n"); + out.write(createTimestamp() + " Goodbye world again!\u0150\r\n"); + + out.flush(); + socket.close(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 60; } + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 3; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 60; } + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 3); + } + }); + } + + @Test + public void testUploadArgs() throws Exception { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + + installApplicationFromTestData("file_to_upload"); + + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + String fileToUpload = joinServerPath(new String[] { + service.getSettings().getSplunkHome(), + "etc", "apps", "file_to_upload", "log.txt"}); + + Args args = new Args(); + args.add("sourcetype", "log"); + args.add("host", "IndexTest"); + args.add("rename-source", "IndexTestSrc"); + + index.upload(fileToUpload, args); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + Service con = index.getService(); + Job search = con.search("search index=" + index.getTitle() + " sourcetype=log host=IndexTest source=IndexTestSrc"); + return getResultCountOfIndex(service) == 4 && search.getEventCount() == 4; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 4); + } + }); + } + + @Test + public void testUploadArgsFailure() throws Exception{ + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("file_to_upload"); + + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + String fileToUpload = joinServerPath(new String[] { + service.getSettings().getSplunkHome(), + "etc", "apps", "file_to_upload", "log.txt"}); + + Args args = new Args(); + args.add("sourcetype", "log"); + args.add("host", "IndexTest"); + args.add("index", index.getTitle()); + args.add("rename-source", "IndexTestSrc"); + // The index argument cannot be passed into the upload function. + try{ + index.upload(fileToUpload, args); + Assert.fail("Uploading to an index with an index argument? No need for redundancy!"); + } + catch(Exception e){ + Assert.assertEquals(e.getMessage(), "The 'index' parameter cannot be passed to an index's oneshot upload."); + } + + } + + @Test + public void testUpload() throws Exception { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + + installApplicationFromTestData("file_to_upload"); + + Assert.assertTrue(getResultCountOfIndex(service) == 0); + Assert.assertTrue(index.getTotalEventCount() == 0); + + String fileToUpload = joinServerPath(new String[] { + service.getSettings().getSplunkHome(), + "etc", "apps", "file_to_upload", "log.txt"}); + index.upload(fileToUpload); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return getResultCountOfIndex(service) == 4; + } + }); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + + // Some versions of Splunk only increase event count by 1. + // Event count should never go up by more than the result count. + int tec = index.getTotalEventCount(); + return (1 <= tec) && (tec <= 4); + } + }); + } + + // @Test + // public void testSubmitAndClean() throws InterruptedException { + // try { + // tryTestSubmitAndClean(); + // } catch (SplunkException e) { + // if (e.getCode() == SplunkException.TIMEOUT) { + // // Due to flakiness of the underlying implementation, + // // this index clean method doesn't always work on a "dirty" + // // Splunk instance. Try again on a "clean" instance. + // System.out.println( + // "WARNING: Index clean timed out. Trying again on a " + + // "freshly restarted Splunk instance..."); + // uncheckedSplunkRestart(); + + // tryTestSubmitAndClean(); + // } else { + // throw e; + // } + // } + // } + + // private void tryTestSubmitAndClean() throws InterruptedException { + // Assert.assertTrue(getResultCountOfIndex(service) == 0); + + // // Make sure the index is not empty. + // index.submit("Hello world"); + // assertEventuallyTrue(new EventuallyTrueBehavior() { + // { + // tries = 50; + // } + + // @Override + // public boolean predicate() { + // return getResultCountOfIndex(service) == 1; + // } + // }); + + // // Clean the index and make sure it's empty. + // // NOTE: Average time for this is 65s (!!!). Have seen 110+. + // index.clean(150); + // Assert.assertTrue(getResultCountOfIndex(service) == 0); + // } + + @Test + public void testUpdateNameShouldFail() { + try { + index.update(new Args("name", createTemporaryName())); + Assert.fail("Expected IllegalStateException."); + } + catch (IllegalStateException e) { + // Good + } + } + + // === Utility === + + private int getResultCountOfIndex(Service s) { + return getResultCountOfIndex(s, indexName); + } + + private int getResultCountOfIndex(Service s, String indexName) { + InputStream results = s.oneshotSearch("search index=" + indexName); + try { + ResultsReaderXml resultsReader = new ResultsReaderXml(results); + + int numEvents = 0; + while (resultsReader.getNextEvent() != null) { + numEvents++; + } + return numEvents; + } catch (IOException e) { + throw new RuntimeException(e); + } + } +} + diff --git a/splunk/src/test/java/com/splunk/InputCrudTest.java b/splunk/src/test/java/com/splunk/InputCrudTest.java new file mode 100644 index 00000000..d0d3a1f7 --- /dev/null +++ b/splunk/src/test/java/com/splunk/InputCrudTest.java @@ -0,0 +1,676 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + + +import org.junit.Assert; +import org.junit.Ignore; +import org.junit.Test; + +import java.util.HashMap; + +public class InputCrudTest extends InputTest { + @Test + public void testGetters() { + Assert.assertFalse("No default inputs to test.", inputs.isEmpty()); + + Input splunkInput = inputs.create(findNextUnusedPort(12911) +"", InputKind.TcpSplunk); + inputs.refresh(); + + // Test getters on all default inputs + for (Input input : inputs.values()) { + input.getName(); + input.getTitle(); + input.getPath(); + input.getKind(); + testSpecializedGetters(input); + } + + splunkInput.remove(); + } + + @SuppressWarnings("deprecation") + private void testSpecializedGetters(Input input) { + InputKind inputKind = input.getKind(); + TcpConnections tcpConnections = null; + UdpConnections udpConnections = null; + + if (inputKind == InputKind.Monitor) { + MonitorInput monitorInput = (MonitorInput) input; + monitorInput.getBlacklist(); + monitorInput.getCrcSalt(); + monitorInput.getFileCount(); + monitorInput.getFollowTail(); + monitorInput.getHost(); + monitorInput.getHostRegex(); + monitorInput.getIgnoreOlderThan(); + monitorInput.getIndex(); + monitorInput.getQueue(); + monitorInput.getRcvBuf(); + monitorInput.getRecursive(); + monitorInput.getSource(); + monitorInput.getSourceType(); + monitorInput.getTimeBeforeClose(); + monitorInput.getWhitelist(); + } else if (inputKind == InputKind.Script) { + ScriptInput scriptInput = (ScriptInput) input; + scriptInput.getEndTime(); + scriptInput.getGroup(); + scriptInput.getHost(); + scriptInput.getIndex(); + scriptInput.getInterval(); + scriptInput.getRcvBuf(); + scriptInput.getStartTime(); + } else if (inputKind == InputKind.Tcp) { + TcpInput tcpInput = (TcpInput) input; + tcpInput.getConnectionHost(); + tcpInput.getGroup(); + tcpInput.getHost(); + tcpInput.getIndex(); + tcpInput.getQueue(); + tcpInput.getRcvBuf(); + tcpInput.getRestrictToHost(); + tcpInput.getSource(); + tcpInput.getSourceType(); + tcpInput.getSSL(); + tcpConnections = tcpInput.connections(); + tcpConnections.getConnection(); + tcpConnections.getServername(); + } else if (inputKind == InputKind.TcpSplunk) { + TcpSplunkInput tcpSplunkInput = (TcpSplunkInput) input; + tcpSplunkInput.getConnectionHost(); + tcpSplunkInput.getGroup(); + tcpSplunkInput.getHost(); + tcpSplunkInput.getIndex(); + tcpSplunkInput.getQueue(); + tcpSplunkInput.getRcvBuf(); + tcpSplunkInput.getSource(); + tcpSplunkInput.getSourceType(); + tcpSplunkInput.getSSL(); + tcpConnections = tcpSplunkInput.connections(); + tcpConnections.getConnection(); + tcpConnections.getServername(); + } else if (inputKind == InputKind.Udp) { + UdpInput udpInput = (UdpInput) input; + udpInput.getConnectionHost(); + udpInput.getGroup(); + udpInput.getHost(); + udpInput.getIndex(); + udpInput.getQueue(); + udpInput.getRcvBuf(); + udpInput.getSource(); + udpInput.getSourceType(); + udpInput.getNoAppendingTimeStamp(); + udpInput.getNoPriorityStripping(); + udpConnections = udpInput.connections(); + udpConnections.getGroup(); + } else if (inputKind == InputKind.WindowsActiveDirectory) { + WindowsActiveDirectoryInput windowsActiveDirectoryInput = + (WindowsActiveDirectoryInput) input; + windowsActiveDirectoryInput.getIndex(); + windowsActiveDirectoryInput.getMonitorSubtree(); + windowsActiveDirectoryInput.getStartingNode(); + windowsActiveDirectoryInput.getTargetDc(); + } else if (inputKind == InputKind.WindowsEventLog) { + WindowsEventLogInput windowsEventLogInput = + (WindowsEventLogInput) input; + windowsEventLogInput.getHosts(); + windowsEventLogInput.getIndex(); + windowsEventLogInput.getLocalName(); + windowsEventLogInput.getLogs(); + windowsEventLogInput.getLookupHost(); + } else if (inputKind == InputKind.WindowsPerfmon) { + WindowsPerfmonInput windowsPerfmonInput = + (WindowsPerfmonInput) input; + windowsPerfmonInput.getCounters(); + windowsPerfmonInput.getIndex(); + windowsPerfmonInput.getInstances(); + windowsPerfmonInput.getInterval(); + windowsPerfmonInput.getObject(); + } else if (inputKind == InputKind.WindowsRegistry) { + WindowsRegistryInput windowsRegistryInput = + (WindowsRegistryInput) input; + windowsRegistryInput.getBaseline(); + windowsRegistryInput.getHive(); + windowsRegistryInput.getIndex(); + windowsRegistryInput.getMonitorSubnodes(); + windowsRegistryInput.getProc(); + windowsRegistryInput.getType(); + } else if (inputKind == InputKind.WindowsWmi) { + WindowsWmiInput windowsWmiInput = (WindowsWmiInput) input; + windowsWmiInput.getClasses(); + windowsWmiInput.getFields(); + windowsWmiInput.getIndex(); + windowsWmiInput.getInstances(); + windowsWmiInput.getInterval(); + windowsWmiInput.getLocalName(); + windowsWmiInput.getLookupHost(); + windowsWmiInput.getServers(); + windowsWmiInput.getWql(); + } + } + + @Test + public void testMonitorInputCrud() { + final String filename; + if (System.getenv("SPLUNK_HOME") != null) { + filename = System.getenv("SPLUNK_HOME") + "/copyright.txt"; + } else { + filename = locateSystemLog(); + } + + // Create variants + try { + inputs.create(filename); + Assert.fail("Expected UnsupportedOperationException"); + } catch (UnsupportedOperationException e) { + // Good + } + try { + inputs.create(filename, new HashMap<String, Object>()); + Assert.fail("Expected UnsupportedOperationException"); + } catch (UnsupportedOperationException e) { + // Good + } + + // Create + if (inputs.containsKey(filename)) { + inputs.remove(filename); + } + inputs.create(filename, InputKind.Monitor); + Assert.assertTrue(inputs.containsKey(filename)); + MonitorInput monitorInput = (MonitorInput)inputs.get(filename); + + // Get variant + Args namespace = new Args(); + namespace.put("owner", monitorInput.getMetadata().getOwner()); + namespace.put("app", monitorInput.getMetadata().getApp()); + inputs.get(filename, namespace); // throws no exception + + // Probe + { + monitorInput.setBlacklist("phonyregex*1"); + monitorInput.setCheckIndex(true); + monitorInput.setCheckPath(true); + if (service.versionCompare("4.2.1") >= 0) { + monitorInput.setCrcSalt("ThisIsSalt"); + monitorInput.setIgnoreOlderThan("1d"); + monitorInput.setTimeBeforeClose(120); + } + monitorInput.setFollowTail(false); + monitorInput.setHost("three.four.com"); + monitorInput.setHostRegex("host*regex*"); + monitorInput.setHostSegment(""); + monitorInput.setIndex("main"); + monitorInput.setRecursive(false); + monitorInput.setRenameSource("renamedSource"); + monitorInput.setSourcetype("monitor"); + monitorInput.setWhitelist("phonyregex*2"); + monitorInput.update(); + + // NOTE: Some attributes are write only. Check what we can. + Assert.assertEquals("phonyregex*1", monitorInput.getBlacklist()); + Assert.assertFalse(monitorInput.getFollowTail()); + Assert.assertEquals("three.four.com", monitorInput.getHost()); + Assert.assertEquals("host*regex*", monitorInput.getHostRegex()); + if (service.versionCompare("4.2.1") >= 0) { + Assert.assertEquals("1d", monitorInput.getIgnoreOlderThan()); + Assert.assertEquals(120, monitorInput.getTimeBeforeClose()); + } + Assert.assertEquals("main", monitorInput.getIndex()); + Assert.assertFalse(monitorInput.getRecursive()); + Assert.assertEquals("renamedSource", monitorInput.getSource()); + Assert.assertEquals("monitor", monitorInput.getSourceType()); + Assert.assertEquals("phonyregex*2", monitorInput.getWhitelist()); + } + + // Remove + monitorInput.remove(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return !inputs.refresh().containsKey(filename); + } + }); + } + + @Test + public void testScriptInputCrud() { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + + installApplicationFromTestData("modular_inputs"); + + // Determine what script to use for the input + String filename; + if (service.getInfo().getOsName().equals("Windows")) { + // Windows + filename = "etc\\apps\\modular_inputs\\bin\\echo.bat"; + } else { + // Linux or Mac OS X + filename = "etc/apps/modular_inputs/bin/echo.sh"; + } + + // Create + if (inputs.get(filename) != null) { + inputs.remove(filename); + } + inputs.create( + filename, InputKind.Script, new Args("interval", "60")); + Assert.assertTrue(inputs.containsKey(filename)); + ScriptInput scriptInput = (ScriptInput)inputs.get(filename); + + // Probe + { + scriptInput.setHost("three.four.com"); + scriptInput.setIndex("main"); + scriptInput.setInterval("120"); + if (service.versionCompare("4.2.4") >= 0) { + scriptInput.setPassAuth("admin"); + } + scriptInput.setRenameSource("renamedSource"); + scriptInput.setSource("renamedSource2"); + scriptInput.setSourcetype("script"); + scriptInput.update(); + + Assert.assertEquals("three.four.com", scriptInput.getHost()); + Assert.assertEquals("main", scriptInput.getIndex()); + Assert.assertEquals("120", scriptInput.getInterval()); + if (service.versionCompare("4.2.4") >= 0) { + Assert.assertEquals("admin", scriptInput.getPassAuth()); + } + if (!WORKAROUND_KNOWN_BUGS) { // SPL-57223 + Assert.assertEquals("renamedSource", scriptInput.getSource()); + } + Assert.assertEquals("script", scriptInput.getSourceType()); + } + + // Remove + scriptInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(filename)); + } + + @Test + public void testTcpInputCrud() { + String port = "9999"; // test port + + deleteInputIfExists(port); + + // Create + inputs.create(port, InputKind.Tcp); + Assert.assertTrue(inputs.containsKey(port)); + TcpInput tcpInput = (TcpInput)inputs.get(port); + + // Probe + { + Assert.assertFalse("ip".equals(tcpInput.getConnectionHost())); + tcpInput.setConnectionHost("ip"); + tcpInput.setHost("myhost"); + tcpInput.setIndex("main"); + tcpInput.setQueue("indexQueue"); + if (service.versionCompare("4.3") >= 0) { + // Behavioral difference between 4.3 and earlier versions + tcpInput.setRawTcpDoneTimeout(120); + } + tcpInput.setSource("tcp"); + tcpInput.setSourceType("sdk-tests"); + tcpInput.setSSL(false); + tcpInput.update(); + + Assert.assertEquals("ip", tcpInput.getConnectionHost()); + Assert.assertEquals("myhost", tcpInput.getHost()); + Assert.assertEquals("main", tcpInput.getIndex()); + Assert.assertEquals("indexQueue", tcpInput.getQueue()); + Assert.assertEquals("tcp", tcpInput.getSource()); + Assert.assertEquals("sdk-tests", tcpInput.getSourceType()); + Assert.assertFalse(tcpInput.getSSL()); + } + + // Remove + Assert.assertTrue(inputs.refresh().containsKey(port)); + tcpInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(port)); + } + + @Test + public void testTcpSplunkInputCrud() { + String port = "9998"; // test port + + deleteInputIfExists(port); + + // Create + inputs.create(port, InputKind.TcpSplunk); + Assert.assertTrue(inputs.containsKey(port)); + TcpSplunkInput tcpSplunkInput = + (TcpSplunkInput)inputs.get(port); + + // Probe + { + Assert.assertFalse("dns".equals(tcpSplunkInput.getConnectionHost())); + tcpSplunkInput.setConnectionHost("dns"); + tcpSplunkInput.setHost("myhost"); + tcpSplunkInput.setSSL(false); + tcpSplunkInput.update(); + + Assert.assertEquals("dns", tcpSplunkInput.getConnectionHost()); + Assert.assertEquals("myhost", tcpSplunkInput.getHost()); + Assert.assertFalse(tcpSplunkInput.getSSL()); + } + + // Remove + tcpSplunkInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(port)); + } + + @Test + public void testUdpInputCrud() { + String port = "9997"; // test port + + deleteInputIfExists(port); + + // Create + inputs.create(port, InputKind.Udp); + Assert.assertTrue(inputs.containsKey(port)); + UdpInput udpInput = (UdpInput)inputs.get(port); + + // Probe + { + Assert.assertFalse("dns".equals(udpInput.getConnectionHost())); + udpInput.setConnectionHost("dns"); + udpInput.setHost("myhost"); + udpInput.setIndex("main"); + udpInput.setNoAppendingTimeStamp(true); + udpInput.setNoPriorityStripping(true); + udpInput.setQueue("indexQueue"); + udpInput.setSource("mysource"); + udpInput.setSourceType("mysourcetype"); + udpInput.update(); + + Assert.assertEquals("dns", udpInput.getConnectionHost()); + Assert.assertEquals("myhost", udpInput.getHost()); + Assert.assertEquals("main", udpInput.getIndex()); + Assert.assertTrue(udpInput.getNoAppendingTimeStamp()); + Assert.assertTrue(udpInput.getNoPriorityStripping()); + Assert.assertEquals("indexQueue", udpInput.getQueue()); + Assert.assertEquals("mysource", udpInput.getSource()); + Assert.assertEquals("mysourcetype", udpInput.getSourceType()); + } + + // Remove + udpInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(port)); + } + + // Need an active directory domain controller to run this test + //@Test + public void _testWindowsActiveDirectoryInputCrud() { + if (!service.getInfo().getOsName().equals("Windows")) { + return; + } + + String name = "sdk-input-wad"; + + deleteInputIfExists(name); + + // Create + inputs.create( + name, InputKind.WindowsActiveDirectory, + new Args("monitorSubtree", false)); + Assert.assertTrue(inputs.containsKey(name)); + WindowsActiveDirectoryInput windowsActiveDirectoryInput = + (WindowsActiveDirectoryInput)inputs.get(name); + + // Probe + { + windowsActiveDirectoryInput.setStartingNode("startnode"); + windowsActiveDirectoryInput.setIndex("main"); + windowsActiveDirectoryInput.setMonitorSubtree(false); + windowsActiveDirectoryInput.setTargetDc("otherDC"); + windowsActiveDirectoryInput.update(); + + Assert.assertEquals("main", windowsActiveDirectoryInput.getIndex()); + Assert.assertFalse(windowsActiveDirectoryInput.getMonitorSubtree()); + Assert.assertEquals("startnode", windowsActiveDirectoryInput.getStartingNode()); + Assert.assertEquals("main", windowsActiveDirectoryInput.getIndex()); + } + + // Remove + windowsActiveDirectoryInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(name)); + } + + @Test + public void testWindowsEventLogInputCrud() { + if (!service.getInfo().getOsName().equals("Windows")) { + return; + } + + String name = "sdk-input-wel"; + + deleteInputIfExists(name); + Assert.assertFalse(inputs.refresh().containsKey(name)); + + // Create + inputs.create( + name, InputKind.WindowsEventLog, + new Args("lookup_host", "127.0.0.1")); + Assert.assertTrue(inputs.containsKey(name)); + WindowsEventLogInput windowsEventLogInput = + (WindowsEventLogInput)inputs.get(name); + + // Probe + { + windowsEventLogInput.setIndex("main"); + windowsEventLogInput.setLookupHost("127.0.0.1"); + windowsEventLogInput.setHosts("one.two.three,four.five.six"); + windowsEventLogInput.update(); + + Assert.assertEquals("127.0.0.1", windowsEventLogInput.getLookupHost()); + Assert.assertEquals("one.two.three,four.five.six", windowsEventLogInput.getHosts()); + Assert.assertEquals("main", windowsEventLogInput.getIndex()); + } + + // Remove + windowsEventLogInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(name)); + } + + @Test + public void testWindowsPerfmonInputCrud() { + if (!service.getInfo().getOsName().equals("Windows")) { + return; + } + + String name = "sdk-input-wp"; + + deleteInputIfExists(name); + + // Create + Args args = new Args(); + args.put("interval", 600); + args.put("object", "Server"); + inputs.create(name, InputKind.WindowsPerfmon, args); + Assert.assertTrue(inputs.containsKey(name)); + WindowsPerfmonInput windowsPerfmonInput = + (WindowsPerfmonInput)inputs.get(name); + + // Probe + { + windowsPerfmonInput.setIndex("main"); + windowsPerfmonInput.setCounters("% Privileged Time"); + windowsPerfmonInput.setInstances("wininit"); + windowsPerfmonInput.setObject("Process"); + windowsPerfmonInput.setInterval(1200); + windowsPerfmonInput.update(); + + Assert.assertEquals(1, windowsPerfmonInput.getCounters().length); + Assert.assertTrue(contains(windowsPerfmonInput.getCounters(), "% Privileged Time")); + Assert.assertEquals(windowsPerfmonInput.getIndex(), "main"); + Assert.assertTrue(contains(windowsPerfmonInput.getInstances(), "wininit")); + Assert.assertEquals(1200, windowsPerfmonInput.getInterval()); + Assert.assertEquals("Process", windowsPerfmonInput.getObject()); + + // set multi-series values and update. + windowsPerfmonInput.setCounters(new String[] {"% Privileged Time","% User Time"}); + windowsPerfmonInput.setInstances(new String[] {"smss","csrss"}); + windowsPerfmonInput.update(); + + Assert.assertEquals(2, windowsPerfmonInput.getCounters().length); + Assert.assertTrue(contains(windowsPerfmonInput.getCounters(), "% Privileged Time")); + Assert.assertTrue(contains(windowsPerfmonInput.getCounters(), "% User Time")); + + Assert.assertEquals(2, windowsPerfmonInput.getInstances().length); + Assert.assertTrue(contains(windowsPerfmonInput.getInstances(), "smss")); + Assert.assertTrue(contains(windowsPerfmonInput.getInstances(), "csrss")); + } + + // Remove + windowsPerfmonInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(name)); + } + + @Test + public void testWindowsRegistryInputCrud() { + if (!service.getInfo().getOsName().equals("Windows")) { + return; + } + if (service.versionCompare("4.3") < 0) { + return; + } + + String name = "sdk-input-wr"; + + deleteInputIfExists(name); + + // Create + Args args = new Args(); + args.put("disabled", true); + args.put("baseline", false); + args.put("hive", "HKEY_USERS"); + args.put("proc", "*"); + args.put("type", "*"); + inputs.create(name, InputKind.WindowsRegistry, args); + Assert.assertTrue(inputs.containsKey(name)); + WindowsRegistryInput windowsRegistryInput = + (WindowsRegistryInput)inputs.get(name); + + // Probe + { + windowsRegistryInput.setIndex("main"); + windowsRegistryInput.setMonitorSubnodes(true); + windowsRegistryInput.update(); + + Assert.assertFalse(windowsRegistryInput.getBaseline()); + Assert.assertEquals("main", + windowsRegistryInput.getIndex()); + + // adjust a few of the arguments + String[] wriType = {"create", "delete"}; + windowsRegistryInput.setType(wriType); + windowsRegistryInput.setBaseline(false); + windowsRegistryInput.update(); + + Assert.assertEquals("*", + windowsRegistryInput.getProc()); + Assert.assertTrue( + windowsRegistryInput.getType()[0].equals("create")); + Assert.assertTrue( + windowsRegistryInput.getType()[1].equals("delete")); + Assert.assertFalse(windowsRegistryInput.getBaseline()); + } + + // Remove + windowsRegistryInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(name)); + } + + @Test + public void testWmiInputCrud() { + if (!service.getInfo().getOsName().equals("Windows")) { + return; + } + + String name = "sdk-input-wmi"; + + deleteInputIfExists(name); + + // Create + Args args = new Args(); + args.put("classes", "PerfOS_Processor"); + args.put("interval", 600); + args.put("lookup_host", service.getHost()); + inputs.create(name, InputKind.WindowsWmi, args); + Assert.assertTrue(inputs.containsKey(name)); + WindowsWmiInput windowsWmiInput = + (WindowsWmiInput)inputs.get(name); + + // Probe + { + Assert.assertEquals( + "Win32_PerfFormattedData_PerfOS_Processor", + windowsWmiInput.getClasses()); + Assert.assertEquals(600, + windowsWmiInput.getInterval()); + Assert.assertEquals(service.getHost(), + windowsWmiInput.getLookupHost()); + + windowsWmiInput.setClasses("PerfDisk_LogicalDisk"); + windowsWmiInput.setFields("Caption"); + windowsWmiInput.setIndex("main"); + windowsWmiInput.setInterval(1200); + windowsWmiInput.setInstances("_Total"); + windowsWmiInput.setServers("host1.splunk.com,host2.splunk.com"); + windowsWmiInput.update(); + + Assert.assertEquals( + "Win32_PerfFormattedData_PerfDisk_LogicalDisk", + windowsWmiInput.getClasses()); + Assert.assertEquals(1, + windowsWmiInput.getFields().length); + Assert.assertTrue( + contains(windowsWmiInput.getFields(), "Caption")); + Assert.assertEquals("main", + windowsWmiInput.getIndex()); + Assert.assertEquals(1200, + windowsWmiInput.getInterval()); + Assert.assertEquals(1, + windowsWmiInput.getInstances().length); + Assert.assertTrue( + contains(windowsWmiInput.getInstances(), "_Total")); + Assert.assertEquals( + "host1.splunk.com,host2.splunk.com", + windowsWmiInput.getServers()); + + // set list fields + windowsWmiInput.setFields(new String[]{"Caption", "Description"}); + windowsWmiInput.update(); + + Assert.assertEquals(2, + windowsWmiInput.getFields().length); + Assert.assertTrue( + contains(windowsWmiInput.getFields(), "Caption")); + Assert.assertTrue( + contains(windowsWmiInput.getFields(), "Description")); + } + + // Remove + windowsWmiInput.remove(); + Assert.assertFalse(inputs.refresh().containsKey(name)); + } +} diff --git a/splunk/src/test/java/com/splunk/InputTest.java b/splunk/src/test/java/com/splunk/InputTest.java new file mode 100644 index 00000000..acad5e33 --- /dev/null +++ b/splunk/src/test/java/com/splunk/InputTest.java @@ -0,0 +1,96 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +/** + * Base class of tests that need to access the service's InputCollection + * or otherwise need to manipulate Input entities. + * + * Class was abstract, and abstract has only been removed, and testNop added, + * to make Ant's test runner happy. + */ +public class InputTest extends SDKTestCase { + protected InputCollection inputs; + + @Before + public void setUp() throws Exception { + super.setUp(); + + inputs = service.getInputs(); + + removeTestInputs(); + } + + @After + public void tearDown() throws Exception { + removeTestInputs(); + + super.tearDown(); + } + + @Test + public void testNop() {} // Here only to make Ant's test runner happy. + + @Test + public void testRemoveFromCollection() { + Args namespace = Args.create(); + namespace.put("owner", "nobody"); + namespace.put("app", "search"); + + inputs.create("2911", InputKind.Tcp); + Assert.assertTrue(inputs.containsKey("2911")); + inputs.remove("2911", namespace); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + inputs.refresh(); + return !inputs.containsKey("2911"); + } + }); + } + + private void removeTestInputs() { + for (Input input : inputs.refresh().values()) { + final String inputName = input.getName(); + if (inputName.startsWith("delete-me")) { + input.remove(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + inputs.refresh(); + return !inputs.containsKey(inputName); + } + }); + } + } + } + + // === Utility === + + protected void deleteInputIfExists(String name) { + if (inputs.containsKey(name)) { + inputs.remove(name); + inputs.refresh(); + } + Assert.assertFalse(inputs.containsKey(name)); + } +} diff --git a/splunk/src/test/java/com/splunk/InsertRootElementFilterInputStreamTest.java b/splunk/src/test/java/com/splunk/InsertRootElementFilterInputStreamTest.java new file mode 100644 index 00000000..3ad608d9 --- /dev/null +++ b/splunk/src/test/java/com/splunk/InsertRootElementFilterInputStreamTest.java @@ -0,0 +1,236 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; + +public class InsertRootElementFilterInputStreamTest { + @Test + public void testNormalOperation() throws IOException { + InputStream stream = new ByteArrayInputStream("<?xml encoding=\"UTF-8\"><results/><results/>".getBytes("UTF-8")); + InputStream filteredStream = new InsertRootElementFilterInputStream(stream); + + String found = SDKTestCase.streamToString(filteredStream); + String expected = "<?xml encoding=\"UTF-8\"><doc><results/><results/></doc>"; + + Assert.assertEquals(expected, found); + } + + @Test + public void testNoDtd() throws IOException { + InputStream stream = new ByteArrayInputStream("<results></results><results></results>".getBytes("UTF-8")); + InputStream filteredStream = new InsertRootElementFilterInputStream(stream); + + String found = SDKTestCase.streamToString(filteredStream); + String expected = "<doc><results></results><results></results></doc>"; + + Assert.assertEquals(expected, found); + } + + @Test + public void testNoXml() throws IOException { + String input = "boris the mad baboon"; + InputStream stream = new ByteArrayInputStream(input.getBytes("UTF-8")); + InputStream filteredStream = new InsertRootElementFilterInputStream(stream); + + String found = SDKTestCase.streamToString(filteredStream); + + Assert.assertEquals(input, found); + } + + @Test + public void testNoResults() throws IOException { + String input = "<?xml encoding=\"UTF-8\"><name/><firstName/>"; + InputStream stream = new ByteArrayInputStream(input.getBytes("UTF-8")); + InputStream filteredStream = new InsertRootElementFilterInputStream(stream); + + String found = SDKTestCase.streamToString(filteredStream); + + Assert.assertEquals(input, found); + } + + @Test + public void testBigPreambleBeforeResults() throws IOException { + InputStream stream = new ByteArrayInputStream(("<?xml encoding=\"UTF-8\">" + + "<!-- A comment big enough to break things, Splunkd sometimes writes a lot of spaces before starting the real payload. -->" + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + "<results/><results/>").getBytes("UTF-8")); + InputStream filteredStream = new InsertRootElementFilterInputStream(stream); + + String found = SDKTestCase.streamToString(filteredStream); + String expected = "<?xml encoding=\"UTF-8\">" + + "<!-- A comment big enough to break things, Splunkd sometimes writes a lot of spaces before starting the real payload. -->" + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + " " + + "<doc><results/><results/></doc>"; + + Assert.assertEquals(expected, found); + } +} diff --git a/tests/com/splunk/LicenseGroupTest.java b/splunk/src/test/java/com/splunk/LicenseGroupTest.java similarity index 57% rename from tests/com/splunk/LicenseGroupTest.java rename to splunk/src/test/java/com/splunk/LicenseGroupTest.java index 9c7e20bd..72d1213e 100644 --- a/tests/com/splunk/LicenseGroupTest.java +++ b/splunk/src/test/java/com/splunk/LicenseGroupTest.java @@ -18,22 +18,29 @@ import java.util.Arrays; import java.util.List; -import org.junit.Test; - -public class LicenseGroupTest extends SplunkTestCase { - @Test public void testLicenseGroup() throws Exception { - Service service = connect(); - EntityCollection<LicenseGroup> licenseGroups = - service.getLicenseGroups(); +import org.junit.Assert; +import org.junit.Test; - // list of stackids, empirically created - List<String> stacks = Arrays.asList("forwarder", "enterprise", "free"); - for (LicenseGroup licenseGroup: licenseGroups.values()) { - // enterprise, forwarder, free +public class LicenseGroupTest extends SDKTestCase { + // list of stackids, empirically created + private static final List<String> KNOWN_STACK_IDS = Arrays.asList( + "download-trial", + "enterprise", + "forwarder", + "free", + "trial", + ""); + + @Test + public void testLicenseGroup() throws Exception { + for (LicenseGroup licenseGroup: service.getLicenseGroups().values()) { + // Recognized stack ID? for (String id: licenseGroup.getStackIds()) { - assertTrue(stacks.contains(id)); + Assert.assertTrue(KNOWN_STACK_IDS.contains(id)); } + + // Test getters licenseGroup.isActive(); } } diff --git a/tests/com/splunk/LicenseMessageTest.java b/splunk/src/test/java/com/splunk/LicenseMessageTest.java similarity index 71% rename from tests/com/splunk/LicenseMessageTest.java rename to splunk/src/test/java/com/splunk/LicenseMessageTest.java index cb12ad8e..3614e0ac 100644 --- a/tests/com/splunk/LicenseMessageTest.java +++ b/splunk/src/test/java/com/splunk/LicenseMessageTest.java @@ -17,22 +17,25 @@ package com.splunk; import java.util.Date; -import org.junit.Test; -public class LicenseMessageTest extends SplunkTestCase { - @Test public void testLicenseMessage() throws Exception { - Service service = connect(); +import org.junit.Assert; +import org.junit.Test; +public class LicenseMessageTest extends SDKTestCase { + @Test + public void testLicenseMessage() throws Exception { + // SPL-83050: Known to fail. Should be fixed before Cupcake is released. EntityCollection<LicenseMessage> licenseMessages = - service.getLicenseMessages(); + service.getLicenseMessages(); + if (licenseMessages.values().size() == 0) { - System.out.println("WARNING: no license messages found"); + System.out.println("WARNING: No license messages found to test."); return; } - // test for sane data in licenses for (LicenseMessage licenseMessage: licenseMessages.values()) { - assertTrue(licenseMessage.getCreationTime().after(new Date(0))); + // Test getters + Assert.assertTrue(licenseMessage.getCreationTime().after(new Date(0))); licenseMessage.getCategory(); licenseMessage.getDescription(); licenseMessage.getPoolId(); diff --git a/tests/com/splunk/LicensePoolTest.java b/splunk/src/test/java/com/splunk/LicensePoolTest.java similarity index 51% rename from tests/com/splunk/LicensePoolTest.java rename to splunk/src/test/java/com/splunk/LicensePoolTest.java index 08340af5..e5625d5f 100644 --- a/tests/com/splunk/LicensePoolTest.java +++ b/splunk/src/test/java/com/splunk/LicensePoolTest.java @@ -16,40 +16,29 @@ package com.splunk; +import org.junit.Assert; import org.junit.Test; -public class LicensePoolTest extends SplunkTestCase { - void checkLicensePool(LicensePool licensePool) { - licensePool.getDescription(); - licensePool.getQuota(); - licensePool.getSlaves(); - licensePool.getSlavesUsageBytes(); - licensePool.getStackId(); - licensePool.getUsedBytes(); - } - - void checkLicensePools(LicensePoolCollection licensePoolCollection) { - for (LicensePool licensePool : licensePoolCollection.values()) - checkLicensePool(licensePool); - } - - @Test public void testLicensePool() throws Exception { - Service service = connect(); - +public class LicensePoolTest extends SDKTestCase { + @Test + public void testCreateWithNoQuota() throws Exception { LicensePoolCollection licensePoolCollection = service.getLicensePools(); - - checkLicensePools(licensePoolCollection); - try { // The following will fail because there is no quota available - licensePoolCollection.create("sdk-test", 1, "download-trial"); - fail("Expected pool create to fail"); + licensePoolCollection.create("sdk-test", "MAX", "download-trial"); + Assert.fail("Expected pool create to fail"); } catch (HttpException e) { - assertEquals(e.getStatus(), 400); + Assert.assertEquals(400, e.getStatus()); } - + } + + @Test + public void testLicensePoolSetters() throws Exception { + LicensePoolCollection licensePoolCollection = service.getLicensePools(); + // Try updating some pools .. + boolean foundAnUpdatablePool = false; for (LicensePool licensePool : licensePoolCollection.values()) { if (licensePool.getStackId().equals("download-trial")) continue; // Can't edit a pool in stack: download-trial @@ -57,20 +46,43 @@ void checkLicensePools(LicensePoolCollection licensePoolCollection) { continue; // Can't edit a pool in stack: forwarder if (licensePool.getStackId().equals("free")) continue; // Can't edit a pool in stack: free + foundAnUpdatablePool = true; - Args saved = new Args(); - saved.put("description", licensePool.getDescription()); - - Args args = new Args(); - args.put("description", "sdk-test description"); - args.put("quota", 1024*1024); - licensePool.update(args); - assertEquals( - (int)Integer.valueOf(licensePool.getQuota()), 1024*1024); + String originalDescription = licensePool.getDescription(); + + // Probe + { + licensePool.setDescription("sdk-test description"); + licensePool.setQuota("1048576"); + licensePool.update(); + + Assert.assertEquals("sdk-test description", licensePool.getDescription()); + Assert.assertEquals("1048576", licensePool.getQuota()); + } - saved.put("quota", "MAX"); - licensePool.update(saved); - assertEquals(licensePool.getDescription(),saved.get("description")); + licensePool.update(new Args("description", originalDescription)); + licensePool.update(new Args("quota", "MAX")); + } + + if (!foundAnUpdatablePool) { + System.out.println("WARNING: Didn't find any updatable license pools."); + } + } + + @Test + public void testLicensePoolGetters() { + LicensePoolCollection licensePoolCollection = service.getLicensePools(); + for (LicensePool licensePool : licensePoolCollection.values()) { + testLicensePoolGetters(licensePool); } } + + private void testLicensePoolGetters(LicensePool licensePool) { + licensePool.getDescription(); + licensePool.getQuota(); + licensePool.getSlaves(); + licensePool.getSlavesUsageBytes(); + licensePool.getStackId(); + licensePool.getUsedBytes(); + } } diff --git a/tests/com/splunk/LicenseSlaveTest.java b/splunk/src/test/java/com/splunk/LicenseSlaveTest.java similarity index 53% rename from tests/com/splunk/LicenseSlaveTest.java rename to splunk/src/test/java/com/splunk/LicenseSlaveTest.java index 05665542..fbb4bb04 100644 --- a/tests/com/splunk/LicenseSlaveTest.java +++ b/splunk/src/test/java/com/splunk/LicenseSlaveTest.java @@ -18,35 +18,37 @@ import java.util.Arrays; import java.util.List; -import org.junit.Test; - -public class LicenseSlaveTest extends SplunkTestCase { - @Test public void testLicenseSlave() throws Exception { - Service service = connect(); - EntityCollection<LicenseSlave> licenseSlaves = - service.getLicenseSlaves(); +import org.junit.Assert; +import org.junit.Test; - // list of pools - List<String> pools = Arrays.asList("auto_generated_pool_download-trial", - "auto_generated_pool_enterprise", "auto_generated_pool_forwarder", +public class LicenseSlaveTest extends SDKTestCase { + private static final List<String> KNOWN_POOL_IDS = Arrays.asList( + "auto_generated_pool_download-trial", + "auto_generated_pool_enterprise", + "auto_generated_pool_forwarder", "auto_generated_pool_free"); - - List<String> stacks = Arrays.asList( - "download-trial", "enterprise", "forwarder", "free"); - - for (LicenseSlave licenseSlave: licenseSlaves.values()) { - assertTrue(licenseSlave.getLabel().length() > 0); + + private static final List<String> KNOWN_STACK_IDS = Arrays.asList( + "download-trial", "enterprise", "forwarder", "free"); + + @Test + public void testDefaultLicenseSlavesAreKnown() throws Exception { + EntityCollection<LicenseSlave> licenseSlaves = service.getLicenseSlaves(); + for (LicenseSlave licenseSlave : licenseSlaves.values()) { + Assert.assertTrue(licenseSlave.getLabel().length() > 0); + for (String pool: licenseSlave.getPoolIds()) { - // special-case, fixed sourcetype has a hash at the end; so + // Special-case, fixed sourcetype has a hash at the end; so // no fixed value will match. Thus only check versus known // fixed values from list. if (!pool.startsWith("auto_generated_pool_fixed-sourcetype_")) { - assertTrue(pools.contains(pool)); + Assert.assertTrue(KNOWN_POOL_IDS.contains(pool)); } } + for (String stack: licenseSlave.getStackIds()) { - assertTrue(stacks.contains(stack)); + Assert.assertTrue(KNOWN_STACK_IDS.contains(stack)); } } } diff --git a/splunk/src/test/java/com/splunk/LicenseTest.java b/splunk/src/test/java/com/splunk/LicenseTest.java new file mode 100644 index 00000000..7c7334ca --- /dev/null +++ b/splunk/src/test/java/com/splunk/LicenseTest.java @@ -0,0 +1,146 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Arrays; +import java.util.Date; +import java.util.List; + +import org.junit.Assert; +import org.junit.Test; + +public class LicenseTest extends SDKTestCase { + // List of features, empirically created + private static final List<String> KNOWN_FEATURES = Arrays.asList( + "Auth", "FwdData", "RcvData", "DeployClient", "SplunkWeb", + "SyslogOutputProcessor", "SigningProcessor", "LocalSearch", + "DistSearch", "RcvSearch", "ScheduledSearch", "Alerting", + "DeployServer", "SigningProcessor", "SyslogOutputProcessor", + "AllowDuplicateKeys", "CanBeRemoteMaster"); + + // List of groupids, empirically created + private static final List<String> KNOWN_GROUP_IDS = Arrays.asList( + "Forwarder", "Enterprise", "Free", "Trial"); + + // List of statuses, empirically created + private static final List<String> KNOWN_STATUSES = Arrays.asList("VALID", "EXPIRED"); + + // List of types, empirically created + private static final List<String> KNOWN_TYPES = Arrays.asList( + "forwarder", "enterprise", "free", "download-trial"); + + @Test + public void testStacks() throws Exception { + EntityCollection<LicenseStack> stacks = service.getLicenseStacks(); + for (LicenseStack stack : stacks.values()) { + Assert.assertTrue(stack.getQuota() >= 0); + Assert.assertTrue(!stack.getType().isEmpty()); + Assert.assertTrue(!stack.getLabel().isEmpty()); + } + } + + @Test + public void testDefaultLicensesHaveKnownProperties() throws Exception { + EntityCollection<License> licenses = service.getLicenses(); + + // Test for sane data in licenses + for (License license: licenses.values()) { + Assert.assertTrue(license.getCreationTime().after(new Date(0))); + Assert.assertTrue(license.getExpirationTime().after(new Date(0))); + Assert.assertTrue(license.getQuota() > 0); + Assert.assertEquals(64, license.getLicenseHash().length()); + // License features changed in 6.2, so don't check against our hardcoded list + if (service.versionIsEarlierThan("6.2")) { + for (String feature: license.getFeatures()) { + Assert.assertTrue(KNOWN_FEATURES.contains(feature)); + } + } + Assert.assertTrue(KNOWN_GROUP_IDS.contains(license.getGroupId())); + Assert.assertTrue(license.getLabel().length() > 0); + Assert.assertNotSame(0, license.getMaxViolations()); + Assert.assertTrue(KNOWN_STATUSES.contains(license.getStatus())); + Assert.assertTrue(KNOWN_TYPES.contains(license.getType())); + license.getSourceTypes(); + license.getStackId(); + license.getWindowPeriod(); + } + } + + // This test is very hard to maintain correctly do to the fact that licenses + // expires. We're going to leave it out for now. + /*@Test + public void testCreateDelete() throws Exception { + EntityCollection<License> licenses = service.getLicenses(); + + String activeGroup = null; + EntityCollection<Entity> licenseGroups = new EntityCollection<Entity>(service, "licenser/groups"); + for (Entity entity : licenseGroups.values()) { + if (entity.getBoolean("is_active", false)) { + activeGroup = entity.getName(); + break; + } + } + + try { + Args args = new Args(); + args.put("is_active", "1"); + service.post("licenser/groups/Free", args); + splunkRestart(); + + String licenseKey; + String licenseFilename; + if (service.versionIsAtLeast("6.1")) { + licenseKey = "EEDD55456662E29733FE185604ED22C44D1F472220BA3616E2605ECB322E4ACF"; + licenseFilename = "splunk_at_least_cupcake.license"; + } else { + licenseKey = "6B7AD703356A487BDC513EE92B96A9B403C070EFAA30029C9784B0E240FA3101"; + licenseFilename = "splunk.license"; + } + + if (licenses.containsKey(licenseKey)) { + licenses.remove(licenseKey); + } + Assert.assertFalse(licenses.containsKey(licenseKey)); + + // Read test license from disk + byte[] licensePayload = new byte[2048]; + InputStream licenseStream = SDKTestCase.openResource(licenseFilename); + try { + licenseStream.read(licensePayload); + } + finally { + licenseStream.close(); + } + + // Create + licenses.create(licenseKey, new Args("payload", new String(licensePayload))); + + // Remove + Assert.assertTrue(licenses.containsKey(licenseKey)); + licenses.remove(licenseKey); + Assert.assertFalse(licenses.containsKey(licenseKey)); + + } finally { + if (activeGroup != null) { + Args args = new Args(); + args.put("is_active", "1"); + service.post("licenser/groups/" + activeGroup, args); + splunkRestart(); + } + } + }*/ +} diff --git a/splunk/src/test/java/com/splunk/LoggerTest.java b/splunk/src/test/java/com/splunk/LoggerTest.java new file mode 100644 index 00000000..8a0ce484 --- /dev/null +++ b/splunk/src/test/java/com/splunk/LoggerTest.java @@ -0,0 +1,79 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Arrays; +import java.util.List; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class LoggerTest extends SDKTestCase { + private static final List<String> VALID_LEVELS = Arrays.asList( + "INFO", "WARN", "ERROR", "DEBUG", "CRIT", "FATAL"); + + // NOTE: Ideally we would create our own logger instead of using an existing + // one. However there is no REST API call to create a Logger, and + // we can't use an app to install one, either. + private static final String TEST_LOGGER_NAME = "AuditLogger"; + + private Logger logger; + private String originalLoggerLevel; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + logger = service.getLoggers().get(TEST_LOGGER_NAME); + originalLoggerLevel = logger.getLevel(); + } + + @After + @Override + public void tearDown() throws Exception { + logger.setLevel(originalLoggerLevel); + + super.tearDown(); + } + + @Test + public void testDefaultLoggersHaveValidLevels() { + for (Logger curLogger : service.getLoggers().values()) { + Assert.assertTrue(VALID_LEVELS.contains(curLogger.getLevel())); + } + } + + @Test + public void testLevelSetter() { + for (String curLevel : VALID_LEVELS) { + logger.setLevel(curLevel); + logger.update(); + Assert.assertEquals(curLevel, logger.getLevel()); + } + } + + @Test + public void testLevelUpdate() { + for (String curLevel : VALID_LEVELS) { + logger.update(new Args("level", curLevel)); + Assert.assertEquals(curLevel, logger.getLevel()); + } + } +} diff --git a/splunk/src/test/java/com/splunk/MessageTest.java b/splunk/src/test/java/com/splunk/MessageTest.java new file mode 100644 index 00000000..75b9ea87 --- /dev/null +++ b/splunk/src/test/java/com/splunk/MessageTest.java @@ -0,0 +1,56 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class MessageTest extends SDKTestCase { + @Test + public void testMessage() throws Exception { + MessageCollection messageCollection = service.getMessages(); + + if (messageCollection.containsKey("sdk-test-message1")) + messageCollection.remove("sdk-test-message1"); + Assert.assertFalse(messageCollection.containsKey("sdk-test-message1")); + + if (messageCollection.containsKey("sdk-test-message2")) + messageCollection.remove("sdk-test-message2"); + Assert.assertFalse(messageCollection.containsKey("sdk-test-message2")); + + // Create & Check + { + messageCollection.create("sdk-test-message1", "hello."); + Assert.assertTrue(messageCollection.containsKey("sdk-test-message1")); + Message message = messageCollection.get("sdk-test-message1"); + Assert.assertEquals("sdk-test-message1", message.getKey()); + Assert.assertEquals("hello.", message.getValue()); + + messageCollection.create("sdk-test-message2", new Args("value", "world.")); + Assert.assertTrue(messageCollection.containsKey("sdk-test-message2")); + message = messageCollection.get("sdk-test-message2"); + Assert.assertEquals("sdk-test-message2", message.getKey()); + Assert.assertEquals("world.", message.getValue()); + } + + messageCollection.remove("sdk-test-message1"); + Assert.assertFalse(messageCollection.containsKey("sdk-test-message1")); + + messageCollection.remove("sdk-test-message2"); + Assert.assertFalse(messageCollection.containsKey("sdk-test-message2")); + } +} diff --git a/splunk/src/test/java/com/splunk/MetadataTest.java b/splunk/src/test/java/com/splunk/MetadataTest.java new file mode 100644 index 00000000..e7b2c675 --- /dev/null +++ b/splunk/src/test/java/com/splunk/MetadataTest.java @@ -0,0 +1,77 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Test; + +public class MetadataTest extends SDKTestCase { + @Test + public void testMetadataGettersOfDefaultEntities() { + testMetadataGetters(service.getApplications()); + // TODO: Fix these when deployment server stuff is resolved. + //testMetadataGetters(service.getDeploymentClient()); + //testMetadataGetters(service.getDeploymentServerClasses()); + //testMetadataGetters(service.getDeploymentTenants()); + testMetadataGetters(service.getDistributedConfiguration()); + testMetadataGetters(service.getDistributedPeers()); + testMetadataGetters(service.getEventTypes()); + //testMetadataGetters(service.getFiredAlertGroups()); + testMetadataGetters(service.getIndexes()); + testMetadataGetters(service.getInfo()); + testMetadataGetters(service.getInputs()); + testMetadataGetters(service.getJobs()); + testMetadataGetters(service.getLicenseGroups()); + testMetadataGetters(service.getLicensePools()); + testMetadataGetters(service.getLicenseSlaves()); + testMetadataGetters(service.getLicenseStacks()); + testMetadataGetters(service.getLicenses()); + testMetadataGetters(service.getLoggers()); + testMetadataGetters(service.getMessages()); + testMetadataGetters(service.getOutputDefault()); + testMetadataGetters(service.getOutputGroups()); + testMetadataGetters(service.getOutputServers()); + testMetadataGetters(service.getOutputSyslogs()); + testMetadataGetters(service.getPasswords()); + testMetadataGetters(service.getRoles()); + testMetadataGetters(service.getSavedSearches()); + testMetadataGetters(service.getSettings()); + testMetadataGetters(service.getUsers()); + } + + private void testMetadataGetters( + EntityCollection<? extends Entity> entityCollection) { + for (Entity entity : entityCollection.values()) { + testMetadataGetters(entity); + } + } + + private void testMetadataGetters(Entity entity) { + EntityMetadata metadata = entity.getMetadata(); + if (metadata == null) return; + + metadata.canChangePermissions(); + metadata.canShareApp(); + metadata.canShareGlobal(); + metadata.canShareUser(); + metadata.canWrite(); + metadata.getApp(); + metadata.getOwner(); + metadata.getPermissions(); + metadata.getSharing(); + metadata.isModifiable(); + } +} diff --git a/splunk/src/test/java/com/splunk/ModularInputKindsTest.java b/splunk/src/test/java/com/splunk/ModularInputKindsTest.java new file mode 100644 index 00000000..8c7d7fff --- /dev/null +++ b/splunk/src/test/java/com/splunk/ModularInputKindsTest.java @@ -0,0 +1,234 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + + +import org.junit.Assert; +import org.junit.Ignore; +import org.junit.Test; + +import java.util.*; + +public class ModularInputKindsTest extends SDKTestCase { + private ResourceCollection<ModularInputKind> inputKinds; + + public void checkModularInputKind(ModularInputKind m) { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + if (m.getName().equals("test1")) { + Assert.assertEquals("Test \"Input\" - 1", m.getTitle()); + Assert.assertEquals("xml", m.getStreamingMode()); + } else if (m.getName().equals("test2")) { + Assert.assertEquals("test2", m.getTitle()); + Assert.assertEquals("simple", m.getStreamingMode()); + } + + } + + @Test + public void testListInputKinds() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + for (ModularInputKind kind : inputKinds.values()) { + checkModularInputKind(kind); + } + } + + @Test + public void testInputByName() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + ModularInputKind m; + m = inputKinds.get("test1"); + checkModularInputKind(m); + m = inputKinds.get("test2"); + checkModularInputKind(m); + } + + @Test + public void testNonexistantArg() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + ModularInputKind test1 = inputKinds.get("test1"); + Assert.assertFalse(test1.hasArgument("nonexistant_argument")); + Assert.assertNull(test1.getArgument("nonexistant_argument")); + } + + @Test + public void testInputKindDescriptionAndTitle() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + ModularInputKind test1 = inputKinds.get("test1"); + String expectedDescription1 = "A description of test input 1 with special characters: //;!*%"; + Assert.assertEquals(expectedDescription1, test1.getDescription()); + Assert.assertEquals("Test \"Input\" - 1", test1.getTitle()); + + ModularInputKind test2 = inputKinds.get("test2"); + Assert.assertEquals(null, test2.getDescription()); + Assert.assertEquals("test2", test2.getTitle()); + } + + @Test + public void testArgDescription() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + ModularInputKind test1 = inputKinds.get("test1"); + + ModularInputKindArgument arg; + + Map<String,String> expectedValues = new HashMap<String,String>(); + expectedValues.put("key_id", "The key of the system"); + expectedValues.put("no_description", null); + expectedValues.put("empty_description", null); + + for (String key : expectedValues.keySet()) { + Assert.assertTrue(test1.hasArgument(key)); + arg = test1.getArgument(key); + String expectedDescription = expectedValues.get(key); + String foundDescription = arg.getDescription(); + Assert.assertEquals(expectedDescription, foundDescription); + } + } + + @Test + public void testArgDataType() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + ModularInputKind test1 = inputKinds.get("test1"); + + ModularInputKindArgument arg; + + Map<String,ModularInputKindArgument.Type> expectedValues = + new HashMap<String,ModularInputKindArgument.Type>(); + expectedValues.put("number_field", ModularInputKindArgument.Type.NUMBER); + expectedValues.put("boolean_field", ModularInputKindArgument.Type.BOOLEAN); + expectedValues.put("string_field", ModularInputKindArgument.Type.STRING); + + for (String key : expectedValues.keySet()) { + Assert.assertTrue(test1.hasArgument(key)); + arg = test1.getArgument(key); + Assert.assertEquals(expectedValues.get(key), arg.getType()); + } + } + + @Test + public void testRequiredOnCreate() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + ModularInputKind test1 = inputKinds.get("test1"); + + ModularInputKindArgument arg; + + Map<String,Boolean> expectedValues = new HashMap<String,Boolean>(); + expectedValues.put("required_on_create", true); + expectedValues.put("not_required_on_create", false); + + for (String key : expectedValues.keySet()) { + Assert.assertTrue(test1.hasArgument(key)); + arg = test1.getArgument(key); + Assert.assertEquals((boolean) expectedValues.get(key), arg.getRequiredOnCreate()); + } + } + + @Test + public void testRequiredOnEdit() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + ModularInputKind test1 = inputKinds.get("test1"); + + ModularInputKindArgument arg; + + Map<String,Boolean> expectedValues = new HashMap<String,Boolean>(); + expectedValues.put("arg_required_on_edit", true); + expectedValues.put("not_required_on_edit", false); + + for (String key : expectedValues.keySet()) { + Assert.assertTrue(test1.hasArgument(key)); + arg = test1.getArgument(key); + Assert.assertEquals((boolean) expectedValues.get(key), arg.getRequiredOnEdit()); + } + } + + @Test + public void testGetArguments() { + if (service.versionIsEarlierThan("5.0") || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + inputKinds = service.getModularInputKinds(); + } + + ModularInputKind test1 = inputKinds.get("test1"); + Map<String, ModularInputKindArgument> args = test1.getArguments(); + + Set<String> expectedKeys = new HashSet<String>(); + expectedKeys.add("name"); + expectedKeys.add("resname"); + expectedKeys.add("key_id"); + expectedKeys.add("no_description"); + expectedKeys.add("empty_description"); + expectedKeys.add("arg_required_on_edit"); + expectedKeys.add("not_required_on_edit"); + expectedKeys.add("required_on_create"); + expectedKeys.add("not_required_on_create"); + expectedKeys.add("number_field"); + expectedKeys.add("string_field"); + expectedKeys.add("boolean_field"); + + Assert.assertEquals(expectedKeys, args.keySet()); + } +} diff --git a/splunk/src/test/java/com/splunk/ModularInputTest.java b/splunk/src/test/java/com/splunk/ModularInputTest.java new file mode 100644 index 00000000..7e3ca981 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ModularInputTest.java @@ -0,0 +1,74 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Ignore; +import org.junit.Test; + +public class ModularInputTest extends InputTest { + @Test + public void testModularInputKinds() { + if (service.versionCompare("5.0") < 0 || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + // Will not pick up the new inputs unless a restart is done. + // Nevertheless Splunk does not request a restart after app installation. + uncheckedSplunkRestart(); + inputs.refresh(); + } + + boolean hasTest2 = false; + for (InputKind inputKind : inputs.getInputKinds()) { + if (inputKind.getKind().equals("test2")) { + hasTest2 = true; + } + } + Assert.assertTrue(hasTest2); + } + + @Test + public void testListModularInputs() { + if (service.versionCompare("5.0") < 0 || !hasTestData()) { + return; + } else { + installApplicationFromTestData("modular_inputs"); + // Will not pick up the new inputs unless a restart is done. + // Nevertheless Splunk does not request a restart after app installation. + uncheckedSplunkRestart(); + inputs.refresh(); + } + + Assert.assertFalse(inputs.isEmpty()); + + String inputName = createTemporaryName(); + inputs.create( + inputName, + InputKind.create("test2"), + new Args("field1", "boris")); + + boolean inputFound = false; + for (Input input : inputs.values()) { + if (input.getName().equals(inputName) && + input.getKind().getKind().equals("test2")) { + inputFound = true; + } + } + Assert.assertTrue("Modular input did not show up in list.", inputFound); + } +} diff --git a/splunk/src/test/java/com/splunk/NamespaceTest.java b/splunk/src/test/java/com/splunk/NamespaceTest.java new file mode 100644 index 00000000..16a332ad --- /dev/null +++ b/splunk/src/test/java/com/splunk/NamespaceTest.java @@ -0,0 +1,285 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class NamespaceTest extends SDKTestCase { + @Test + public void testStaticNamespace() { + Assert.assertEquals( + "This test is not valid when Service owner is overridden.", + null, service.getOwner()); + Assert.assertEquals( + "This test is not valid when Service app is overridden.", + null, service.getApp()); + + Args namespace = new Args(); + + // syntactic tests + namespace.clear(); + Assert.assertEquals("/services/", + service.fullpath("", null)); + + namespace.clear(); + namespace.put("owner", "bill@some domain\u0150"); + namespace.put("app", "my! app!@"); + Assert.assertEquals("/servicesNS/bill%40some+domain%C5%90/my%21+app%21%40/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/Bob/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("app", "search"); + Assert.assertEquals("/servicesNS/-/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("app", "search"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/Bob/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "user"); + Assert.assertEquals("/servicesNS/-/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "user"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/Bob/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "user"); + namespace.put("app", "search"); + Assert.assertEquals("/servicesNS/-/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "user"); + namespace.put("app", "search"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/Bob/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "app"); + Assert.assertEquals("/servicesNS/nobody/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "app"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "app"); + namespace.put("app", "search"); + Assert.assertEquals("/servicesNS/nobody/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "app"); + namespace.put("app", "search"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "global"); + Assert.assertEquals("/servicesNS/nobody/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "global"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/-/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "global"); + namespace.put("app", "search"); + Assert.assertEquals("/servicesNS/nobody/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "global"); + namespace.put("app", "search"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/search/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "system"); + Assert.assertEquals("/servicesNS/nobody/system/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "system"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/system/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "system"); + namespace.put("app", "search"); + Assert.assertEquals("/servicesNS/nobody/system/", + service.fullpath("", namespace)); + + namespace.clear(); + namespace.put("sharing", "system"); + namespace.put("app", "search"); + namespace.put("owner", "Bob"); + Assert.assertEquals("/servicesNS/nobody/system/", + service.fullpath("", namespace)); + } + + @Test + public void testLiveNamespace1() throws Exception { + String username = "sdk-user@somedomain!"; + String password = "changeme!"; + String savedSearch = "sdk-test1"; + String searchString = "search index=main * | head 10"; + + // Setup a namespace + Args namespace = new Args(); + namespace.put("owner", username); + namespace.put("app", "search"); + + // get all users, scrub and make our test user + UserCollection users = service.getUsers(); + if (users.containsKey(username)) + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + users.create(username, password, "user"); + Assert.assertTrue(users.containsKey(username)); + + // get saved searches for our new namespace, clean to make sure + // we remove, before we create one. + SavedSearchCollection savedSearches = + service.getSavedSearches(namespace); + + if (savedSearches.containsKey(savedSearch)) + savedSearches.remove(savedSearch); + Assert.assertFalse(savedSearches.containsKey(savedSearch)); + + savedSearches.create(savedSearch, searchString); + Assert.assertTrue(savedSearches.containsKey(savedSearch)); + + // remove saved search + savedSearches.remove(savedSearch); + Assert.assertFalse(savedSearches.containsKey(savedSearch)); + + // remove user + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + } + + // Check that a saved search created in one user namespace is invisible in another. + @Test + public void testNamespaceVisibility() { + final String savedSearchName = createTemporaryName(); + final String query = "search *"; + + final String user = "admin"; + final String app = "search"; + + Args namespace = new Args(); + namespace.put("owner", user); + namespace.put("app", app); + + Args otherUserNamespace = new Args(); + otherUserNamespace.put("owner", user); + otherUserNamespace.put("app", "launcher"); + + Args appNamespace = new Args(); + appNamespace.put("owner", "nobody"); + appNamespace.put("app", app); + + Args wildcardUserNamespace = new Args(); + wildcardUserNamespace.put("owner", "-"); + wildcardUserNamespace.put("app", app); + + try { + SavedSearch ss = service.getSavedSearches(namespace).create(savedSearchName, query); + + Assert.assertTrue(service.getSavedSearches(namespace).containsKey(savedSearchName)); + Assert.assertFalse(service.getSavedSearches(otherUserNamespace).containsKey(savedSearchName)); + Assert.assertFalse(service.getSavedSearches(appNamespace).containsKey(savedSearchName)); + Assert.assertTrue(service.getSavedSearches(wildcardUserNamespace).containsKey(savedSearchName)); + } finally { + if (service.getSavedSearches(namespace).containsKey(savedSearchName)) { + service.getSavedSearches(namespace).remove(savedSearchName); + } + } + } + + @Test + public void testNamespaceConflicts() { + final String user = "admin"; + final String app1 = "search"; + final String app2 = "launcher"; + + Args namespace1 = new Args(); + namespace1.put("owner", user); + namespace1.put("app", app1); + + Args namespace2 = new Args(); + namespace2.put("owner", user); + namespace2.put("app", app2); + + Args wildcardNamespace = new Args(); + wildcardNamespace.put("owner", user); + wildcardNamespace.put("app", "-"); + + final String savedSearchName = createTemporaryName(); + final String query1 = "search * | head 1"; + final String query2 = "search * | head 2"; + + try { + SavedSearch ss1 = service.getSavedSearches(namespace1).create(savedSearchName, query1); + SavedSearch ss2 = service.getSavedSearches(namespace2).create(savedSearchName, query2); + + Assert.assertEquals(query1, service.getSavedSearches(namespace1).get(savedSearchName).getSearch()); + Assert.assertEquals(query2, service.getSavedSearches(namespace2).get(savedSearchName).getSearch()); + + try { + service.getSavedSearches(wildcardNamespace).get(savedSearchName).getSearch(); + Assert.fail("Expected SplunkException about multiple keys."); + } catch (SplunkException e) { + + } + } finally { + if (service.getSavedSearches(namespace1).containsKey(savedSearchName)) { + service.getSavedSearches(namespace1).remove(savedSearchName); + } + + if (service.getSavedSearches(namespace2).containsKey(savedSearchName)) { + service.getSavedSearches(namespace2).remove(savedSearchName); + } + } + + + } +} diff --git a/splunk/src/test/java/com/splunk/OutputDefaultTest.java b/splunk/src/test/java/com/splunk/OutputDefaultTest.java new file mode 100644 index 00000000..55f28389 --- /dev/null +++ b/splunk/src/test/java/com/splunk/OutputDefaultTest.java @@ -0,0 +1,78 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class OutputDefaultTest extends SDKTestCase { + @Test + public void testOutputDefault() throws Exception { + OutputDefault outputDefault = service.getOutputDefault(); + + // Getters don't throw exception & + // Save old values + outputDefault.getAutoLB(); + outputDefault.blockOnQueueFull(); + outputDefault.getAutoLBFrequency(); + int onQueueFull = outputDefault.getDropEventsOnQueueFull(); + outputDefault.getForwardedIndex0Whitelist(); + outputDefault.getForwardedIndex1Blacklist(); + outputDefault.getForwardedIndex2Whitelist(); + int heartbeat = outputDefault.getHeartbeatFrequency(); + outputDefault.getMaxQueueSize(); + boolean forward = outputDefault.indexAndForward(); + outputDefault.isCompressed(); + outputDefault.isDisabled(); + outputDefault.isForwardedIndexFilterDisable(); + boolean cookedData = outputDefault.getSendCookedData(); + String maxQueueSize = outputDefault.getMaxQueueSize(); + + // Probe + { + outputDefault.setMaxQueueSize("1MB"); + Assert.assertEquals(outputDefault.getMaxQueueSize(), "1MB"); + outputDefault.setMaxQueueSize(maxQueueSize); + Assert.assertEquals(outputDefault.getMaxQueueSize(), maxQueueSize); + + outputDefault.setDropEventsOnQueueFull(0); + outputDefault.setHeartbeatFrequency(heartbeat+1); + outputDefault.setIndexAndForward(!forward); + outputDefault.setSendCookedData(!cookedData); + outputDefault.update(); + + Assert.assertEquals(0, outputDefault.getDropEventsOnQueueFull()); + Assert.assertEquals(heartbeat + 1, outputDefault.getHeartbeatFrequency()); + Assert.assertEquals(!forward, outputDefault.indexAndForward()); + Assert.assertEquals(!cookedData, outputDefault.getSendCookedData()); + } + + // Restore original values + { + outputDefault.setDropEventsOnQueueFull(onQueueFull); + outputDefault.setHeartbeatFrequency(heartbeat); + outputDefault.setIndexAndForward(forward); + outputDefault.setSendCookedData(cookedData); + outputDefault.update(); + + Assert.assertEquals(onQueueFull, outputDefault.getDropEventsOnQueueFull()); + Assert.assertEquals(heartbeat, outputDefault.getHeartbeatFrequency()); + Assert.assertEquals(forward, outputDefault.indexAndForward()); + Assert.assertEquals(cookedData, outputDefault.getSendCookedData()); + } + } +} diff --git a/tests/com/splunk/OutputGroupTest.java b/splunk/src/test/java/com/splunk/OutputGroupTest.java similarity index 51% rename from tests/com/splunk/OutputGroupTest.java rename to splunk/src/test/java/com/splunk/OutputGroupTest.java index f54cf5c5..e850dd13 100644 --- a/tests/com/splunk/OutputGroupTest.java +++ b/splunk/src/test/java/com/splunk/OutputGroupTest.java @@ -16,23 +16,43 @@ package com.splunk; +import org.junit.Assert; import org.junit.Test; -public class OutputGroupTest extends SplunkTestCase { - @Test public void testOutputGroup() throws Exception { - Service service = connect(); - +public class OutputGroupTest extends SDKTestCase { + @Test + public void testOutputGroup() throws Exception { EntityCollection<OutputGroup> outputGroups = service.getOutputGroups(); if (outputGroups.values().size() == 0) { - System.out.println("WARNING: OutputGroup not configured"); + System.out.println("WARNING: No OutputGroups to test"); return; } for (OutputGroup outputGroup: outputGroups.values()) { + // Getters don't throw exception & + // Save old values outputGroup.getMethod(); - outputGroup.getServers(); + String[] servers = outputGroup.getServers(); outputGroup.isDisabled(); + outputGroup.getAutoLB(); + + // Probe + { + outputGroup.setServers("1.1.1.1:9997"); + outputGroup.update(); + + String[] updatedServers = outputGroup.getServers(); + Assert.assertTrue(contains(updatedServers, "1.1.1.1:9997")); + } + + // Restore original values + { + outputGroup.setServers(Util.join(",", servers)); + outputGroup.update(); + + outputGroup.getServers(); + } } } } diff --git a/tests/com/splunk/OutputServerTest.java b/splunk/src/test/java/com/splunk/OutputServerTest.java similarity index 51% rename from tests/com/splunk/OutputServerTest.java rename to splunk/src/test/java/com/splunk/OutputServerTest.java index d2043bc5..24fb6aa2 100644 --- a/tests/com/splunk/OutputServerTest.java +++ b/splunk/src/test/java/com/splunk/OutputServerTest.java @@ -18,19 +18,41 @@ import org.junit.Test; -public class OutputServerTest extends SplunkTestCase { - @Test public void testOutputServer() throws Exception { - Service service = connect(); - +public class OutputServerTest extends SDKTestCase { + @Test + public void testOutputServer() throws Exception { EntityCollection<OutputServer> outputServers = service.getOutputServers(); if (outputServers.values().size() == 0) { - System.out.println("WARNING: OutputServer not configured"); + System.out.println("WARNING: No OutputServers to test"); return; } - for (OutputServer outputServer: outputServers.values()) { + for (OutputServer outputServer : outputServers.values()) { + // Getters throw no exceptions + // NOTE: No corresponding setters. + outputServer.getDestHost(); + outputServer.getDestIp(); + outputServer.getDestPort(); + outputServer.getMethod(); + outputServer.getSourcePort(); + outputServer.getStatus(); + + // Setters throw no exceptions. + // NOTE: No corresponding getters. + /* + outputServer.setMethod(); + outputServer.setSslAltNameToCheck(); + outputServer.setSslCertPath(); + outputServer.setSslCipher(); + outputServer.setSslCommonNameToCheck(); + outputServer.setSslPassword(); + outputServer.setSslRootCAPath(); + outputServer.setSslVerifyServerCert(); + */ + + // Getter on "allCollections" endpoint throw no exceptions OutputServerAllConnections outputServerAllConnections = outputServer.allConnections(); outputServerAllConnections.getDestHost(); diff --git a/splunk/src/test/java/com/splunk/OutputSyslogTest.java b/splunk/src/test/java/com/splunk/OutputSyslogTest.java new file mode 100644 index 00000000..1ca28adb --- /dev/null +++ b/splunk/src/test/java/com/splunk/OutputSyslogTest.java @@ -0,0 +1,64 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class OutputSyslogTest extends SDKTestCase { + @Test + public void testOutputSyslog() throws Exception { + EntityCollection<OutputSyslog> dos = service.getOutputSyslogs(); + + if (dos.values().size() == 0) { + System.out.println("WARNING: No OutputSyslogs to test"); + return; + } + + for (OutputSyslog entity : dos.values()) { + // Save + String server = entity.getServer(); + String type = entity.getType(); + + // Probe + { + entity.setServer("1.1.1.1:514"); + //entity.setPriority(); -- can't check + //entity.setTimestampFormat(); -- can't check + String otherType = "tcp"; + if (type.equals("tcp")) + otherType = "udp"; + entity.setType(otherType); + entity.update(); + + // check + Assert.assertEquals("1.1.1.1:514", entity.getServer()); + Assert.assertEquals(otherType, entity.getType()); + } + + // Restore + { + entity.setServer(server); + entity.setType(type); + entity.update(); + + Assert.assertEquals(server, entity.getServer()); + Assert.assertEquals(type, entity.getType()); + } + } + } +} diff --git a/splunk/src/test/java/com/splunk/PasswordTest.java b/splunk/src/test/java/com/splunk/PasswordTest.java new file mode 100644 index 00000000..3d32d393 --- /dev/null +++ b/splunk/src/test/java/com/splunk/PasswordTest.java @@ -0,0 +1,176 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +import java.util.HashMap; + +public class PasswordTest extends SDKTestCase { + @Test + public void testGettersOfDefaultPasswords() { + for (Password password : service.getPasswords().values()) { + testGettersOf(password); + } + } + + private void testGettersOf(Password password) { + password.getClearPassword(); + password.getEncryptedPassword(); + password.getPassword(); + password.getRealm(); + password.getUsername(); + } + + @Test + public void testPasswordCrud() { + PasswordCollection passwords = service.getPasswords(); + + String name = "sdk-test"; + String value = "sdk-test-password"; + String realm = "sdk-test-realm"; + + if (passwords.containsKey(name)) + passwords.remove(name); + Assert.assertFalse(passwords.containsKey(name)); + + Password password; + + // Create a password without realm + password = passwords.create(name, value); + Assert.assertTrue(passwords.containsKey(name)); + Assert.assertEquals(name, password.getUsername()); + Assert.assertEquals(value, password.getClearPassword()); + Assert.assertEquals(null, password.getRealm()); + + // Update the password + password.update(new Args("password", "foobar")); + Assert.assertTrue(passwords.containsKey(name)); + Assert.assertEquals(name, password.getUsername()); + Assert.assertEquals("foobar", password.getClearPassword()); + Assert.assertEquals(null, password.getRealm()); + + passwords.remove(name); + Assert.assertFalse(passwords.containsKey(name)); + + // Create a password with a realm + password = passwords.create(name, value, realm); + Assert.assertTrue(passwords.containsKey(name)); + Assert.assertEquals(name, password.getUsername()); + Assert.assertEquals(value, password.getClearPassword()); + Assert.assertEquals(realm, password.getRealm()); + + // Update the password + password.update(new Args("password", "bizbaz")); + Assert.assertTrue(passwords.containsKey(name)); + Assert.assertEquals(name, password.getUsername()); + Assert.assertEquals("bizbaz", password.getClearPassword()); + Assert.assertEquals(realm, password.getRealm()); + + Assert.assertTrue(password.getEncryptedPassword().length() > 0); + Assert.assertEquals(password.getName(), name); + Assert.assertTrue(password.getPassword().length() > 0); + + password.setPassword("booyah"); + password.update(); + Assert.assertTrue(password.getPassword().length() > 0); + + passwords.remove(name); + Assert.assertFalse(passwords.containsKey(name)); + } + + @Test + public void testPasswordsSameNamesButUniqueRealms() { + PasswordCollection passwords = service.getPasswords(); + + String realmA = "sdk-test-realm-a"; + String realmB = "sdk-test-realm-b"; + String passwordA = "sdk-test-password-a"; + String passwordB = "sdk-test-password-b"; + String username = "sdk-test-username"; + + passwords.create(username, passwordA, realmA); + passwords.create(username, passwordB, realmB); + + Assert.assertEquals(passwordA, passwords.get(realmA, username).getClearPassword()); + Assert.assertEquals(passwordB, passwords.get(realmB, username).getClearPassword()); + + passwords.remove(realmA, username); + passwords.remove(realmB, username); + + Assert.assertNull(passwords.get(realmA, username)); + Assert.assertNull(passwords.get(realmB, username)); + } + + @Test + public void testPasswordsCompatibleGetByName() { + PasswordCollection passwords = service.getPasswords(); + + String realm = "sdk-test-realm-c"; + String password = "sdk-test-password"; + String username = "sdk-test-username"; + + passwords.create(username, password, realm); + Assert.assertEquals(password, passwords.get(username).getClearPassword()); + + passwords.remove(username); + Assert.assertNull(passwords.get(username)); + } + @Test + public void testPasswordsWithWildCards(){ + HashMap<String, Object> args = new HashMap<String, Object>(); + args = Command.defaultValues; + args.put("owner", "-"); + args.put("app", "-"); + args.put("username", "admin"); + args.put("password", "changed!"); + Service service = Service.connect(args); + PasswordCollection passwords = service.getPasswords(); + Assert.assertEquals(passwords.size(),0); + + String name = "no-owner"; + String value = "sdk-test-password"; + String realm = "sdk-test-realm"; + + Password password; + // Create a password + try{ + password = passwords.create(name, value); + }catch(IllegalArgumentException e){ + Assert.assertEquals("While creating StoragePasswords, namespace cannot have wildcards.", e.getMessage()); + } + try{ + password = passwords.create(name, value, realm); + }catch(IllegalArgumentException e){ + Assert.assertEquals("While creating StoragePasswords, namespace cannot have wildcards.", e.getMessage()); + } + // Remove a password + try{ + password = passwords.remove(name); + }catch(IllegalArgumentException e){ + Assert.assertEquals("app context must be specified when removing a password.", e.getMessage()); + } + try{ + password = passwords.remove(realm, name); + }catch(IllegalArgumentException e){ + Assert.assertEquals("app context must be specified when removing a password.", e.getMessage()); + } + passwords = service.getPasswords(); + Assert.assertEquals(passwords.size(),0); + } +} diff --git a/splunk/src/test/java/com/splunk/PivotTest.java b/splunk/src/test/java/com/splunk/PivotTest.java new file mode 100644 index 00000000..6961a8a3 --- /dev/null +++ b/splunk/src/test/java/com/splunk/PivotTest.java @@ -0,0 +1,805 @@ +/* + * Copyright 2014 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ +package com.splunk; + +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; +import com.google.gson.JsonPrimitive; +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + + +public class PivotTest extends SDKTestCase { + DataModelObject dataModelObject; + + @Before + public void setUp() throws Exception { + super.setUp(); + + EntityCollection<DataModel> dataModels = service.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_for_pivot.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + this.dataModelObject = model.getObject("test_data"); + Assert.assertNotNull(dataModelObject); + } + + @After + public void tearDown() throws Exception { + for (DataModel d : service.getDataModels().values()) { + if (d.getName().startsWith("delete-me")) { + d.remove(); + } + } + + super.tearDown(); + } + + @Test + public void testConstructorArgs() { + + PivotSpecification pivotArgs = dataModelObject.createPivotSpecification(); + + JsonObject root = pivotArgs.toJson(); + + Assert.assertTrue(root.has("dataModel")); + Assert.assertEquals(new JsonPrimitive(dataModelObject.getDataModel().getName()), root.get("dataModel")); + + Assert.assertTrue(root.has("baseClass")); + Assert.assertEquals(new JsonPrimitive(dataModelObject.getName()), root.get("baseClass")); + } + + @Test + public void testAccelerationWorks() { + Args serviceArgs = new Args(); + serviceArgs.put("host", service.getHost()); + serviceArgs.put("port", service.getPort()); + serviceArgs.put("scheme", service.getScheme()); + serviceArgs.put("token", service.getToken()); + + serviceArgs.put("owner", "nobody"); + serviceArgs.put("app", "search"); + Service nonprivateService = new Service(serviceArgs); + + EntityCollection<DataModel> dataModels = nonprivateService.getDataModels(); + + DataModelArgs args = new DataModelArgs(); + args.setRawJsonDescription(streamToString(openResource("/data/datamodels/data_model_for_pivot.json"))); + DataModel model = dataModels.create(createTemporaryName(), args); + + dataModelObject = model.getObject("test_data"); + Assert.assertNotNull(dataModelObject); + + model.setAcceleration(true); + model.setEarliestAcceleratedTime("-2mon"); + model.setAccelerationCronSchedule("0 */12 * * *"); + model.update(); + + PivotSpecification pivotArgs = dataModelObject.createPivotSpecification(); + + Assert.assertEquals(dataModelObject.getDataModel().getName(), pivotArgs.getAccelerationNamespace()); + + String sid = createTemporaryName(); + pivotArgs.setAccelerationJob(sid); + Assert.assertEquals("sid="+sid, pivotArgs.getAccelerationNamespace()); + + String namespace = createTemporaryName(); + pivotArgs.setAccelerationNamespace(namespace); + Assert.assertEquals(namespace, pivotArgs.getAccelerationNamespace()); + } + + @Test(expected=IllegalArgumentException.class) + public void testAddFilterOnNonexistantField() { + PivotSpecification pivotArgs = dataModelObject.createPivotSpecification(); + pivotArgs.addFilter(createTemporaryName(), BooleanComparison.EQUALS, true); + } + + @Test(expected=IllegalArgumentException.class) + public void testAddBooleanFilterOnWrongType() { + PivotSpecification pivotSpec = dataModelObject.createPivotSpecification(); + pivotSpec.addFilter("_time", BooleanComparison.EQUALS, true); + } + + @Test + public void testAddBooleanFilter() { + PivotSpecification pivotSpec = dataModelObject.createPivotSpecification(); + pivotSpec.addFilter("has_boris", BooleanComparison.EQUALS, true); + + Assert.assertEquals(1, pivotSpec.getFilters().size()); + for (PivotFilter pf : pivotSpec.getFilters()) { + Assert.assertTrue(pf instanceof BooleanPivotFilter); + JsonElement obj = pf.toJson(); + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("has_boris"), o.get("fieldName")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("boolean"), o.get("type")); + + Assert.assertTrue(o.has("rule")); + JsonObject rule = o.getAsJsonObject("rule"); + + Assert.assertTrue(rule.has("comparator")); + Assert.assertEquals(new JsonPrimitive("="), rule.get("comparator")); + + Assert.assertTrue(rule.has("compareTo")); + Assert.assertEquals(new JsonPrimitive(true), rule.get("compareTo")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddStringFilterOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter("has_boris", StringComparison.CONTAINS, "abc"); + } + + @Test(expected=IllegalArgumentException.class) + public void testAddStringFilteronNonexistantField() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter(createTemporaryName(), StringComparison.CONTAINS, "abc"); + } + + @Test + public void testAddStringFilter() { + PivotSpecification pivotSpec = dataModelObject.createPivotSpecification(); + pivotSpec.addFilter("host", StringComparison.CONTAINS, "abc"); + + Assert.assertEquals(1, pivotSpec.getFilters().size()); + for (PivotFilter pf : pivotSpec.getFilters()) { + Assert.assertTrue(pf instanceof StringPivotFilter); + JsonElement obj = pf.toJson(); + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("host"), o.get("fieldName")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("string"), o.get("type")); + + Assert.assertTrue(o.has("rule")); + JsonObject rule = o.getAsJsonObject("rule"); + + Assert.assertTrue(rule.has("comparator")); + Assert.assertEquals(new JsonPrimitive("contains"), rule.get("comparator")); + + Assert.assertTrue(rule.has("compareTo")); + Assert.assertEquals(new JsonPrimitive("abc"), rule.get("compareTo")); + } + } + + @Test + public void testAddStringFilterAgainstSplunk() { + DataModel dm = (DataModel)service.getDataModels().get("internal_audit_logs"); + DataModelObject dmo = dm.getObject("searches"); + PivotSpecification pivotSpec = dmo.createPivotSpecification(); + + pivotSpec.addCellValue("host", "host_count", StatsFunction.COUNT); + + pivotSpec.addFilter("host", StringComparison.DOES_NOT_CONTAIN, "<$@^*%>"); + pivotSpec.addFilter("host", StringComparison.CONTAINS, "."); + + Pivot p = pivotSpec.pivot(); + final Job j = p.run(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + + @Override + public boolean predicate() { + if (!j.isDone()) { + j.refresh(); + } + return j.isDone(); + } + }); + } + + @Test(expected=IllegalArgumentException.class) + public void testAddIpv4FilterOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter("has_boris", IPv4Comparison.STARTS_WITH, "192.168"); + } + + @Test(expected=IllegalArgumentException.class) + public void testIpv4FilterOnNonexistantField() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter(createTemporaryName(), IPv4Comparison.STARTS_WITH, "192.168"); + } + + @Test + public void testAddIpv4Filter() { + PivotSpecification pivotSpec = dataModelObject.createPivotSpecification(); + pivotSpec.addFilter("hostip", IPv4Comparison.STARTS_WITH, "192.168"); + + Assert.assertEquals(1, pivotSpec.getFilters().size()); + for (PivotFilter pf : pivotSpec.getFilters()) { + Assert.assertTrue(pf instanceof IPv4PivotFilter); + JsonElement obj = pf.toJson(); + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("hostip"), o.get("fieldName")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("ipv4"), o.get("type")); + + Assert.assertTrue(o.has("rule")); + JsonObject rule = o.getAsJsonObject("rule"); + + Assert.assertTrue(rule.has("comparator")); + Assert.assertEquals(new JsonPrimitive("startsWith"), rule.get("comparator")); + + Assert.assertTrue(rule.has("compareTo")); + Assert.assertEquals(new JsonPrimitive("192.168"), rule.get("compareTo")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddNumberFilterOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter("has_boris", NumberComparison.AT_LEAST, 2.3); + } + + @Test(expected=IllegalArgumentException.class) + public void testNumberFilterOnNonexistantField() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter(createTemporaryName(), NumberComparison.AT_LEAST, 2.3); + } + + @Test + public void testAddNumberFilter() { + PivotSpecification pivotSpec = dataModelObject.createPivotSpecification(); + pivotSpec.addFilter("epsilon", NumberComparison.AT_LEAST, 2.3); + + Assert.assertEquals(1, pivotSpec.getFilters().size()); + for (PivotFilter pf : pivotSpec.getFilters()) { + Assert.assertTrue(pf instanceof NumberPivotFilter); + JsonElement obj = pf.toJson(); + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("rule")); + JsonObject rule = o.getAsJsonObject("rule"); + + Assert.assertTrue(rule.has("comparator")); + Assert.assertEquals(new JsonPrimitive(">="), rule.get("comparator")); + + Assert.assertTrue(rule.has("compareTo")); + Assert.assertEquals(new JsonPrimitive((double)2.3), rule.get("compareTo")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddLimitFilterOnNonexistentField() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter("has_boris", "host", + SortDirection.DEFAULT, 50, StatsFunction.COUNT); + } + + @Test + public void testAddLimitFilter() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addFilter("epsilon", "host", SortDirection.ASCENDING, 500, StatsFunction.AVERAGE); + + Assert.assertEquals(1, pivotSpecification.getFilters().size()); + for (PivotFilter pf : pivotSpecification.getFilters()) { + Assert.assertTrue(pf instanceof LimitPivotFilter); + JsonElement obj = pf.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("owner")); + Assert.assertEquals(new JsonPrimitive("test_data"), o.get("owner")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("attributeName")); + Assert.assertEquals(new JsonPrimitive("host"), o.get("attributeName")); + + Assert.assertTrue(o.has("attributeOwner")); + Assert.assertEquals(new JsonPrimitive("BaseEvent"), o.get("attributeOwner")); + + Assert.assertTrue(o.has("limitType")); + Assert.assertEquals(new JsonPrimitive("lowest"), o.get("limitType")); + + Assert.assertTrue(o.has("limitAmount")); + Assert.assertEquals(new JsonPrimitive(500), o.get("limitAmount")); + + Assert.assertTrue(o.has("statsFn")); + Assert.assertEquals(new JsonPrimitive("average"), o.get("statsFn")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddNumericRowSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "My Label"); + } + + @Test + public void testAddNumericRowSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("epsilon", "My Label"); + + Assert.assertEquals(1, pivotSpecification.getRowSplits().size()); + for (PivotRowSplit prs : pivotSpecification.getRowSplits()) { + Assert.assertTrue(prs instanceof NumberPivotRowSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("owner")); + Assert.assertEquals(new JsonPrimitive("test_data"), o.get("owner")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("label")); + Assert.assertEquals(new JsonPrimitive("My Label"), o.get("label")); + + Assert.assertTrue(o.has("display")); + Assert.assertEquals(new JsonPrimitive("all"), o.get("display")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddRangeRowSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "My Label", 0, 100, 20, 5); + } + + @Test + public void testAddRangeRowSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("epsilon", "My Label", 0, 100, 20, 5); + + Assert.assertEquals(1, pivotSpecification.getRowSplits().size()); + for (PivotRowSplit prs : pivotSpecification.getRowSplits()) { + Assert.assertTrue(prs instanceof RangePivotRowSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("owner")); + Assert.assertEquals(new JsonPrimitive("test_data"), o.get("owner")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("label")); + Assert.assertEquals(new JsonPrimitive("My Label"), o.get("label")); + + Assert.assertTrue(o.has("display")); + Assert.assertEquals(new JsonPrimitive("ranges"), o.get("display")); + + JsonObject ranges = new JsonObject(); + ranges.add("start", new JsonPrimitive(0)); + ranges.add("end", new JsonPrimitive(100)); + ranges.add("size", new JsonPrimitive(20)); + ranges.add("maxNumberOf", new JsonPrimitive(5)); + Assert.assertTrue(o.has("ranges")); + Assert.assertEquals(ranges, o.get("ranges")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddBooleanRowSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("epsilon", "My Label", "true", "false"); + } + + @Test + public void testAddBooleanRowSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "My Label", "is_true", "is_false"); + + Assert.assertEquals(1, pivotSpecification.getRowSplits().size()); + for (PivotRowSplit prs : pivotSpecification.getRowSplits()) { + Assert.assertTrue(prs instanceof BooleanPivotRowSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + JsonObject expected = new JsonObject(); + expected.add("fieldName", new JsonPrimitive("has_boris")); + expected.add("label", new JsonPrimitive("My Label")); + expected.add("owner", new JsonPrimitive("test_data")); + expected.addProperty("type", "boolean"); + expected.addProperty("trueLabel", "is_true"); + expected.addProperty("falseLabel", "is_false"); + + Assert.assertEquals(expected, o); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddTimestampRowSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("epsilon", "My Label", "true", "false"); + } + + @Test + public void testAddTimestampRowSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("_time", "My Label", TimestampBinning.DAY); + + Assert.assertEquals(1, pivotSpecification.getRowSplits().size()); + for (PivotRowSplit prs : pivotSpecification.getRowSplits()) { + Assert.assertTrue(prs instanceof TimestampPivotRowSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + JsonObject expected = new JsonObject(); + expected.add("fieldName", new JsonPrimitive("_time")); + expected.add("label", new JsonPrimitive("My Label")); + expected.add("owner", new JsonPrimitive("BaseEvent")); + expected.addProperty("type", "timestamp"); + expected.addProperty("period", "day"); + + Assert.assertEquals(expected, o); + } + } + + @Test + public void testAddStringRowSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("host", "My Label"); + + Assert.assertEquals(1, pivotSpecification.getRowSplits().size()); + for (PivotRowSplit prs : pivotSpecification.getRowSplits()) { + Assert.assertTrue(prs instanceof StringPivotRowSplit); + JsonElement found = prs.toJson(); + + JsonObject expected = new JsonObject(); + expected.addProperty("fieldName", "host"); + expected.addProperty("label", "My Label"); + expected.addProperty("owner", "BaseEvent"); + expected.addProperty("type", "string"); + + Assert.assertEquals(expected, found); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddNumericColumnSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("has_boris"); + } + + @Test + public void testAddNumericColumnSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("epsilon"); + + Assert.assertEquals(1, pivotSpecification.getColumnSplits().size()); + for (PivotColumnSplit prs : pivotSpecification.getColumnSplits()) { + Assert.assertTrue(prs instanceof NumericPivotColumnSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("owner")); + Assert.assertEquals(new JsonPrimitive("test_data"), o.get("owner")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("display")); + Assert.assertEquals(new JsonPrimitive("all"), o.get("display")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddRangeColumnSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("has_boris", 0, 100, 20, 5); + } + + @Test + public void testAddRangeColumnSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("epsilon", 0, 100, 20, 5); + + Assert.assertEquals(1, pivotSpecification.getColumnSplits().size()); + for (PivotColumnSplit prs : pivotSpecification.getColumnSplits()) { + Assert.assertTrue(prs instanceof RangePivotColumnSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + Assert.assertTrue(o.has("fieldName")); + Assert.assertEquals(new JsonPrimitive("epsilon"), o.get("fieldName")); + + Assert.assertTrue(o.has("owner")); + Assert.assertEquals(new JsonPrimitive("test_data"), o.get("owner")); + + Assert.assertTrue(o.has("type")); + Assert.assertEquals(new JsonPrimitive("number"), o.get("type")); + + Assert.assertTrue(o.has("display")); + Assert.assertEquals(new JsonPrimitive("ranges"), o.get("display")); + + JsonObject ranges = new JsonObject(); + ranges.add("start", new JsonPrimitive("0")); + ranges.add("end", new JsonPrimitive("100")); + ranges.add("size", new JsonPrimitive("20")); + ranges.add("maxNumberOf", new JsonPrimitive("5")); + Assert.assertTrue(o.has("ranges")); + Assert.assertEquals(ranges, o.get("ranges")); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddBooleanColumnSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("epsilon", "true", "false"); + } + + @Test + public void testAddBooleanColumnSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("has_boris", "is_true", "is_false"); + + Assert.assertEquals(1, pivotSpecification.getColumnSplits().size()); + for (PivotColumnSplit prs : pivotSpecification.getColumnSplits()) { + Assert.assertTrue(prs instanceof BooleanPivotColumnSplit); + JsonElement obj = prs.toJson(); + + Assert.assertTrue(obj instanceof JsonObject); + JsonObject o = (JsonObject)obj; + + JsonObject expected = new JsonObject(); + expected.add("fieldName", new JsonPrimitive("has_boris")); + expected.add("owner", new JsonPrimitive("test_data")); + expected.addProperty("type", "boolean"); + expected.addProperty("trueLabel", "is_true"); + expected.addProperty("falseLabel", "is_false"); + + Assert.assertEquals(expected, o); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testAddTimestampColumnSplitOnWrongType() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("epsilon", "true", "false"); + } + + @Test + public void testAddTimestampColumnSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("_time", TimestampBinning.DAY); + + Assert.assertEquals(1, pivotSpecification.getColumnSplits().size()); + for (PivotColumnSplit prs : pivotSpecification.getColumnSplits()) { + Assert.assertTrue(prs instanceof TimestampPivotColumnSplit); + JsonObject found = prs.toJson(); + + JsonObject expected = new JsonObject(); + expected.add("fieldName", new JsonPrimitive("_time")); + expected.add("owner", new JsonPrimitive("BaseEvent")); + expected.addProperty("type", "timestamp"); + expected.addProperty("period", "day"); + + Assert.assertEquals(expected, found); + } + } + + @Test + public void testAddStringColumnSplit() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addColumnSplit("host"); + + Assert.assertEquals(1, pivotSpecification.getColumnSplits().size()); + for (PivotColumnSplit prs : pivotSpecification.getColumnSplits()) { + Assert.assertTrue(prs instanceof StringPivotColumnSplit); + JsonObject found = prs.toJson(); + + JsonObject expected = new JsonObject(); + expected.addProperty("fieldName", "host"); + expected.addProperty("owner", "BaseEvent"); + expected.addProperty("type", "string"); + + Assert.assertEquals(expected, found); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testNonexistantFieldToCellValue() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addCellValue("nonexistant", "my_label", StatsFunction.COUNT); + } + + @Test + public void testAddStringCellValue() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addCellValue("source", "Source Value", StatsFunction.DISTINCT_COUNT); + + Assert.assertEquals(1, pivotSpecification.getCellValues().size()); + for (PivotCellValue pcv : pivotSpecification.getCellValues()) { + JsonObject found = pcv.toJson(); + JsonObject expected = new JsonObject(); + expected.addProperty("fieldName", "source"); + expected.addProperty("owner", "BaseEvent"); + expected.addProperty("type", "string"); + expected.addProperty("label", "Source Value"); + expected.addProperty("value", "dc"); + expected.addProperty("sparkline", false); + + Assert.assertEquals(expected, found); + } + } + + @Test + public void testAddIpv4CellValue() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addCellValue("hostip", "Source Value", StatsFunction.DISTINCT_COUNT); + + Assert.assertEquals(1, pivotSpecification.getCellValues().size()); + for (PivotCellValue pcv : pivotSpecification.getCellValues()) { + JsonObject found = pcv.toJson(); + JsonObject expected = new JsonObject(); + expected.addProperty("fieldName", "hostip"); + expected.addProperty("owner", "test_data"); + expected.addProperty("type", "ipv4"); + expected.addProperty("label", "Source Value"); + expected.addProperty("value", "dc"); + expected.addProperty("sparkline", false); + + Assert.assertEquals(expected, found); + } + } + + @Test(expected=IllegalArgumentException.class) + public void testIllegalStatsFunction() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addCellValue("source", "Source Value", StatsFunction.SUM); + + } + + @Test(expected=IllegalArgumentException.class) + public void testNoBooleanCellValues() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addCellValue("has_boris", "Source Value", StatsFunction.DISTINCT_VALUES); + } + + @Test(expected= HttpException.class) + public void testEmptyPivotGivesError() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + Pivot pivot = pivotSpecification.pivot(); + } + + @Test + public void testSimplePivotWithoutNamespace() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "Has Boris", "meep", "hilda"); + pivotSpecification.addCellValue("hostip", "Distinct IPs", StatsFunction.DISTINCT_COUNT); + + + Pivot pivot = pivotSpecification.pivot(); + Assert.assertNull(pivot.getAcceleratedQuery()); + Assert.assertTrue(pivot.getPivotQuery().startsWith("| pivot")); + final Job job = pivot.run(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + Assert.assertTrue(job.getSearch().startsWith("| pivot")); + } + + @Test + public void testSimplePivotWithSparkline() { + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "Has Boris", "meep", "hilda"); + pivotSpecification.addCellValue("hostip", "Distinct IPs", StatsFunction.DISTINCT_COUNT); + + + Pivot pivot = pivotSpecification.pivot(); + Assert.assertNull(pivot.getAcceleratedQuery()); + Assert.assertTrue(pivot.getPivotQuery().startsWith("| pivot")); + final Job job = pivot.run(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + Assert.assertTrue(job.getSearch().startsWith("| pivot")); + } + + @Test + public void testSimplePivotWithNamespace() { + Job adhocJob = dataModelObject.createLocalAccelerationJob(); + PivotSpecification pivotSpecification = dataModelObject.createPivotSpecification(); + pivotSpecification.addRowSplit("has_boris", "Has Boris", "meep", "hilda"); + pivotSpecification.addCellValue("hostip", "Distinct IPs", StatsFunction.DISTINCT_COUNT); + pivotSpecification.setAccelerationJob(adhocJob); + + Pivot pivot = pivotSpecification.pivot(); + Assert.assertNotNull(pivot.getAcceleratedQuery()); + + final Job job = pivot.run(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + + Assert.assertTrue(job.getSearch().startsWith("| tstats")); + adhocJob.cancel(); + } + + @Test + public void testColumnRangeSplit() { + // This test is here because we had a problem with fields that were supposed to be + // numbers being expected as strings in Splunk 6.0. This was fixed in Splunk 6.1, and accepts + // either strings or numbers. + DataModelObject searches = service.getDataModels().get("internal_audit_logs").getObject("searches"); + PivotSpecification pivotSpecification = new PivotSpecification(searches); + pivotSpecification.addRowSplit("user", "Executing user"); + pivotSpecification.addColumnSplit("exec_time", 0, 12, 5, 4); + pivotSpecification.addCellValue("search", "Search Query", StatsFunction.DISTINCT_VALUES); + + Pivot pivot = pivotSpecification.pivot(); + final Job job = pivot.run(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isDone(); + } + }); + + job.cancel(); + + } +} diff --git a/splunk/src/test/java/com/splunk/PortInputTest.java b/splunk/src/test/java/com/splunk/PortInputTest.java new file mode 100644 index 00000000..1db21e68 --- /dev/null +++ b/splunk/src/test/java/com/splunk/PortInputTest.java @@ -0,0 +1,76 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +public class PortInputTest extends InputTest { + private int tcpPort = -1; + private TcpInput tcpInput = null; + + protected int findNextUnusedPort(int startingPort) { + InputCollection inputs = service.getInputs(); + + int port = startingPort; + while (inputs.containsKey(String.valueOf(port))) { + port++; + } + return port; + } + + @Before + public void setUp() throws Exception { + super.setUp(); + + tcpPort = findNextUnusedPort(10000); + while (true) { + try { + tcpInput = service.getInputs().create( + String.valueOf(tcpPort), + InputKind.Tcp, + new Args("index", "main")); + break; + } catch (HttpException he) { + if (he.getStatus() == 400) { + tcpPort += 1; + } + } + } + } + + @After + public void tearDown() throws Exception { + if (tcpInput != null) { + tcpInput.remove(); + } + + super.tearDown(); + } + + @Test(expected=UnsupportedOperationException.class) + public void testRestrictToHostCausesError() { + tcpInput.update(new Args("restrictToHost", "boris")); + } + + @Test + public void testGetPort() { + Assert.assertEquals(tcpPort, tcpInput.getPort()); + } +} diff --git a/splunk/src/test/java/com/splunk/ReceiverTest.java b/splunk/src/test/java/com/splunk/ReceiverTest.java new file mode 100644 index 00000000..e171b9d1 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ReceiverTest.java @@ -0,0 +1,128 @@ + +/* + * Copyright 2015 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; +import org.junit.Assume; + +import java.io.IOException; +import java.io.OutputStream; +import java.net.Socket; +import java.util.HashMap; +import java.util.Map; + +public class ReceiverTest extends SDKTestCase { + + @Test + public void testReceiverWithoutCookie() { + service.removeAllCookies(); + testReceiver(service); + } + + @Test + public void testReceiverWithCookie() { + Assume.assumeTrue(service.versionIsAtLeast("6.2")); + Assert.assertTrue(service.hasSplunkAuthCookies()); + testReceiver(service); + } + + @Test + public void testReceiverWithoutSplunkCookie() { + String validToken = service.getToken(); + Assert.assertTrue(validToken.startsWith("Splunk ")); + String otherCookies = "load=balancer;"; + Map<String, Object> args = new HashMap<>(); + args.put("cookie", otherCookies); + args.put("host",service.getHost()); + args.put("port", service.getPort()); + Service s = new Service(args); + s.setToken(validToken); + s.version = s.getInfo().getVersion(); + System.out.println(s.version); + Assume.assumeTrue(s.versionIsAtLeast("6.2")); + Assert.assertTrue(!s.cookieStore.isEmpty()); + testReceiver(s); + } + + // Make a few simple requests and make sure the results look ok. + public void testReceiver(Service passedService) { + Receiver receiver = passedService.getReceiver(); + + final String indexName = passedService.getIndexes().get("_internal").getDefaultDatabase(); + final Index index = passedService.getIndexes().get(indexName); + final int originalEventCount = index.getTotalEventCount(); + final int versionCompare = passedService.versionCompare("6.0.0"); + final String osName = passedService.getInfo().getOsName(); + + try { + Socket socket1 = receiver.attach(); + OutputStream stream = socket1.getOutputStream(); + + String s = createTimestamp() + " Boris the mad baboon1!\r\n"; + stream.write(s.getBytes("UTF-8")); + // Splunk won't deterministically index these events until the socket is closed or greater than 1MB + // has been written. + stream.close(); + socket1.close(); + } catch (IOException e) { + Assert.fail("Exception on attach"); + } + + try { + Socket socket1 = receiver.attach(Args.create("sourcetype", "mysourcetype")); + OutputStream stream = socket1.getOutputStream(); + + String s = createTimestamp() + " Boris the mad baboon2!\r\n"; + stream.write(s.getBytes("UTF-8")); + // Splunk won't deterministically index these events until the socket is closed or greater than 1MB + // has been written. + stream.close(); + socket1.close(); + } catch (IOException e) { + Assert.fail("Exception on attach"); + } + + receiver.submit("Boris the mad baboon3!\r\n"); + receiver.submit(Args.create("sourcetype", "mysourcetype"), "Boris the mad baboon4!\r\n"); + receiver.log("Boris the mad baboon5!\r\n"); + receiver.log("main", "Boris the mad baboon6!\r\n"); + receiver.log(Args.create("sourcetype", "mysourcetype"), "Boris the mad baboon7!\r\n"); + receiver.log(indexName, Args.create("sourcetype", "mysourcetype"), "Boris the mad baboon8!\r\n"); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { + tries = 200; + } + + @Override + public boolean predicate() { + index.refresh(); + int eventCount = index.getTotalEventCount(); + // WORKAROUND (SPL-75109): Splunk 6.0 on Windows doesn't record events submitted to the streaming + // HTTP input without a sourcetype. + // + if (versionCompare == 0 && osName.equals("Windows")) { + return eventCount == originalEventCount + 7; + } else { + return eventCount == originalEventCount + 8; + } + } + }); + } +} diff --git a/splunk/src/test/java/com/splunk/ResourceRoot.java b/splunk/src/test/java/com/splunk/ResourceRoot.java new file mode 100644 index 00000000..ed1fd512 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ResourceRoot.java @@ -0,0 +1,24 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +/** + * This is a class used solely to get the path to resource like XML and JSON + * files in the test suite in static methods of other classes. + */ +class ResourceRoot { +} diff --git a/splunk/src/test/java/com/splunk/ResultsReaderTest.java b/splunk/src/test/java/com/splunk/ResultsReaderTest.java new file mode 100644 index 00000000..71ebe42d --- /dev/null +++ b/splunk/src/test/java/com/splunk/ResultsReaderTest.java @@ -0,0 +1,493 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +import java.io.IOException; +import java.io.InputStream; +import java.util.*; + +/** + * Test aspects of results readers not covered by the atom, results, and export test data. + * + * Note: some of these tests predate the introduction of the atom, results, and export test + * data, and may overlap with tests in that set. + */ +public class ResultsReaderTest extends SDKTestCase { + @Test + public void testReadCsv() throws Exception { + InputStream input = openResource("/results.csv"); + ResultsReaderCsv reader = new ResultsReaderCsv(input); + + String[] fields = new String[0]; + fields = reader.getFields().toArray(fields); + Assert.assertEquals(2, fields.length); + Assert.assertEquals("sum(kb)", fields[0]); + Assert.assertEquals("series", fields[1]); + + Map<String, String> expected = new HashMap<String, String>(); + + expected.put("series", "twitter"); + expected.put("sum(kb)", "14372242.758775"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd"); + expected.put("sum(kb)", "267802.333926"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd_access"); + expected.put("sum(kb)", "5979.036338"); + assertNextEventEquals(expected, reader); + + Assert.assertNull(reader.getNextEvent()); + reader.close(); + } + + @Test + public void testReadCsvFromOneshot() throws Exception { + InputStream input = service.oneshotSearch( + "search index=_internal | head 1 | stats count", + Args.create("output_mode", "csv")); + ResultsReaderCsv reader = new ResultsReaderCsv(input); + Map<String, String> expected = new HashMap<String, String>(); + + expected.put("count", "1"); + assertNextEventEquals(expected, reader); + + Assert.assertNull(reader.getNextEvent()); + reader.close(); + } + + @Test + public void testReadFromExportJson() throws Exception { + if (service.versionIsEarlierThan("5.0.0")) { + System.out.println("WARNING: Export from Splunk 4.x (or earlier) is not supported by JSON result reader; skipping test."); + return; + } + verifyMultiReader(getExportStreamJson()); + } + + @Test + public void testReadFromExportXml() throws Exception { + verifyMultiReader(getExportStreamXml()); + } + + private void verifyMultiReader( + MultiResultsReader<? extends ResultsReader> reader) + throws Exception { + + SearchResults singleResults = null; + for(SearchResults results : reader) { + singleResults = results; + break; + } + + Event singleEvent = null; + for(Event event : singleResults) { + singleEvent = event; + } + + Assert.assertEquals("1", singleEvent.get("count")); + } + + private MultiResultsReader getExportStreamJson() throws IOException { + return new MultiResultsReaderJson( + service.export( + "search index=_internal | head 1 | stats count", + Args.create("output_mode", "json"))); + } + + private MultiResultsReader getExportStreamXml() throws IOException { + return new MultiResultsReaderXml( + service.export( + "search index=_internal | head 1 | stats count", + Args.create("output_mode", "xml"))); + } + + @Test + public void testReadJsonOnSplunk4() throws Exception { + InputStream input = openResource("/results4.json"); + ResultsReaderJson reader = new ResultsReaderJson(input); + Map<String, String> expected = new HashMap<String, String>(); + + expected.put("series", "twitter"); + expected.put("sum(kb)", "14372242.758775"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd"); + expected.put("sum(kb)", "267802.333926"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd_access"); + expected.put("sum(kb)", "5979.036338"); + assertNextEventEquals(expected, reader); + + Assert.assertNull(reader.getNextEvent()); + reader.close(); + } + + @Test + public void testReadJsonOnSplunk5() throws Exception { + // Splunk 5.0 uses a different format for JSON results + // from Splunk 4.3. + InputStream input = openResource("/results5.json"); + ResultsReaderJson reader = new ResultsReaderJson(input); + Map<String, String> expected = new HashMap<String, String>(); + + expected.put("series", "twitter"); + expected.put("sum(kb)", "14372242.758775"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd"); + expected.put("sum(kb)", "267802.333926"); + assertNextEventEquals(expected, reader); + + expected.put("series", "splunkd_access"); + expected.put("sum(kb)", "5979.036338"); + assertNextEventEquals(expected, reader); + + Assert.assertNull(reader.getNextEvent()); + reader.close(); + } + + public void testReadMultivalueCsvJson() throws IOException { + // These results were generated from "search index=_internal | head 1", + // with the output formats {xml, csv, json}. + String search = "search index=_internal | head 1"; + + testReadMultivalue( + ResultsReaderXml.class, "/resultsMV.xml"); + testReadMultivalue( + ResultsReaderCsv.class, "/resultsMV.csv"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMV4.json"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMV5.json"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMVFuture.json", ","); + + testReadMultivalue( + ResultsReaderXml.class, "/resultsMVOneshot.xml"); + testReadMultivalue( + ResultsReaderCsv.class, "/resultsMVOneshot.csv"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMVOneshot4.json"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMVOneshot5.json"); + testReadMultivalue( + ResultsReaderJson.class, "/resultsMVOneshotFuture.json", ","); + + testReadMultivalue( + ResultsReaderXml.class, "splunk_search:blocking/xml/" + search); + testReadMultivalue( + ResultsReaderCsv.class, "splunk_search:blocking/csv/" + search); + testReadMultivalue( + ResultsReaderJson.class, "splunk_search:blocking/json/" + search); + + testReadMultivalue( + ResultsReaderXml.class, "splunk_search:oneshot/xml/" + search); + testReadMultivalue( + ResultsReaderCsv.class, "splunk_search:oneshot/csv/" + search); + testReadMultivalue( + ResultsReaderJson.class, "splunk_search:oneshot/json/" + search); + } + + private void testReadMultivalue( + Class<? extends ResultsReader> type, + String filename) throws IOException { + + // For our particular test data, the multi-value delimiter + // for the "_si" field (which is being checked) is a newline + // for those ResultsReaders that care about delimiters. + String delimiter = (type == ResultsReaderXml.class) ? "," : "\n"; + + testReadMultivalue(type, filename, delimiter); + } + + private void testReadMultivalue( + Class<? extends ResultsReader> type, + String filename, + String delimiter) throws IOException { + + // Test legacy getNextEvent() interface on 2-valued and 1-valued fields + { + ResultsReader reader = createResultsReader(type, openResource(filename)); + + Event firstResult = reader.getNextEvent(); + { + String[] si = firstResult.getArray("_si", delimiter); + //String[] siArray = siDelimited.split(Pattern.quote(delimiter)); + Assert.assertEquals(2, si.length); + // (siArray[0] should be the locally-determined hostname of + // splunkd, but there is no good way to test this + // consistently.) + Assert.assertEquals("_internal", si[1]); + } + Assert.assertEquals("_internal", firstResult.get("index")); + + Assert.assertNull("Expected exactly one result.", reader.getNextEvent()); + reader.close(); + } + + // Test new getNextEvent() interface on 2-valued and 1-valued fields + { + ResultsReader reader = createResultsReader(type, openResource(filename)); + + Event firstResult = reader.getNextEvent(); + { + String[] siArray = firstResult.getArray("_si", delimiter); + Assert.assertEquals(2, siArray.length); + // (siArray[0] should be the locally-determined hostname of + // splunkd, but there is no good way to test this + // consistently.) + Assert.assertEquals("_internal", siArray[1]); + } + Assert.assertEquals( + new String[] {"_internal"}, + firstResult.getArray("index", delimiter)); + + Assert.assertNull("Expected exactly one result.", reader.getNextEvent()); + reader.close(); + } + } + + private static ResultsReader createResultsReader( + Class<? extends ResultsReader> type, InputStream input) { + + try { + return type.getConstructor(InputStream.class).newInstance(input); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + @Test + public void testEventIsReadOnly() { + Event event = new Event(); + + try { + event.clear(); + Assert.fail("Expected UnsupportedOperationException."); + } + catch (UnsupportedOperationException e) { + // Good + } + + try { + event.clone(); + Assert.fail("Expected UnsupportedOperationException."); + } + catch (UnsupportedOperationException e) { + // Good + } + + try { + event.put(null, null); + Assert.fail("Expected UnsupportedOperationException."); + } + catch (UnsupportedOperationException e) { + // Good + } + + try { + event.putAll(null); + Assert.fail("Expected UnsupportedOperationException."); + } + catch (UnsupportedOperationException e) { + // Good + } + + try { + event.remove(null); + Assert.fail("Expected UnsupportedOperationException."); + } + catch (UnsupportedOperationException e) { + // Good + } + } + + @Test + public void testPreviewSingleReaderXmlIter() throws Exception { + testPreviewSingleReaderXml(true); + } + + @Test + public void testPreviewSingleReaderXmlGetNext() throws Exception { + testPreviewSingleReaderXml(false); + } + + private void testPreviewSingleReaderXml(boolean useIter) throws Exception { + ResultsReaderXml reader = new ResultsReaderXml( + openResource("/resultsPreview.xml")); + + Assert.assertTrue(reader.isPreview()); + + String[] fieldNameArray = new String[0]; + fieldNameArray = reader.getFields().toArray(fieldNameArray); + Assert.assertEquals(101, fieldNameArray.length); + Assert.assertEquals(fieldNameArray[99], "useragent"); + + int index = 0; + Event lastEvent = null; + if (useIter){ + for (Event event : reader) { + lastEvent = event; + index ++; + } + } else { + Event event; + while ((event = reader.getNextEvent()) != null) { + lastEvent = event; + index ++; + } + } + Assert.assertEquals("1355946614", lastEvent.get("_indextime")); + Assert.assertEquals(10, index); + + reader.close(); + } + + final String resultsExportXml = "/resultsExport.xml"; + + @Test + public void testExportSingleReaderXml() throws Exception { + testExportSingleReader( + new ResultsReaderXml( + getExportResultsStream(resultsExportXml))); + } + + @Test + public void testExportMultiReaderXml() throws Exception { + testExportMultiReader( + new MultiResultsReaderXml( + getExportResultsStream(resultsExportXml)), + 18); + } + + final String resultsExportJson = "/resultsExport.json"; + + @Test + public void testExportSingleReaderJson() throws Exception { + testExportSingleReader( + new ResultsReaderJson( + getExportResultsStream(resultsExportJson))); + } + + @Test + public void testExportMultiReaderJson() throws Exception { + ExportResultsStream stream = getExportResultsStream(resultsExportJson); + MultiResultsReaderJson multiReader = new MultiResultsReaderJson(stream); + testExportMultiReader(multiReader, 15); + } + + private ExportResultsStream getExportResultsStream(String fileName) { + return new ExportResultsStream( + openResource(fileName)); + } + + private void testExportSingleReader( + ResultsReader reader) + throws Exception{ + + int indexEvent = 0; + for (Event event : reader){ + if (indexEvent == 0) { + Assert.assertEquals("172.16.35.130", event.get("host")); + Assert.assertEquals("16", event.get("count")); + } + + if (indexEvent == 4) { + Assert.assertEquals("three.four.com", event.get("host")); + Assert.assertEquals("35994", event.get( "count")); + } + + indexEvent++; + } + + Assert.assertEquals(5, indexEvent); + + reader.close(); + } + + private void testExportMultiReader( + MultiResultsReader<? extends ResultsReader> multiReader, + int countResultSet) + throws Exception{ + int indexResultSet = 0; + SearchResults firstResults = null; + for(SearchResults results : multiReader) { + if (firstResults == null) + firstResults = results; + + if (indexResultSet == countResultSet -1) { + Assert.assertFalse(results.isPreview()); + } + + int indexEvent = 0; + for (Event event : results) { + if (indexResultSet == 1 && indexEvent == 1) { + Assert.assertEquals("andy-pc", event.get("host")); + Assert.assertEquals("3", event.get("count")); + } + + if (indexResultSet == countResultSet - 2 && indexEvent == 3) { + Assert.assertEquals("andy-pc", event.get("host")); + Assert.assertEquals("135", event.get( "count")); + } + + indexEvent++; + } + + switch (indexResultSet) { + case 0: + Assert.assertEquals(indexEvent, 1); + break; + case 1: + Assert.assertEquals(indexEvent, 3); + break; + default: + Assert.assertEquals(indexEvent, 5); + break; + } + indexResultSet++; + } + + Assert.assertEquals(indexResultSet, countResultSet); + + // firstResults should be empty since the multi-reader has passed it + // and there should be no exception. + int count = 0; + for (Event eventL : firstResults) { + count++; + } + Assert.assertEquals(0, count); + + multiReader.close(); + } + + // === Utility === + + private void assertNextEventEquals( + Map<String, String> expected, + ResultsReader reader) throws IOException { + + Assert.assertEquals(expected, reader.getNextEvent()); + expected.clear(); + } +} diff --git a/splunk/src/test/java/com/splunk/ResultsReaderTestFromExpectedFile.java b/splunk/src/test/java/com/splunk/ResultsReaderTestFromExpectedFile.java new file mode 100644 index 00000000..ecfa0d14 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ResultsReaderTestFromExpectedFile.java @@ -0,0 +1,181 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import com.google.gson.Gson; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; +import org.w3c.dom.Document; +import org.xml.sax.InputSource; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.stream.*; +import javax.xml.transform.Transformer; +import javax.xml.transform.TransformerFactory; +import javax.xml.transform.dom.DOMSource; +import javax.xml.transform.stream.StreamResult; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.StringReader; +import java.io.StringWriter; +import java.util.*; + +import static junit.framework.TestCase.*; + +/** + * Test the parsing of XML from results endpoints. + * + * All the raw XML to parse is in the data/results/ directory, and the expected + * behavior is specified in the data/resultsreader_test_data.json file. + */ +@RunWith(Parameterized.class) +public class ResultsReaderTestFromExpectedFile { + private static Gson reader = new Gson(); + private static Map<String, Object> expectedData = + reader.fromJson( + SDKTestCase.streamToString( + SDKTestCase.openResource( + "/data/resultsreader_test_data.json")), + Map.class); + + private Map<String, Object> expectedResultsSet; + private String version; + private String testName; + private InputStream xmlStream; + + public ResultsReaderTestFromExpectedFile(String version, String testName) { + this.version = version; + this.testName = testName; + this.xmlStream = SDKTestCase.openResource( + "/data/results/" + version + "/" + testName + ".xml"); + Map<String, Object> versionData = + (Map<String, Object>)expectedData.get(version); + this.expectedResultsSet = + (Map<String, Object>)versionData.get(testName); + } + + @Parameterized.Parameters(name="{1} from version {0}") + public static Collection<Object[]> testCases() { + Collection<Object[]> cases = new ArrayList<Object[]>(); + for (String version : (Set<String>)expectedData.keySet()) { + Map<String, Object> casesForThisVersion = + (Map<String, Object>)expectedData.get(version); + for (String testName : (Set<String>)casesForThisVersion.keySet()) { + cases.add(new Object[] {version, testName}); + } + } + return cases; + } + + @Test + public void testResultsReader() throws IOException, XMLStreamException { + // TODO: This test fails on Windows due to XML attributes being out of order + ResultsReaderXml resultsReader = new ResultsReaderXml(this.xmlStream); + List<Map<String, Object>> expectedEvents = + (List<Map<String, Object>>)this.expectedResultsSet.get("results"); + verifyResultsReader(resultsReader, expectedEvents); + } + + static String xmlToString(String originalXml) throws Exception + { + DocumentBuilderFactory fctr = DocumentBuilderFactory.newInstance(); + DocumentBuilder bldr = fctr.newDocumentBuilder(); + InputSource insrc = new InputSource(new StringReader(originalXml)); + Document xml = bldr.parse(insrc); + xml.normalize(); + + DOMSource domSource = new DOMSource(xml); + StringWriter writer = new StringWriter(); + StreamResult result = new StreamResult(writer); + TransformerFactory tf = TransformerFactory.newInstance(); + Transformer transformer = tf.newTransformer(); + transformer.transform(domSource, result); + + return writer.toString(); + } + + static void verifyResultsReader( + ResultsReaderXml resultsReader, + List<Map<String, Object>> expectedEvents) + throws IOException, XMLStreamException { + for (Map<String, Object> expectedEvent : expectedEvents) { + Event foundEvent = resultsReader.getNextEvent(); + assertNotNull( + "Did not parse as many events from the XML as expected.", + foundEvent); + if (foundEvent.containsKey("_raw")) { + final String segmentedRaw = foundEvent.getSegmentedRaw(); + final String keySegmentedRaw = "RAW_XML"; + try { + final String parsedExpected = xmlToString((String)expectedEvent.get(keySegmentedRaw)); + final String parsedReceived = xmlToString(segmentedRaw); + assertEquals(parsedExpected, parsedReceived); + } catch (Exception e) { + // TODO Auto-generated catch block + assertFalse(true); + } + verifyXml(segmentedRaw); + } + Map<String, Object> expectedFields = + (Map<String,Object>)expectedEvent.get("fields"); + Set<String> expectedKeys = expectedFields.keySet(); + assertEquals(expectedKeys, foundEvent.keySet()); + for (String key : expectedFields.keySet()) { + assertTrue(foundEvent.containsKey(key)); + if (expectedFields.get(key) instanceof List) { + assertEquals( + expectedFields.get(key), + Arrays.asList(foundEvent.getArray(key))); + } else { + assertEquals(expectedFields.get(key), foundEvent.get(key)); + } + } + } + assertNull(resultsReader.getNextEvent()); + } + + // Verify XML by round-tripping. + static private void verifyXml(String xml) + throws XMLStreamException, IOException { + ByteArrayInputStream byteArrayInputStream = + new ByteArrayInputStream(xml.getBytes()); + XMLEventReader reader = XMLInputFactory.newInstance(). + createXMLEventReader(byteArrayInputStream); + + ByteArrayOutputStream byteArrayOutputStream = + new ByteArrayOutputStream(); + XMLEventWriter writer = XMLOutputFactory.newInstance(). + createXMLEventWriter(byteArrayOutputStream); + writer.add(reader); + writer.close(); + + String xmlWithDtd = byteArrayOutputStream.toString(); + int lengthOfDtd = xmlWithDtd.indexOf(">") + 1; + String dtd = xmlWithDtd.substring(0, lengthOfDtd); + assertTrue("Expected xml to have a DTD", dtd.startsWith("<?")); + // Remove the XML DTD + String xmlWithoutDtd = xmlWithDtd.substring(lengthOfDtd); + + assertEquals(xml, xmlWithoutDtd); + byteArrayInputStream.close(); + } +} diff --git a/splunk/src/test/java/com/splunk/RoleTest.java b/splunk/src/test/java/com/splunk/RoleTest.java new file mode 100644 index 00000000..f6a1f4f8 --- /dev/null +++ b/splunk/src/test/java/com/splunk/RoleTest.java @@ -0,0 +1,116 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import java.util.Arrays; +import java.util.List; + +import org.junit.Assert; +import org.junit.Test; + +public class RoleTest extends SDKTestCase { + @Test + public void testSymmetricAccessors() { + Role role = service.getRoles().create(createTemporaryName()); + try { + role.setCapabilities(new String[] { "admin_all_objects" }); + role.setDefaultApp("search"); + role.setImportedRoles(new String[] { "user" }); + role.setSearchDiskQuota(9000); + role.setSearchFilter("*"); + role.setSearchIndexesAllowed(new String[] { "*" }); + role.setSearchIndexesDefault(new String[] { "main", "_internal" }); + role.setSearchJobsQuota(49); + + role.setRealTimeSearchJobsQuota(99); + role.setSearchTimeWindow(99); + + role.update(); + role.refresh(); + + Assert.assertEquals(new String[] { "admin_all_objects" }, role.getCapabilities()); + Assert.assertEquals("search", role.getDefaultApp()); + Assert.assertArrayEquals(new String[]{"user"}, role.getImportedRoles()); + Assert.assertEquals(9000, role.getSearchDiskQuota()); + Assert.assertEquals("*", role.getSearchFilter()); + Assert.assertArrayEquals(new String[]{"*"}, role.getSearchIndexesAllowed()); + List<String> defaultIndexes = Arrays.asList(role.getSearchIndexesDefault()); + Assert.assertEquals(2, defaultIndexes.size()); + Assert.assertTrue(defaultIndexes.contains("main")); + Assert.assertTrue(defaultIndexes.contains("_internal")); + Assert.assertEquals(49, role.getSearchJobsQuota()); + + Assert.assertEquals(99, role.getRealTimeSearchJobsQuota()); + Assert.assertEquals(99, role.getSearchTimeWindow()); + } + finally { + role.remove(); + } + } + + @Test + public void testArrayPromotingSetters() { + Role role = service.getRoles().create(createTemporaryName()); + try { + role.setCapabilities("admin_all_objects"); + role.setImportedRoles("user"); + role.setSearchIndexesAllowed("*"); + role.setSearchIndexesDefault("main"); + + role.update(); + role.refresh(); + + Assert.assertArrayEquals(new String[] { "admin_all_objects" }, role.getCapabilities()); + Assert.assertArrayEquals(new String[] { "user" }, role.getImportedRoles()); + Assert.assertArrayEquals(new String[] { "*" }, role.getSearchIndexesAllowed()); + Assert.assertArrayEquals(new String[] { "main" }, role.getSearchIndexesDefault()); + } + finally { + role.remove(); + } + } + + @Test + public void testUnpairedImportedGetters() { + Role role = service.getRoles().create(createTemporaryName()); + try { + role.setImportedRoles("user"); + + role.update(); + role.refresh(); + + /* + * NOTE: These expected values probably come from the "user" role. + * If the default values of the "user" role change in the + * future, this test should be rewritten to lookup the values + * from the "user" role to determine the expected values here. + */ + Assert.assertTrue(Arrays.asList(role.getImportedCapabilities()).contains( + "change_own_password")); + Assert.assertEquals(6, role.getImportedRealTimeSearchJobsQuota()); + Assert.assertEquals(100, role.getImportedSearchDiskQuota()); + Assert.assertEquals(null, role.getImportedSearchFilter()); + Assert.assertArrayEquals(new String[] { "*" }, role.getImportedIndexesAllowed()); + Assert.assertArrayEquals(new String[] { "main" }, role.getImportedIndexesDefault()); + Assert.assertEquals(3, role.getImportedSearchJobsQuota()); + Assert.assertEquals(-1, role.getImportedSearchTimeWindow()); + } + finally { + role.remove(); + } + } +} diff --git a/splunk/src/test/java/com/splunk/SDKTestCase.java b/splunk/src/test/java/com/splunk/SDKTestCase.java new file mode 100644 index 00000000..c2c623fa --- /dev/null +++ b/splunk/src/test/java/com/splunk/SDKTestCase.java @@ -0,0 +1,433 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.BeforeClass; + +import java.io.*; +import java.net.InetSocketAddress; +import java.net.Socket; +import java.net.SocketTimeoutException; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.*; + + +/** + * Base test case for SDK test suite. + * + * TestCase does the following actions in the various test contexts: + * + * @@Before: + * - Read ~/.splunkrc to get host, port, user, and password to connect with. + * - Create a Service object connected to the Splunk instance. + * + * @@After: + * - Logout the Service object. + */ +public abstract class SDKTestCase { + protected static final boolean WORKAROUND_KNOWN_BUGS = true; + private static final boolean VERBOSE_PORT_SCAN = false; + + protected static Service service; + protected List<String> installedApps; + + protected Command command; + + public static String streamToString(java.io.InputStream is) { + Reader r = null; + try { + r = new InputStreamReader(is, "UTF-8"); + } catch (UnsupportedEncodingException e) { + throw new RuntimeException("Your JVM does not support UTF-8!"); + } + StringBuffer sb = new StringBuffer(); + int ch; + try { + while ((ch = r.read()) != -1) { + sb.append((char)ch); + } + } catch (IOException ioex) { + throw new RuntimeException(ioex.getMessage()); + } + return sb.toString(); + } + + public void connect() { + if (service != null) { + service.login(service.username, service.password); + } else { + service = Service.connect(command.opts); + } + } + + public static Integer getJavaVersion() { + String version = System.getProperty("java.version"); + if (version.startsWith("1.")) { + version = version.substring(2, 3); + } else { + int dot = version.indexOf("."); + if (dot != -1) { + version = version.substring(0, dot); + } + } + return Integer.parseInt(version); + } + + @BeforeClass + public static void preClassLoadActions() { + // Bypass the certification validation here. + HttpService.setValidateCertificates(false); + } + + @Before + public void setUp() throws Exception { + // If using Charles Proxy for debugging, uncomment these lines. + //System.setProperty("https.proxyHost", "127.0.0.1"); + //System.setProperty("https.proxyPort", "8888"); + + HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2); + + command = Command.splunk(); + connect(); + if (restartRequired()) { + System.out.println( + "WARNING: Splunk was already in a state requiring a " + + "restart prior to running this test. Trying to recover..."); + splunkRestart(); + System.out.println("Restart complete."); + } + installedApps = new ArrayList<String>(); + } + + @After + public void tearDown() throws Exception { + if (restartRequired()) { + Assert.fail("Test left Splunk in a state that required restart."); + } + + // Cannot delete applications in Splunk 4.2. + if (service.versionIsAtLeast("4.3")) { + // We delete the apps we installed for capabilities after checking + // for restarts that might be required, since deleting an app + // triggers a restart (but one that we can safely ignore). + for (String applicationName : installedApps) { + try { + service.getApplications().remove(applicationName); + } catch (HttpException e) { + // WORKAROUND (SPL-75224): Under Splunk 6.0 on Windows, deleting apps sometimes fails with + // the message "Operation completed successfully." The app is actually deleted, but it will + // cause tests to fail. + if (service.versionCompare("6.0.0") == 0 && e.getStatus() != 500) { + throw e; + } + } + clearRestartMessage(); + } + } + } + + // === Temporary Names === + + protected static String createTimestamp() { + DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd-HH:mm:ss"); + return dateFormat.format(new Date()); + } + + protected static String createTemporaryName() { + return "delete-me-" + UUID.randomUUID().toString(); + } + + public static InputStream openResource(String path) { + if (path.startsWith("splunk_search:")) { + path = path.substring("splunk_search:".length()); + + String[] pathComponents = path.split("/"); + String searchType = pathComponents[0]; + String outputMode = pathComponents[1]; + String search = pathComponents[2]; + + Args resultsArgs = new Args("output_mode", outputMode); + if (searchType.equals("blocking")) { + Job job = service.getJobs().create( + search, + new Args("exec_mode", "blocking")); + return job.getResults(resultsArgs); + } + else if (searchType.equals("oneshot")) { + return service.oneshotSearch(search, resultsArgs); + } + else { + throw new IllegalArgumentException( + "Unrecognized search type: " + searchType); + } + } + + InputStream input = ResourceRoot.class.getResourceAsStream(path); + Assert.assertNotNull("Could not open " + path, input); + return input; + } + + // === Asserts === + + public static abstract class EventuallyTrueBehavior { + public int tries; + public int pauseTime; + + { + tries = 10; + pauseTime = 1000; + } + + public String timeoutMessage = "Test timed out before true."; + public abstract boolean predicate(); + } + + public static boolean assertEventuallyTrue(EventuallyTrueBehavior behavior) { + int remainingTries = behavior.tries; + while (remainingTries > 0) { + boolean succeeded = behavior.predicate(); + if (succeeded) { + return true; + } else { + remainingTries -= 1; + try { + Thread.sleep(behavior.pauseTime); + } catch (InterruptedException e) {} + } + } + Assert.fail(behavior.timeoutMessage); + return false; + } + + // === Test Data Installation === + + public boolean hasTestData() { + String collectionName = "sdkappcollection"; + return service.getApplications().containsKey("sdkappcollection"); + } + + public void installApplicationFromTestData(String applicationName) { + String collectionName = "sdkappcollection"; + if (!service.getApplications().containsKey("sdkappcollection")) { + throw new TestDataNotInstalledException(); + } + + String splunkHome = service.getSettings().getSplunkHome(); + + // This is the filename separator sequence for splunkd, not + // the Splunk SDK. Therefore we can't just use File.separator here. + String separator; + if (splunkHome.contains("/") && splunkHome.contains("\\")) { + // Windows - allows mixed paths + separator = "\\"; + } else if (splunkHome.contains("/")) { + // Unix or Mac OS X + separator = "/"; + } else if (splunkHome.contains("\\")) { + // Windows + separator = "\\"; + } else { + throw new RuntimeException( + "Couldn't determine what the path separator was " + + "for splunkd."); + } + + String[] pathComponents = {splunkHome, "etc", "apps", + collectionName, "build", applicationName + ".tar"}; + String appPath = Util.join(separator, pathComponents); + + Args args = new Args(); + + args.put("name", appPath); + args.put("filename", true); + args.put("update", true); + + service.post("apps/local", args); + + installedApps.add(applicationName); + } + + // === Restarts === + + public void clearRestartMessage() { + final MessageCollection messages = service.getMessages(); + if (messages.containsKey("restart_required")) { + messages.remove("restart_required"); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override public boolean predicate() { + messages.refresh(); + return !messages.containsKey("restart_required"); + } + }); + } + } + + public boolean restartRequired() { + for (Message message : service.getMessages().values()) { + if (message.containsKey("restart_required")) { + return true; + } + } + return false; + } + + private void markAsRestartRequired() { + service.getMessages().create( + "restart_required", + "Unit test called markAsRestartRequired()."); + } + + public void splunkRestart() { + if (!restartRequired()) { + Assert.fail("Asked to restart Splunk when no restart was required."); + } + uncheckedSplunkRestart(); + } + + public void uncheckedSplunkRestart() { + ResponseMessage response = service.restart(); + if (response.getStatus() != 200) { + Assert.fail("Restart command failed: " + response.getContent()); + } + + // (This status will be cleared when Splunk actually restarts.) + markAsRestartRequired(); + + // Wait for splunkd to come back up fresh. + // (And update 'service'.) + assertEventuallyTrue(new EventuallyTrueBehavior() { + { + tries = 120; + pauseTime = 1000; + } + + @Override + public boolean predicate() { + try { + connect(); + return !restartRequired(); + } catch (Exception e) { + return false; + } + } + }); + } + + // === Misc === + + protected static void sleep(int milliseconds) { + try { + Thread.sleep(milliseconds); + } + catch (InterruptedException e) {} + } + + protected int findNextUnusedPort(int startingPort) { + int port = startingPort; + while (isPortInUse(port)) { + port++; + } + return port; + } + + public boolean isPortInUse(int port) { + try { + Socket pingSocket = new Socket(); + // On Windows, the firewall doesn't respond at all if you connect to an unbound port, so we need to + // take lack of a connection as an empty port. Timeout is 1000ms. + try { + pingSocket.connect(new InetSocketAddress(service.getHost(), port), 1000); + } catch (SocketTimeoutException ste) { + return false; + } + pingSocket.close(); + if (VERBOSE_PORT_SCAN) { + System.out.println("IN-USE(" + port + ")"); + } + return true; + } catch (IOException e) { + if (VERBOSE_PORT_SCAN) { + System.out.println("OPEN(" + port + "): " + e.getMessage()); + } + return false; + } + } + + protected static boolean contains(String[] array, String value) { + return Arrays.asList(array).contains(value); + } + + protected static void assertEquals(String[] a1, String[] a2) { + Assert.assertArrayEquals(a1, a2); + } + + protected static String locateSystemLog() { + String filename = null; + String osName = service.getInfo().getOsName(); + if (osName.equals("Windows")) + filename = "C:\\Windows\\WindowsUpdate.log"; + else if (osName.equals("Linux")) { + filename = "/etc/hosts"; + } + else if (osName.equals("Darwin")) { + filename = "/var/log/system.log"; + } else { + throw new RuntimeException("OS " + osName + " not recognized"); + } + + Assert.assertNotNull(filename); + return filename; + } + + protected static String joinServerPath(String[] components) { + String separator; + String osName = service.getInfo().getOsName(); + if (osName.equals("Windows")) + separator = "\\"; + else if (osName.equals("Linux")) + separator = "/"; + else if (osName.equals("Darwin")) { + separator = "/"; + } else { + throw new RuntimeException("OS " + osName + " not recognized"); + } + + return Util.join(separator, components); + } + + protected boolean firstLineIsXmlDtd(InputStream stream) { + InputStreamReader reader; + try { + reader = new InputStreamReader(stream, "UTF-8"); + } catch (UnsupportedEncodingException e) { + throw new Error(e); + } + BufferedReader lineReader = new BufferedReader(reader); + try { + return "<?xml version=\"1.0\" encoding=\"UTF-8\"?>".equals( + lineReader.readLine() + ); + } catch (IOException e) { + Assert.fail(e.toString()); + return false; + } + } +} diff --git a/splunk/src/test/java/com/splunk/SavedSearchTest.java b/splunk/src/test/java/com/splunk/SavedSearchTest.java new file mode 100644 index 00000000..e62a6294 --- /dev/null +++ b/splunk/src/test/java/com/splunk/SavedSearchTest.java @@ -0,0 +1,496 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +import java.util.HashMap; + +public class SavedSearchTest extends SDKTestCase { + SavedSearchCollection savedSearches; + String savedSearchName; + SavedSearch savedSearch; + String query = "search index=_internal * earliest=-1m | head 3"; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + + Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_1); + + savedSearchName = createTemporaryName(); + savedSearches = service.getSavedSearches(); + savedSearch = savedSearches.create(savedSearchName, query); + + savedSearches.refresh(); + Assert.assertTrue(savedSearches.containsKey(savedSearchName)); + } + + @After + @Override + public void tearDown() throws Exception { + // Remove this run's saved search. + for (Job j : savedSearch.history()) { + j.cancel(); + } + savedSearch.remove(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + savedSearches.refresh(); + return !savedSearches.containsKey(savedSearchName); + } + }); + + // Remove any previously created saved searches that + // somehow escaped. + for (SavedSearch s : savedSearches.values()) { + if (s.getName().startsWith("delete-me")) { + for (Job j : s.history()) { + j.cancel(); + } + s.remove(); + } + } + + super.tearDown(); + } + + @SuppressWarnings("deprecation") + @Test + public void testUpdate() { + boolean isVisible = savedSearch.isVisible(); + savedSearch.setIsVisible(!isVisible); + + savedSearch.setActionEmailAuthPassword("sdk-password"); + savedSearch.setActionEmailAuthUsername("sdk-username"); + savedSearch.setActionEmailBcc("sdk-bcc@splunk.com"); + savedSearch.setActionEmailCc("sdk-cc@splunk.com"); + savedSearch.setActionEmailCommand("$name1$"); + savedSearch.setActionEmailFormat("text"); + savedSearch.setActionEmailFrom("sdk@splunk.com"); + savedSearch.setActionEmailHostname("dummy1.host.com"); + savedSearch.setActionEmailInline(true); + savedSearch.setActionEmailMailServer("splunk.com"); + savedSearch.setActionEmailMaxResults(101); + savedSearch.setActionEmailMaxTime("10s"); + savedSearch.setActionEmailPdfView("dummy"); + savedSearch.setActionEmailPreProcessResults("*"); + savedSearch.setActionEmailReportPaperOrientation("landscape"); + savedSearch.setActionEmailReportPaperSize("letter"); + savedSearch.setActionEmailReportServerEnabled(false); + savedSearch.setActionEmailReportServerUrl("splunk.com"); + savedSearch.setActionEmailSendPdf(false); + savedSearch.setActionEmailSendResults(false); + savedSearch.setActionEmailSubject("sdk-subject"); + savedSearch.setActionEmailTo("sdk-to@splunk.com"); + savedSearch.setActionEmailTrackAlert(false); + savedSearch.setActionEmailTtl("61"); + savedSearch.setActionEmailUseSsl(false); + savedSearch.setActionEmailUseTls(false); + savedSearch.setActionEmailWidthSortColumns(false); + savedSearch.setActionPopulateLookupCommand("$name2$"); + savedSearch.setActionPopulateLookupDest("dummypath"); + savedSearch.setActionPopulateLookupHostname("dummy2.host.com"); + savedSearch.setActionPopulateLookupMaxResults(102); + savedSearch.setActionPopulateLookupMaxTime("20s"); + savedSearch.setActionPopulateLookupTrackAlert(false); + savedSearch.setActionPopulateLookupTtl("62"); + savedSearch.setActionRssCommand("$name3$"); + savedSearch.setActionRssHostname("dummy3.host.com"); + savedSearch.setActionRssMaxResults(103); + savedSearch.setActionRssMaxTime("30s"); + savedSearch.setActionRssTrackAlert(false); + savedSearch.setActionRssTtl("63"); + savedSearch.setActionScriptFilename("foo.sh"); + savedSearch.setActionScriptCommand("$name4$"); + savedSearch.setActionScriptHostname("dummy4.host.com"); + savedSearch.setActionScriptMaxResults(104); + savedSearch.setActionScriptMaxTime("40s"); + savedSearch.setActionScriptTrackAlert(false); + savedSearch.setActionScriptTtl("64"); + savedSearch.setActionSummaryIndexName("default"); + savedSearch.setActionSummaryIndexCommand("$name5$"); + savedSearch.setActionSummaryIndexHostname("dummy5.host.com"); + savedSearch.setActionSummaryIndexInline(false); + savedSearch.setActionSummaryIndexMaxResults(105); + savedSearch.setActionSummaryIndexMaxTime("50s"); + savedSearch.setActionSummaryIndexTrackAlert(false); + savedSearch.setActionSummaryIndexTtl("65"); + savedSearch.setActions( + "rss,email,populate_lookup,script,summary_index"); + savedSearch.setSearch("search index=boris abcd"); + + savedSearch.setAlertComparator("greater than"); + savedSearch.setAlertCondition("*"); + savedSearch.setAlertDigestMode(true); // false causes side effects + savedSearch.setAlertExpires("23h"); + savedSearch.setAlertSeverity(6); + savedSearch.setAlertSuppress(true); + if (service.versionIsAtLeast("4.3")) { + savedSearch.setAlertSuppressFields("host"); + } + savedSearch.setAlertSuppressPeriod("1m"); + savedSearch.setAlertThreshold("50%"); + savedSearch.setAlertTrack("0"); + savedSearch.setAlertType("number of events"); + savedSearch.setCronSchedule("*/5 * * * *"); + savedSearch.setDescription("Cake!"); + savedSearch.setDispatchBuckets("100"); + savedSearch.setDispatchEarliestTime("-100s@s"); + savedSearch.setDispatchLatestTime("-1s@s"); + savedSearch.setDispatchLookups(false); + savedSearch.setDispatchMaxCount(100000); + savedSearch.setDispatchMaxTime(120); + savedSearch.setDispatchSpawnProcess(true); + savedSearch.setDispatchTimeFormat("%FT%T.%Q"); + savedSearch.setDispatchTtl("3p"); + savedSearch.setDisplayView("flash_timeline"); + savedSearch.setMaxConcurrent(2); + savedSearch.setRealtimeSchedule(false); + savedSearch.setRequestUiDispatchApp("foo"); + savedSearch.setRequestUiDispatchView("bar"); + savedSearch.setRunOnStartup(true); + // TODO: Create a vsid to test this properly + savedSearch.setVsid(""); + + savedSearch.setDispatchReduceFrequency(11); + savedSearch.setDispatchRealTimeBackfill(true); + savedSearch.setRestartOnSearchpeerAdd(false); + savedSearch.setDisabled(true); + + savedSearch.update(); + savedSearch.refresh(); + + Assert.assertTrue(savedSearch.isActionEmail()); + Assert.assertTrue(savedSearch.isActionPopulateLookup()); + Assert.assertTrue(savedSearch.isActionRss()); + Assert.assertTrue(savedSearch.isActionScript()); + Assert.assertTrue(savedSearch.isActionSummaryIndex()); + Assert.assertTrue(savedSearch.isDigestMode()); + + Assert.assertEquals("sdk-password", savedSearch.getActionEmailAuthPassword()); + Assert.assertEquals("sdk-username", savedSearch.getActionEmailAuthUsername()); + Assert.assertEquals("sdk-bcc@splunk.com", savedSearch.getActionEmailBcc()); + Assert.assertEquals("sdk-cc@splunk.com", savedSearch.getActionEmailCc()); + Assert.assertEquals("$name1$", savedSearch.getActionEmailCommand()); + Assert.assertEquals("text", savedSearch.getActionEmailFormat()); + Assert.assertEquals("sdk@splunk.com", savedSearch.getActionEmailFrom()); + Assert.assertEquals("dummy1.host.com", savedSearch.getActionEmailHostname()); + Assert.assertTrue(savedSearch.getActionEmailInline()); + Assert.assertEquals("splunk.com", savedSearch.getActionEmailMailServer()); + Assert.assertEquals(101, savedSearch.getActionEmailMaxResults()); + Assert.assertEquals("10s", savedSearch.getActionEmailMaxTime()); + Assert.assertEquals("dummy", savedSearch.getActionEmailPdfView()); + Assert.assertEquals("*", savedSearch.getActionEmailPreProcessResults()); + Assert.assertEquals("landscape", savedSearch.getActionEmailReportPaperOrientation()); + Assert.assertEquals("letter", savedSearch.getActionEmailReportPaperSize()); + Assert.assertFalse(savedSearch.getActionEmailReportServerEnabled()); + Assert.assertEquals("splunk.com", savedSearch.getActionEmailReportServerUrl()); + Assert.assertFalse(savedSearch.getActionEmailSendPdf()); + Assert.assertFalse(savedSearch.getActionEmailSendResults()); + Assert.assertEquals("sdk-subject", savedSearch.getActionEmailSubject()); + Assert.assertEquals("sdk-to@splunk.com", savedSearch.getActionEmailTo()); + Assert.assertFalse(savedSearch.getActionEmailTrackAlert()); + Assert.assertEquals("61", savedSearch.getActionEmailTtl()); + Assert.assertFalse(savedSearch.getActionEmailUseSsl()); + Assert.assertFalse(savedSearch.getActionEmailUseTls()); + Assert.assertFalse(savedSearch.getActionEmailWidthSortColumns()); + Assert.assertEquals("$name2$", savedSearch.getActionPopulateLookupCommand()); + Assert.assertEquals("dummypath", savedSearch.getActionPopulateLookupDest()); + Assert.assertEquals("dummy2.host.com", savedSearch.getActionPopulateLookupHostname()); + Assert.assertEquals(102, savedSearch.getActionPopulateLookupMaxResults()); + Assert.assertEquals("20s", savedSearch.getActionPopulateLookupMaxTime()); + Assert.assertFalse(savedSearch.getActionPopulateLookupTrackAlert()); + Assert.assertEquals("62", savedSearch.getActionPopulateLookupTtl()); + Assert.assertEquals("$name3$", savedSearch.getActionRssCommand()); + Assert.assertEquals("dummy3.host.com", savedSearch.getActionRssHostname()); + Assert.assertEquals(103, savedSearch.getActionRssMaxResults()); + Assert.assertEquals("30s", savedSearch.getActionRssMaxTime()); + Assert.assertFalse(savedSearch.getActionRssTrackAlert()); + Assert.assertEquals("63", savedSearch.getActionRssTtl()); + Assert.assertEquals("foo.sh", savedSearch.getActionScriptFilename()); + Assert.assertEquals("$name4$", savedSearch.getActionScriptCommand()); + Assert.assertEquals("dummy4.host.com", savedSearch.getActionScriptHostname()); + Assert.assertEquals(104, savedSearch.getActionScriptMaxResults()); + Assert.assertEquals("40s", savedSearch.getActionScriptMaxTime()); + Assert.assertFalse(savedSearch.getActionScriptTrackAlert()); + Assert.assertEquals("64", savedSearch.getActionScriptTtl()); + Assert.assertEquals("default", savedSearch.getActionSummaryIndexName()); + Assert.assertEquals("$name5$", savedSearch.getActionSummaryIndexCommand()); + Assert.assertEquals("dummy5.host.com", savedSearch.getActionSummaryIndexHostname()); + Assert.assertFalse(savedSearch.getActionSummaryIndexInline()); + Assert.assertEquals(105, savedSearch.getActionSummaryIndexMaxResults()); + Assert.assertEquals("50s", savedSearch.getActionSummaryIndexMaxTime()); + Assert.assertFalse(savedSearch.getActionSummaryIndexTrackAlert()); + Assert.assertEquals("65", savedSearch.getActionSummaryIndexTtl()); + Assert.assertEquals(savedSearch.isVisible(), !isVisible); + + boolean isPre620 = service.versionIsEarlierThan("6.2.0"); + try { + Assert.assertEquals(savedSearch.isEmbedEnabled(), false); + Assert.assertNull(savedSearch.getEmbedToken()); + if (isPre620) + Assert.fail("Expected UnsupportedOperationException"); + } catch(UnsupportedOperationException uoe) { + if (!isPre620) + Assert.fail("Unexpected UnsupportedOperationException"); + else + Assert.assertNotNull(uoe); + } + + Assert.assertNull(savedSearch.getNextScheduledTime()); + if (service.versionIsEarlierThan("4.3")) { + Assert.assertEquals("search search index=boris abcd", savedSearch.getQualifiedSearch()); + } else { + Assert.assertEquals("search search index=boris abcd", savedSearch.getQualifiedSearch()); + } + + Assert.assertEquals("greater than", savedSearch.getAlertComparator()); + Assert.assertEquals("*", savedSearch.getAlertCondition()); + Assert.assertEquals(true, savedSearch.getAlertDigestMode()); + Assert.assertEquals("23h", savedSearch.getAlertExpires()); + Assert.assertEquals(6, savedSearch.getAlertSeverity()); + Assert.assertEquals(true, savedSearch.getAlertSuppress()); + if (service.versionIsAtLeast("4.3")) { + Assert.assertEquals("host", savedSearch.getAlertSuppressFields()); + } + Assert.assertEquals("1m", savedSearch.getAlertSuppressPeriod()); + Assert.assertEquals("50%", savedSearch.getAlertThreshold()); + // NOTE: Always returns "0" or "1". Never "auto". Vince notified. + Assert.assertEquals("0", savedSearch.getAlertTrack()); + Assert.assertEquals("number of events", savedSearch.getAlertType()); + Assert.assertEquals("*/5 * * * *", savedSearch.getCronSchedule()); + Assert.assertEquals("Cake!", savedSearch.getDescription()); + Assert.assertEquals(100, savedSearch.getDispatchBuckets()); + Assert.assertEquals("-100s@s", savedSearch.getDispatchEarliestTime()); + Assert.assertEquals("-1s@s", savedSearch.getDispatchLatestTime()); + Assert.assertEquals(false, savedSearch.getDispatchLookups()); + Assert.assertEquals(100000, savedSearch.getDispatchMaxCount()); + // NOTE: Should be int to match setter. See DVPL-1268. + Assert.assertEquals(120, savedSearch.getDispatchMaxTime()); + Assert.assertEquals(true, savedSearch.getDispatchSpawnProcess()); + Assert.assertEquals("%FT%T.%Q", savedSearch.getDispatchTimeFormat()); + Assert.assertEquals("3p", savedSearch.getDispatchTtl()); + Assert.assertEquals("flash_timeline", savedSearch.getDisplayView()); + Assert.assertEquals(2, savedSearch.getMaxConcurrent()); + Assert.assertEquals(false, savedSearch.getRealtimeSchedule()); + Assert.assertEquals("foo", savedSearch.getRequestUiDispatchApp()); + Assert.assertEquals("bar", savedSearch.getRequestUiDispatchView()); + Assert.assertEquals(true, savedSearch.getRunOnStartup()); + Assert.assertEquals(null, savedSearch.getVsid()); + + Assert.assertEquals(11, savedSearch.getDispatchReduceFrequency()); + Assert.assertEquals(true, savedSearch.getDispatchRtBackfill()); + Assert.assertEquals(false, savedSearch.getRestartOnSearchPeerAdd()); + Assert.assertEquals(true, savedSearch.isDisabled()); + } + + @Test + public void testScheduled() { + SavedSearch savedSearch = this.savedSearches.create(createTemporaryName(), "search index=_internal | head 1"); + + Assert.assertFalse(savedSearch.isScheduled()); + savedSearch.setCronSchedule("*/5 * * * *"); + savedSearch.setIsScheduled(true); + savedSearch.update(); + Assert.assertTrue(savedSearch.isScheduled()); + + savedSearch.remove(); + } + + @Test + public void testGetSavedSearchByTitle(){ + try{ + SavedSearch fetchedSavedSearch = this.savedSearches.getService().getSavedSearch(savedSearchName); + Assert.assertEquals(fetchedSavedSearch.getName(),savedSearch.getName()); + }catch (Exception e) { } + } + + @Test + public void testCreateWithNoSearch() { + try { + this.savedSearches.create(createTemporaryName()); + Assert.fail("Should've thrown!"); + } catch (Exception e) { + Assert.assertTrue(true); + } + } + + @Test + public void testAcknowledge() { + savedSearch.acknowledge(); + } + + @Test + public void testUpdateWithBogusKeysFails() { + try { + Args args = new Args("borisTheMadBaboon", "Arrgh!"); + savedSearch.update(args); + Assert.fail("Expected an exception."); + } catch (Exception e) {} + } + + @Test + public void testCannotUpdateName() { + String newName = savedSearchName + "-alteration"; + try { + Args args = new Args("name", newName); + savedSearch.update(args); + savedSearch.refresh(); + Assert.fail("Expected exception to be raised when trying to update name."); + } catch (Exception e) {} + } + + @Test + public void testACLUpdates(){ + Record aclInfo = savedSearch.getMetadata().getEaiAcl(); + Assert.assertNotEquals(aclInfo.getString("sharing"), "app"); + Assert.assertNotEquals(aclInfo.getString("owner"), "nobody"); + Assert.assertNull(aclInfo.get("perms")); + Args args = new Args(); + args.add("sharing","app"); + args.add("owner","nobody"); + args.add("app","search"); + args.add("perms.read","admin, nobody"); + savedSearch.aclUpdate(args); + aclInfo = savedSearch.getMetadata().getEaiAcl(); + Assert.assertEquals(aclInfo.getString("sharing"), "app"); + Assert.assertEquals(aclInfo.getString("owner"), "nobody"); + Assert.assertNotNull(aclInfo.get("perms")); + } + + @Test + public void testACLUpdateWithoutSharing(){ + Args args = new Args(); + args.add("owner","nobody"); + args.add("app","search"); + Assert.assertThrows("Required argument 'sharing' is missing.", IllegalArgumentException.class, () -> {savedSearch.aclUpdate(args);}); + } + + @Test + public void testACLUpdateWithoutOwner(){ + Args args = new Args(); + Assert.assertThrows("Required argument 'owner' is missing.", IllegalArgumentException.class, () -> {savedSearch.aclUpdate(args);}); + } + + @Test + public void testDispatch() { + final JobCollection jobs = service.getJobs(); + + SavedSearchDispatchArgs args = new SavedSearchDispatchArgs(); + args.setDispatchBuckets(100); + + try { + final Job job = savedSearch.dispatch(args); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + + Assert.assertTrue(jobs.containsKey(job.getSid())); + } catch (InterruptedException e) { + Assert.fail(e.toString()); + } + } + + @Test + public void testDispatchWithoutOptions() { + final JobCollection jobs = service.getJobs(); + + try { + final Job job = savedSearch.dispatch(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + + Assert.assertTrue(jobs.containsKey(job.getSid())); + } catch (InterruptedException e) { + Assert.fail(e.toString()); + } + } + + @Test + public void testHistory() { + savedSearch.refresh(); + Job[] oldJobs = savedSearch.history(); + + try { + final Job job = savedSearch.dispatch(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isReady(); + } + }); + + Assert.assertEquals(oldJobs.length + 1, savedSearch.history().length); + + boolean isFound = false; + for (Job j : savedSearch.history()) { + if (j.getSid().equals(job.getSid())) { + isFound = true; + } + } + Assert.assertTrue(isFound); + + } catch (InterruptedException e) { + Assert.fail(e.toString()); + } + } + + @Test + public void testHistoryWithArgs(){ + savedSearch.refresh(); + Assert.assertEquals(0, savedSearch.history().length); + try { + Job job; + for(int i = 0 ; i < 31 ; i++){ + job = savedSearch.dispatch(); + while(!job.isReady()){ + sleep(2); + } + } + //history without any argument, it will return max 30 jobs only. + Assert.assertEquals(30, savedSearch.history().length); + + //history with argument 'count' set to '0' i.e it returns the whole history + HashMap<String, Object> args = new HashMap<String, Object>(); + args.put("count", 0); + Assert.assertEquals(31, savedSearch.history(args).length); + + //history with argument 'count' set to '10' i.e. it will return only 10 jobs from history + args.put("count", 10); + args.put("sort_dir", "desc"); + Assert.assertEquals(10, savedSearch.history(args).length); + + } catch (InterruptedException e) { + Assert.fail(e.toString()); + } + } +} diff --git a/splunk/src/test/java/com/splunk/ScriptedInputTest.java b/splunk/src/test/java/com/splunk/ScriptedInputTest.java new file mode 100644 index 00000000..b1ca3465 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ScriptedInputTest.java @@ -0,0 +1,81 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class ScriptedInputTest extends SDKTestCase { + @Test + public void testMatchNonscriptInputName() { + Assert.assertFalse(InputCollection.matchesInputName(InputKind.Tcp, "1-[]bc", "def")); + Assert.assertTrue(InputCollection.matchesInputName(InputKind.Tcp, "1-[]bc", "1-[]bc")); + } + + @Test + public void testMatchScriptInputName() { + Assert.assertTrue(InputCollection.matchesInputName( + InputKind.Script, "abc.py", "$SPLUNK_HOME/etc/apps/boris/bin/abc.py" + )); + Assert.assertFalse(InputCollection.matchesInputName( + InputKind.Script, "abc", "$SPLUNK_HOME/etc/apps/boris/bin/abc.py" + )); + + Assert.assertTrue(InputCollection.matchesInputName( + InputKind.Script, "abc.py", "$SPLUNK_HOME\\etc\\apps\\boris\\bin\\abc.py" + )); + Assert.assertFalse(InputCollection.matchesInputName( + InputKind.Script, "abc", "$SPLUNK_HOME\\etc\\apps\\boris\\bin\\abc.py" + )); + } + + @Test + public void testEntity() { + // In Splunk 4.2, we can't use $SPLUNK_HOME in the path to the + // script, so we have to fetch $SPLUNK_HOME separately and interpolate + // it ourselves. + String splunkHome = service.getSettings().getSplunkHome(); + InputCollection inputs = service.getInputs(); + inputs.create( + joinServerPath(new String[] { + splunkHome, "etc", "apps", "search", "bin", + "bucketdir.py", + }), + InputKind.Script, + Args.create("interval", "0")); + inputs.refresh(); + + ScriptInput input = (ScriptInput)inputs.get("bucketdir.py"); + Assert.assertNotNull(input); + + input.getEndTime(); + input.getGroup(); + input.getRcvBuf(); + input.getSource(); + input.getStartTime(); + + Assert.assertFalse(input.getBoolean("disabled")); + input.setDisabled(true); + input.update(); + Assert.assertTrue(input.getBoolean("disabled")); + input.setDisabled(false); + input.update(); + Assert.assertFalse(input.getBoolean("disabled")); + + input.remove(); + } +} diff --git a/splunk/src/test/java/com/splunk/SearchJobTest.java b/splunk/src/test/java/com/splunk/SearchJobTest.java new file mode 100644 index 00000000..fbb7cbce --- /dev/null +++ b/splunk/src/test/java/com/splunk/SearchJobTest.java @@ -0,0 +1,1048 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Ignore; +import org.junit.Test; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.util.Date; +import java.util.HashMap; +import java.util.Map; + +public class SearchJobTest extends SDKTestCase { + private static final String QUERY = "search index=_internal | head 10"; + private static final String SUMMARY_FIELD_MAGIC_42 = "<field k='index' c='10' nc='0' dc='1' exact='1'>"; + private static final String SUMMARY_FIELD_MAGIC_43 = "<field k='host' c='10' nc='0' dc='1' exact='1' relevant='0'>"; + private static final String SUMMARY_FIELD_MAGIC_5x = "<field k=\"host\" c=\"10\" nc=\"0\" dc=\"1\" exact=\"1\" relevant=\"0\">"; + + private JobCollection jobs; + + @Before + @Override + public void setUp() throws Exception { + super.setUp(); + jobs = service.getJobs(); + } + + @Test + public void testRemove() { + Args namespace = Args.create(); + namespace.put("app", "search"); + namespace.put("owner", "admin"); + Assert.assertNull(jobs.remove("doesntexist", namespace)); + } + + @Test + public void testEventsFromJob() { + Job job = jobs.create(QUERY); + waitUntilDone(job); + + Assert.assertEquals(10, countEvents(job.getEvents())); + + job.cancel(); + } + + @Test + public void testEventsWithSearchParams() { + Job job = jobs.create(QUERY); + waitUntilDone(job); + + Map args = new HashMap<String, Object>(); + args.put("search","| head 1"); + Assert.assertEquals(1, countEvents(job.getEvents(args))); + + job.cancel(); + } + + @Test + public void testResultsFromJob() { + Job job = jobs.create(QUERY); + waitUntilDone(job); + + Assert.assertEquals(10, countEvents(job.getResults())); + + job.cancel(); + } + + @Test + public void testResultsWithSearchParams() { + Job job = jobs.create(QUERY); + waitUntilDone(job); + + Map args = new HashMap<String, Object>(); + args.put("search","| head 1"); + Assert.assertEquals(1, countEvents(job.getResults(args))); + + job.cancel(); + } + + @Test + public void testGetJobBySid() { + + String sid = service.search(QUERY).getSid(); + Assert.assertTrue(sid.length() > 0); + + Job job = service.getJob(sid); + Assert.assertNotNull(job); + + waitUntilDone(job); + + Assert.assertEquals(10, job.getEventCount()); + Assert.assertEquals(10, job.getResultCount()); + } + + @Test + public void testGetJobBySidLongValues() { + + String sid = service.search(QUERY).getSid(); + Assert.assertTrue(sid.length() > 0); + + Job job = service.getJob(sid); + Assert.assertNotNull(job); + + waitUntilDone(job); + + Assert.assertEquals(10L, job.getEventCountLong()); + Assert.assertEquals(10L, job.getResultCountLong()); + Assert.assertTrue(10L < job.getScanCountLong()); + } + + @Test + public void testBlockingSearch() { + Assert.assertEquals(10, countEvents(service.oneshotSearch(QUERY))); + } + + @Test + public void testOneshotWithGarbageFails() { + try { + service.oneshotSearch("syntax-error"); + Assert.fail("Expected an exception from oneshot with garbage."); + } catch (HttpException e) { + Assert.assertEquals(400, e.getStatus()); + } + } + + @Test + public void testBlockingExport() { + Assert.assertEquals(10, countEvents(service.export(QUERY))); + } + + @Test + public void testExportWithGarbageFails() { + try { + service.export("syntax-error"); + Assert.fail("Expected an exception from export with garbage."); + } catch (HttpException e) { + Assert.assertEquals(400, e.getStatus()); + } + } + + @Test + public void testAsyncSearchWithGarbageFails() { + Job job = null; + try { + job = jobs.create("syntax-error"); + Assert.fail("Expected an exception from creating a job with garbage."); + } catch (HttpException e) { + Assert.assertEquals(400, e.getStatus()); + if (job != null) { + Assert.assertTrue(job.isFailed()); + } + } + } + + // Splunk can include <sg> tags in and similar XML elements in its output to show user interfaces + // what terms in the results were matched so they can be called out in the user interface. The following + // six tests check that oneshot, export, and normal searches all, by default, have such highlighting turned + // off, and it can be turned on for all of them. + @Test + public void testOneshotHasNoSgByDefault() throws IOException { + if (service.versionIsEarlierThan("5.0.0")) { + System.out.println("WARNING: 'segmentation=none' has no impact on Splunk 4.3.5 (or earlier); skipping test."); + return; + } + InputStream input = service.oneshotSearch("search index=_internal GET | head 3"); + String data = streamToString(input); + Assert.assertFalse(data.contains("<sg")); + } + + @Test + public void testOneshotCanEnableSg() throws IOException { + JobArgs args = new JobArgs(); + args.put("segmentation", "raw"); + InputStream input = service.oneshotSearch("search index=_internal GET | head 3", args); + String data = streamToString(input); + Assert.assertTrue(data.contains("<sg")); + } + + @Test + public void testExportHasNoSgByDefault() throws IOException { + if (service.versionIsEarlierThan("5.0.0")) { + System.out.println("WARNING: 'segmentation=none' has no impact on Splunk 4.3.5 (or earlier); skipping test."); + return; + } + InputStream input = service.export("search index=_internal GET | head 3"); + String data = streamToString(input); + Assert.assertFalse(data.contains("<sg")); + } + + @Test + public void testExportCanEnableSg() throws IOException { + JobArgs args = new JobArgs(); + args.put("segmentation", "raw"); + InputStream input = service.export("search index=_internal GET | head 3", args); + String data = streamToString(input); + Assert.assertTrue(data.contains("<sg")); + } + + @Test + public void testJobHasNoSgByDefault() throws IOException { + if (service.versionIsEarlierThan("5.0.0")) { + System.out.println("WARNING: 'segmentation=none' has no impact on Splunk 4.3.5 (or earlier); skipping test."); + return; + } + Job job = service.getJobs().create("search index=_internal GET | head 3"); + waitUntilDone(job); + String data = streamToString(job.getResults()); + Assert.assertFalse(data.contains("<sg")); + } + + @Test + public void testJobCanEnableSg() throws IOException { + Job job = service.getJobs().create("search index=_internal GET | head 3"); + waitUntilDone(job); + Map<String, String> args = new HashMap<String, String>(); + args.put("segmentation", "raw"); + String data = streamToString(job.getResults(args)); + Assert.assertTrue(data.contains("<sg")); + } + + @Test + public void testExportArgs() throws IOException { + JobExportArgs args = new JobExportArgs(); + args.setAutoCancel(5); + args.setAutoFinalizeEventCount(2); + args.setAutoPause(10); + args.setEnableLookups(true); + args.setMaximumTime(3); + args.setMaximumLines(1); + args.setOutputMode(JobExportArgs.OutputMode.XML); + args.setEarliestTime("-10m"); + args.setLatestTime("-1s"); + args.setTruncationMode(JobExportArgs.TruncationMode.TRUNCATE); + args.setOutputTimeFormat("%s.%Q"); + args.setFieldList(new String[] { "_raw", "date_hour", "foo" }); + args.setRequiredFieldList(new String[] { "_raw", "date_hour", "foo2" }); + args.setSearchMode(JobExportArgs.SearchMode.NORMAL); + + InputStream input = service.export("search index=_internal | head 200", args); + ResultsReaderXml reader = new ResultsReaderXml(input); + + int count = 0; + while(true) { + HashMap<String, String> found = reader.getNextEvent(); + if (found != null) { + count++; + // Verify 'args.setMaximumLines(1)' above + int numLines = found.get("_raw").split("\\n").length; + // 'max_lines' works for GET search/jobs/{search_id}/events + // but not GET search/jobs/export, with Splunk. + // This is either a Splunk server bug or a Doc bug. + // Refer to + // http://docs.splunk.com/Documentation/Splunk/5.0.2/RESTAPI/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fevents + if (numLines != 1) { + System.out.println("'max_lines' does not work due to a known bug."); + numLines = 1; + } + Assert.assertEquals(1, numLines); + Assert.assertFalse(found.containsKey("date_month")); + Assert.assertFalse(found.containsKey("foo")); + Assert.assertFalse(found.containsKey("foo2")); + } + else { + break; + } + } + + Assert.assertEquals(200, count); + } + + @Test + public void testJobArgs() throws IOException, InterruptedException { + String name = createTemporaryName(); + JobArgs args = new JobArgs(); + args.setAutoCancel(5); + args.setAutoFinalizeEventCount(2); + args.setAutoPause(10); + args.setEnableLookups(true); + args.setMaximumTime(3); + args.setMaximumCount(10); + args.setStatusBuckets(1); + args.setEarliestTime("-600m"); + args.setLatestTime("-1s"); + args.setRequiredFieldList(new String[] { "_raw", "date_hour" }); + args.setSearchMode(JobArgs.SearchMode.NORMAL); + args.setId(name); + + JobCollection jobs = service.getJobs(); + Job job = jobs.create("search index=_internal | head 200", args); + + while(!job.isDone()) { + Thread.sleep(1000); + } + + job.refresh(); + Assert.assertEquals(job.get("sid"), name); + Assert.assertTrue(job.getEventCount() < 2000); + + testEventArgs(job); + testResultArgs(job); + testPreviewArgs(job); + + job.cancel(); + } + + public void testEventArgs(Job job) throws IOException, InterruptedException { + JobEventsArgs args = new JobEventsArgs(); + args.setCount(2); + args.setOffset(2); + args.setMaximumLines(1); + args.setFieldList(new String[] { "_raw", "date_hour", "_serial" }); + args.setOutputMode(JobEventsArgs.OutputMode.CSV); + args.setOutputTimeFormat("%s.%Q"); + args.setSegmentation("full"); + args.setTruncationMode(JobEventsArgs.TruncationMode.TRUNCATE); + + InputStream input = job.getEvents(args); + ResultsReaderCsv reader = new ResultsReaderCsv(input); + + int count = 0; + while(true) { + HashMap<String, String> found = reader.getNextEvent(); + if (found != null) { + Assert.assertEquals(found.get("_raw").split("\n").length, 1); + Assert.assertFalse(found.containsKey("date_month")); + Assert.assertEquals(Integer.parseInt(found.get("_serial")), count + 2); + count++; + } + else { + break; + } + } + + Assert.assertEquals(2, count); + } + + public void testResultArgs(Job job) throws IOException, InterruptedException { + JobResultsArgs args = new JobResultsArgs(); + args.setCount(2); + args.setOffset(2); + args.setFieldList(new String[] { "_raw", "date_hour", "_serial" }); + args.setOutputMode(JobResultsArgs.OutputMode.CSV); + + InputStream input = job.getResults(args); + ResultsReaderCsv reader = new ResultsReaderCsv(input); + + int count = 0; + while(true) { + HashMap<String, String> found = reader.getNextEvent(); + if (found != null) { + Assert.assertEquals(found.get("_raw").split("\n").length, 1); + Assert.assertFalse(found.containsKey("date_month")); + Assert.assertEquals(Integer.parseInt(found.get("_serial")), count + 2); + count++; + } + else { + break; + } + } + + Assert.assertEquals(2, count); + + JobResultsArgs args2 = new JobResultsArgs(); + args2.setSearch("stats count"); + args2.setOutputMode(JobResultsArgs.OutputMode.JSON); + + InputStream input2 = job.getResults(args2); + ResultsReaderJson reader2 = new ResultsReaderJson(input2); + + int count2 = 0; + while(true) { + HashMap<String, String> found = reader2.getNextEvent(); + if (found != null) { + Assert.assertEquals(found.get("count"), "10"); + count2++; + } + else { + break; + } + } + + Assert.assertEquals(1, count2); + } + + public void testPreviewArgs(Job job) throws IOException, InterruptedException { + JobResultsPreviewArgs args = new JobResultsPreviewArgs(); + args.setCount(2); + args.setOffset(2); + args.setFieldList(new String[] { "_raw", "date_hour", "_serial" }); + args.setOutputMode(JobResultsPreviewArgs.OutputMode.CSV); + + InputStream input = job.getResultsPreview(args); + ResultsReaderCsv reader = new ResultsReaderCsv(input); + + int count = 0; + while (true) { + HashMap<String, String> found = reader.getNextEvent(); + if (found != null) { + Assert.assertEquals(found.get("_raw").split("\n").length, 1); + Assert.assertFalse(found.containsKey("date_month")); + Assert.assertEquals(Integer.parseInt(found.get("_serial")), count + 2); + count++; + } + else { + break; + } + } + + Assert.assertEquals(2, count); + + JobResultsPreviewArgs args2 = new JobResultsPreviewArgs(); + args2.setSearch("stats count"); + args2.setOutputMode(JobResultsPreviewArgs.OutputMode.JSON); + + InputStream input2 = job.getResultsPreview(args2); + ResultsReaderJson reader2 = new ResultsReaderJson(input2); + + int count2 = 0; + while(true) { + HashMap<String, String> found = reader2.getNextEvent(); + if (found != null) { + Assert.assertEquals(found.get("count"), "10"); + count2++; + } + else { + break; + } + } + + Assert.assertEquals(1, count2); + } + + @Test + public void testSimpleParse() { + String response = inputStreamToString( + service.parse(QUERY).getContent() + ); + + Assert.assertTrue(response.contains("<key name=\"command\">search</key>")); + Assert.assertTrue(response.contains("<key name=\"command\">head</key>")); + } + + @Test + public void testParseWithParseOnly() { + Args args = new Args("output_mode", "json"); + String response = inputStreamToString( + service.parse(QUERY, args).getContent() + ); + + Assert.assertTrue(response.startsWith("{")); + } + + @Test + public void testParseError() { + String badQuery = "syntax-error"; + + try { + service.parse(badQuery); + Assert.fail("Expected a parse error."); + } catch (HttpException e) { + Assert.assertEquals(400, e.getStatus()); + } + } + + @Test + public void testParseErrorWithArgs() { + String badQuery = "syntax-error"; + + try { + Args args = new Args("output_mode", "json"); + service.parse(badQuery, args); + Assert.fail("Expected a parse error."); + } catch (HttpException e) { + Assert.assertEquals(400, e.getStatus()); + } + } + + @Test + public void testCancel() { + Job job = jobs.create(QUERY); + + while (!job.isReady()) { + try { + Thread.sleep(500); + } catch (InterruptedException e) {} + } + + String sid = job.getSid(); + + jobs.refresh(); + Assert.assertTrue(jobs.containsKey(sid)); + + job.cancel(); + jobs.refresh(); + Assert.assertFalse(jobs.containsKey(sid)); + } + + @Test + public void testCancelIsIdempotent() { + Job job = jobs.create(QUERY); + + while (!job.isReady()) { + try { + Thread.sleep(500); + } catch (InterruptedException e) {} + } + + String sid = job.getSid(); + + jobs.refresh(); + Assert.assertTrue(jobs.containsKey(sid)); + + job.cancel(); + job.cancel(); // Second cancel should be a nop + jobs.refresh(); + Assert.assertFalse(jobs.containsKey(sid)); + } + + @Test + public void testCursorTime() { + Job job = jobs.create(QUERY); + + while (!job.isReady()) { + try { + Thread.sleep(500); + } catch (InterruptedException e) {} + } + + String sid = job.getSid(); + + jobs.refresh(); + Assert.assertTrue(jobs.containsKey(sid)); + + Date date = job.getCursorTime(); + Assert.assertNotNull(date); + } + + @Test + public void testRemoteTimeline() throws InterruptedException { + Job job = jobs.create(QUERY); + + String sid = job.getSid(); + + jobs.refresh(); + Assert.assertTrue(jobs.containsKey(sid)); + + while (!job.isReady()) { + Thread.sleep(50); + } + + job.isRemoteTimeline(); + } + + @Test + public void testRemoveFail() throws InterruptedException { + Job job = jobs.create(QUERY); + + String sid = job.getSid(); + + while (!job.isReady()) { + Thread.sleep(100); + } + + jobs.refresh(); + Assert.assertTrue(jobs.containsKey(sid)); + + try { + job.remove(); + Assert.fail("Exception should be thrown on job removal"); + } catch (Exception ex) { + Assert.assertTrue(true); + } + } + + @Test + public void testPreview() throws InterruptedException { + JobArgs args = new JobArgs(); + args.put("field_list", "source,host,sourcetype"); + args.setStatusBuckets(100); + + Job job = jobs.create(QUERY, args); + + while (!job.isReady()) { + Thread.sleep(100); + } + + Assert.assertTrue(10 >= countEvents(job.getResultsPreview())); + + job.cancel(); + } + + @Test + public void testPreviewWithSearchParams() throws InterruptedException { + JobArgs args = new JobArgs(); + args.put("field_list", "source,host,sourcetype"); + args.setStatusBuckets(100); + + Job job = jobs.create(QUERY, args); + + while (!job.isReady()) { + Thread.sleep(100); + } + + Map argsSearchQuery = new HashMap<String, Object>(); + argsSearchQuery.put("search","| head 1"); + // Assert.assertTrue(1 >= countEvents(job.getResultsPreview(args))); + Assert.assertEquals(1, countEvents(job.getResultsPreview(argsSearchQuery))); + + job.cancel(); + } + + @Test + public void testSearchLog() { + Job job = jobs.create(QUERY); + waitUntilDone(job); + String response = inputStreamToString(job.getSearchLog()); + + Assert.assertTrue(response.contains("dispatchRunner")); + + job.cancel(); + } + + @Test + public void testSummary() { + // status_buckets > 0 and arguments to + // required_fields_list guarantees content + // in the summary. + JobArgs args = new JobArgs(); + args.setStatusBuckets(100); + args.put("required_fields_list", "source,host"); + Job job = jobs.create(QUERY, args); + waitUntilDone(job); + + // Ensure at least one field comes back + String response = inputStreamToString(job.getSummary()); + if (!response.contains(SUMMARY_FIELD_MAGIC_42) && + !response.contains(SUMMARY_FIELD_MAGIC_43) && + !response.contains(SUMMARY_FIELD_MAGIC_5x)) { + Assert.fail("Couldn't find <field> in response: " + response); + } + + job.cancel(); + } + + @Test + public void testTimeline() { + Args args = new Args(); + args.put("status_buckets", 100); + Job job = jobs.create(QUERY, args); + waitUntilDone(job); + + String response = inputStreamToString(job.getTimeline()); + Assert.assertTrue(response.contains("<bucket")); + + job.cancel(); + } + + @Test + public void testTimelineWithJobArgs() { + JobArgs args = new JobArgs(); + args.setStatusBuckets(100); + Job job = jobs.create(QUERY, args); + waitUntilDone(job); + + String response = inputStreamToString(job.getTimeline()); + Assert.assertTrue(response.contains("<bucket")); + + job.cancel(); + } + + @Test + public void testAttributes() { + Args args = new Args(); + args.put("status_buckets", 100); + Job job = jobs.create(QUERY, args); + waitUntilDone(job); + + String response = Util.join(",", job.getSearchProviders()); + Assert.assertTrue(response.contains(service.getSettings().getServerName())); + + job.cancel(); + } + + @Test + public void testEnablePreview() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal | sleep 10"; + Args args = new Args(); + args.put("earliest_time", "-1m"); + args.put("priority", 5); + args.put("latest_time", "now"); + final Job job = jobs.create(query, args); + + while (!job.isReady()) { + Thread.sleep(150); + } + + // WORKAROUND (SPL-74890): Splunk 6.0.0 has a bug where the isPreviewEnabled field may not show up + // for some period after the job is ready. + if (service.versionCompare("6.0.0") == 0) { + while (job.getString("isPreviewEnabled", null) == null) { + job.refresh(); + Thread.sleep(100); + } + } + // END WORKAROUND + + job.refresh(); + Assert.assertFalse(job.isPreviewEnabled()); + + job.enablePreview(); + job.update(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 50; } + @Override + public boolean predicate() { + job.refresh(); + + if (!job.isPreviewEnabled() && job.isDone()) { + Assert.fail("Job finished before preview was enabled."); + } + + return job.isPreviewEnabled(); + } + }); + + waitForSleepingJobToDie(job); + } + + @Test + public void testDisablePreview() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal | sleep 10"; + Args args = new Args(); + args.put("earliest_time", "-1m"); + args.put("priority", 5); + args.put("latest_time", "now"); + args.put("preview", "1"); + final Job job = jobs.create(query, args); + + while (!job.isReady()) { + Thread.sleep(150); + } + + // WORKAROUND (SPL-74890): Splunk 6.0.0 has a bug where the isPreviewEnabled field may not show up + // for some period after the job is ready. + if (service.versionCompare("6.0.0") == 0) { + while (job.getString("isPreviewEnabled", null) == null) { + job.refresh(); + Thread.sleep(100); + } + } + // END WORKAROUND + + Assert.assertTrue(job.isPreviewEnabled()); + + job.disablePreview(); + job.update(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 50; } + @Override + public boolean predicate() { + job.refresh(); + + if (job.isPreviewEnabled() && job.isDone()) { + Assert.fail("Job finished before preview was enabled."); + } + + return !job.isPreviewEnabled(); + } + }); + + waitForSleepingJobToDie(job); + } + + void waitForSleepingJobToDie(Job job) { + final String sid = job.getSid(); + job.cancel(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + jobs.refresh(); + return !jobs.containsKey(sid); + } + }); + + // On Windows, the sleep command in our search + // will delay the actual end of the job process + // by up to 50ms. We wait for 500ms to give it a chance + // to die. + try { + Thread.sleep(500); + } catch (InterruptedException e) {} + } + + @Test + public void testSetPriority() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + // Note that you can only *decrease* the priority of a job unless + // splunkd is running as root.This is because Splunk jobs + // are tied up with operating system processes and their priorities. + String query = "search index=_internal | sleep 10"; + Args args = new Args(); + args.put("earliest_time", "-1m"); + args.put("priority", 5); + args.put("latest_time", "now"); + final Job job = jobs.create(query); + + while (!job.isReady()) { + Thread.sleep(100); + } + + // WORKAROUND (SPL-74890): Splunk 6.0.0 has a bug where the priority field may not show up + // for some period after the job is ready. + if (service.versionCompare("6.0.0") == 0) { + while (job.getString("priority", null) == null) { + job.refresh(); + Thread.sleep(100); + } + } + // END WORKAROUND + + + Assert.assertEquals(5, job.getPriority()); // The default priority is 5 + + final int newPriority = 3; + job.setPriority(newPriority); + job.update(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + job.refresh(); + return job.getPriority() == newPriority; + } + }); + + job.cancel(); + } + + @Test + public void testPause() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal | sleep 10"; + final Job job = jobs.create(query); + + while (!job.isReady()) { + Thread.sleep(100); + } + + if (job.isPaused()) { + job.control("unpause"); + job.refresh(); + Assert.assertFalse(job.isPaused()); + } + + job.pause(); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + job.refresh(); + return job.isPaused(); + } + }); + + job.cancel(); + } + + @Test + public void testUnpause() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal | sleep 10"; + final Job job = jobs.create(query); + + while (!job.isReady()) { + Thread.sleep(100); + } + + if (!job.isPaused()) { + job.control("pause"); + job.refresh(); + Assert.assertTrue(job.isPaused()); + } + + job.control("unpause"); + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + job.refresh(); + return !job.isPaused(); + } + }); + + job.cancel(); + } + + @Test + public void testFinalize() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal | sleep 10"; + final Job job = jobs.create(query); + + while (!job.isReady()) { + Thread.sleep(100); + } + + Assert.assertFalse(job.isFinalized()); + + job.finish(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + job.refresh(); + return job.isFinalized(); + } + }); + + job.cancel(); + } + + @Test + public void testDone() throws InterruptedException { + if (!hasTestData()) { + System.out.println("WARNING: sdk-app-collection not installed in Splunk; skipping test."); + return; + } + + installApplicationFromTestData("sleep_command"); + + String query = "search index=_internal earliest=-1h | sleep 5"; + final Job job = jobs.create(query); + + while (!job.isReady()) { + Thread.sleep(100); + } + + // Job shouldn't be done yet due to the sleep command + Assert.assertFalse(job.getBoolean("isDone")); + Thread.sleep(6000); + // Job still shouldn't be done + Assert.assertFalse(job.getBoolean("isDone")); + // Job should be done after the refresh + while(!job.isDone()) { + Thread.sleep(1000); + } + Assert.assertTrue(job.getBoolean("isDone")); + Assert.assertTrue(job.isDone()); + job.cancel(); + } + + // === Utility === + + private int countEvents(InputStream stream) { + ResultsReaderXml results = null; + try { + results = new ResultsReaderXml(stream); + + int count = 0; + while (results.getNextEvent() != null) { + count += 1; + } + + return count; + } catch (IOException e) { + Assert.fail(e.toString()); + return -1; + } + } + + private void waitUntilDone(final Job job) { + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + return job.isDone(); + } + }); + } + + private String inputStreamToString(InputStream stream) { + try { + StringBuilder b = new StringBuilder(); + BufferedReader reader = new BufferedReader( + new InputStreamReader(stream, "UTF-8") + ); + String tmp; + while ((tmp = reader.readLine()) != null) { + b.append(tmp + "\n"); + } + + return b.toString(); + } catch (IOException e) { + Assert.fail(e.toString()); + return null; + } + } +} diff --git a/splunk/src/test/java/com/splunk/ServiceTest.java b/splunk/src/test/java/com/splunk/ServiceTest.java new file mode 100644 index 00000000..a8960842 --- /dev/null +++ b/splunk/src/test/java/com/splunk/ServiceTest.java @@ -0,0 +1,753 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +import java.io.IOException; +import java.io.InputStream; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +public class ServiceTest extends SDKTestCase { + private static final String QUERY = "search index=_internal | head 10"; + + @Test + public void testCapabilities() throws Exception { + List<String> expected = Arrays.asList( + "admin_all_objects", "change_authentication", + "change_own_password", "delete_by_keyword", + "edit_deployment_client", "edit_deployment_server", + "edit_dist_peer", "edit_forwarders", "edit_httpauths", + "edit_input_defaults", "edit_monitor", "edit_roles", + "edit_scripted", "edit_search_server", "edit_server", + "edit_splunktcp", "edit_splunktcp_ssl", "edit_tcp", "edit_udp", + "edit_user", "edit_web_settings", "get_metadata", + "get_typeahead", "indexes_edit", "license_edit", "license_tab", + "list_deployment_client", "list_forwarders", "list_httpauths", + "list_inputs", "request_remote_tok", "rest_apps_management", + "rest_apps_view", "rest_properties_get", "rest_properties_set", + "restart_splunkd", "rtsearch", "schedule_search", "search", + "use_file_operator"); + + String[] caps = service.getCapabilities(); + for (String name : expected) { + Assert.assertTrue(contains(caps, name)); + } + } + + // Make a few simple requests and make sure the results look ok. + @Test + public void testGet() { + // Check a few paths that we know exist + String[] paths = { + "/", + "/services", + "/services/search/jobs", + "search/jobs", + "authentication/users" + }; + + for (String path : paths) + checkResponse(service.get(path)); + + // And make sure we get the expected 404 + try { + service.get("/zippy"); + Assert.fail("Expected HttpException"); + } + catch (HttpException e) { + Assert.assertEquals(404, e.getStatus()); + } + } + + @Test + public void testInfo() throws Exception { + List <String> expected = Arrays.asList( + "build", "cpu_arch", "guid", "isFree", "isTrial", "licenseKeys", + "licenseSignature", "licenseState", "master_guid", "mode", + "os_build", "os_name", "os_version", "serverName", "version"); + + ServiceInfo info = service.getInfo(); + for (String name : expected) + Assert.assertTrue(info.containsKey(name)); + + info.getBuild(); + info.getCpuArch(); + info.getGuid(); + info.getLicenseKeys(); + info.getLicenseLabels(); + info.getLicenseSignature(); + info.getLicenseState(); + info.getMasterGuid(); + info.getMode(); + info.getOsBuild(); + info.getOsName(); + info.getOsVersion(); + info.getServerName(); + info.getVersion(); + info.isFree(); + info.isRtSearchEnabled(); + info.isTrial(); + + Assert.assertEquals(info.getService(), service); + } + + private void checkLoggedIn(Service service) { + ResponseMessage response; + response = service.get("/services/authentication/users"); + checkResponse(response); + } + + protected void checkNotLoggedIn(Service service) { + try { + service.get("/services/authentication/users"); + Assert.fail("Expected HttpException"); + } + catch (HttpException e) { + Assert.assertEquals(401, e.getStatus()); + } + } + + @Test + public void testLogin() { + Service service = new Service( + (String) command.opts.get("host"), + (Integer) command.opts.get("port"), + (String) command.opts.get("scheme")); + + // Not logged in, should fail with 401 + checkNotLoggedIn(service); + + // Logged in, request should succeed + service.login( + (String) command.opts.get("username"), + (String) command.opts.get("password")); + checkLoggedIn(service); + + // Logout, the request should fail with a 401 + service.logout(); + checkNotLoggedIn(service); + } + + @Test + public void testServiceWithCustomHeaders() { + ServiceArgs args = new ServiceArgs(); + args.setHost((String) command.opts.get("host")); + args.setPort((Integer) command.opts.get("port")); + args.setScheme((String) command.opts.get("scheme")); + args.setUsername((String) command.opts.get("username")); + args.setPassword((String) command.opts.get("password")); + args.setHttpHeaders(new HashMap<String, String>() {{ + put("some header key", "some value"); + }}); + Service service = new Service(args); + Map<String, String> customHeaders = service.getCustomHeaders(); + Assert.assertEquals(customHeaders.get("some header key"), "some value"); + } + + @Test + public void testLoginWithoutArguments() { + ServiceArgs args = new ServiceArgs(); + args.setHost((String) command.opts.get("host")); + args.setPort((Integer) command.opts.get("port")); + args.setScheme((String) command.opts.get("scheme")); + args.setUsername((String) command.opts.get("username")); + args.setPassword((String) command.opts.get("password")); + Service service = new Service(args); + + checkNotLoggedIn(service); + + service.login(); + checkLoggedIn(service); + + service.logout(); + checkNotLoggedIn(service); + } + + @Test + public void testLoginWithArgumentsOverridesServiceArgs() { + ServiceArgs args = new ServiceArgs(); + args.setHost((String) command.opts.get("host")); + args.setPort((Integer) command.opts.get("port")); + args.setScheme((String) command.opts.get("scheme")); + args.setUsername("I can't possibly be a user"); + args.setPassword("This password is nonsense."); + Service service = new Service(args); + + checkNotLoggedIn(service); + + service.login( + (String) command.opts.get("username"), + (String) command.opts.get("password") + ); + checkLoggedIn(service); + + service.logout(); + checkNotLoggedIn(service); + } + + @Test(expected=IllegalStateException.class) + public void testLoginWithoutAnyUsernameFails() { + ServiceArgs args = new ServiceArgs(); + args.setHost((String) command.opts.get("host")); + args.setPort((Integer) command.opts.get("port")); + args.setScheme((String) command.opts.get("scheme")); + Service service = new Service(args); + + service.login(); + } + + @Test + public void testLoginWithToken() { + String validToken = service.getToken(); + + Assert.assertTrue(validToken.startsWith("Splunk ")); + + Service s = new Service(service.getHost(), service.getPort()); + s.setToken(validToken); + + // Ensure we can perform some action. + // In particular we don't expect an unauthenticated error. + s.getSettings().refresh(); + + // Make sure we're still using the same token. + // In particular we don't want to trigger auto-login functionality + // that gets a new token. + Assert.assertEquals(s.getToken(), validToken); + } + + @Test + public void testLoginWithOnlyTokenValue() { + String validToken = service.getToken(); + + ServiceArgs args = new ServiceArgs(); + args.setHost((String) command.opts.get("host")); + args.setUsername((String) command.opts.get("username")); + args.setPassword((String) command.opts.get("password")); + args.setPort((Integer) command.opts.get("port")); + args.setScheme((String) command.opts.get("scheme")); + + Service service2 = new Service(args); + service2.login(); + + // Manually removing Splunk keyword from preset token. + String modifiedToken = (service2.getToken().replace("Splunk", "")).trim(); + service2.setSplunkToken(modifiedToken); + + service2.getSettings().refresh(); + + Assert.assertEquals(service2.getToken(), validToken); + } + + @Test + public void testLoginGetters() { + Service s = new Service("theHost"); + try { + s.login("theUser", "thePassword"); + } catch (Exception e) { + // Don't care if login fails. It probably will. + } + + Assert.assertEquals("theUser", s.getUsername()); + Assert.assertEquals("thePassword", s.getPassword()); + } + + @Test + public void testJobs() throws InterruptedException { + JobCollection jobs = service.getJobs(); + for (Job entity : jobs.values()) + testGetters(entity); + + Job job = jobs.create("search * | head 1"); + + while (!job.isDone()) { + Thread.sleep(500); + } + + testGetters(job); + job.cancel(); + } + + // Perform some non-intrusive inspection of the given Job object. + private void testGetters(Job job) { + ready(job); + job.getDelegate(); + job.getDiskUsage(); + job.getDispatchState(); + job.getDoneProgress(); + job.getDropCount(); + job.getEarliestTime(); + job.getEventAvailableCount(); + job.getEventCount(); + job.getEventFieldCount(); + job.getEventIsStreaming(); + job.getEventIsTruncated(); + job.getEventSearch(); + job.getEventSorting(); + job.getKeywords(); + job.getLabel(); + job.getLatestTime(); + job.getNumPreviews(); + job.getPriority(); + job.getRemoteSearch(); + job.getReportSearch(); + job.getResultCount(); + job.getResultIsStreaming(); + job.getResultPreviewCount(); + job.getRunDuration(); + job.getScanCount(); + job.getSearch(); + job.getSearchEarliestTime(); + job.getSearchLatestTime(); + job.getSid(); + job.getStatusBuckets(); + job.getTtl(); + job.isDone(); + job.isFailed(); + job.isFinalized(); + job.isPaused(); + job.isPreviewEnabled(); + job.isRealTimeSearch(); + job.isSaved(); + job.isSavedSearch(); + job.isZombie(); + Assert.assertEquals(job.getName(), job.getSid()); + } + + @Test + public void testSettersAndGettersPattern() { + Settings settings = service.getSettings(); + + // Save + String originalHost = settings.getHost(); + int originalMinSpace = settings.getMinFreeSpace(); + + // Ensure setter updates local state + settings.setHost("sdk-host"); + Assert.assertEquals("sdk-host", settings.getHost()); + + // Ensure update() merges arguments with local state + settings.setHost("sdk-host2"); + settings.update(Args.create("minFreeSpace", 500)); + Assert.assertEquals("sdk-host2", settings.getHost()); + Assert.assertEquals(500, settings.getMinFreeSpace()); + + // Ensure update argument takes precedence over local state + settings.setMinimumFreeSpace(600); + settings.update(Args.create("minFreeSpace", 700)); + Assert.assertEquals(700, settings.getMinFreeSpace()); + + // Restore + { + settings.setHost(originalHost); + settings.setMinimumFreeSpace(originalMinSpace); + settings.update(); + + Assert.assertEquals(settings.getMinFreeSpace(), + originalMinSpace); + Assert.assertEquals(settings.getHost(), originalHost); + } + + // Twiddling the host value makes Splunk want to restart. + // No actual instability results, though. + clearRestartMessage(); + } + + @Test + public void testUsers() { + Args args; + User user; + + String username = "sdk-user"; + String password = "changeme!"; + + UserCollection users = service.getUsers(); + + // Cleanup potential prior failed test run. + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + + // Create user using base create method + { + args = new Args(); + args.put("password", password); + args.put("roles", "power"); + user = users.create(username, args); + + Assert.assertTrue(users.containsKey(username)); + Assert.assertEquals(username, user.getName()); + Assert.assertEquals(1, user.getRoles().length); + Assert.assertTrue(contains(user.getRoles(), "power")); + + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + } + + // Create user using derived create method + { + user = users.create(username, password, "power"); + + Assert.assertTrue(users.containsKey(username)); + Assert.assertEquals(username, user.getName()); + Assert.assertEquals(1, user.getRoles().length); + Assert.assertTrue(contains(user.getRoles(), "power")); + + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + } + + // Create using derived method with multiple roles + { + user = users.create( + username, password, new String[] { "power", "user" }); + + Assert.assertTrue(users.containsKey(username)); + Assert.assertEquals(username, user.getName()); + Assert.assertEquals(2, user.getRoles().length); + Assert.assertTrue(contains(user.getRoles(), "power")); + Assert.assertTrue(contains(user.getRoles(), "user")); + + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + } + + // Create using derived method with multiple roles and extra properties + { + args = new Args(); + args.put("realname", "Renzo"); + args.put("email", "email.me@now.com"); + args.put("defaultApp", "search"); + user = users.create( + username, password, new String[] { "power", "user" }, args); + + Assert.assertTrue(users.containsKey(username)); + Assert.assertEquals(username, user.getName()); + Assert.assertEquals(2, user.getRoles().length); + Assert.assertTrue(contains(user.getRoles(), "power")); + Assert.assertTrue(contains(user.getRoles(), "user")); + Assert.assertEquals("Renzo", user.getRealName()); + Assert.assertEquals("email.me@now.com", user.getEmail()); + Assert.assertEquals("search", user.getDefaultApp()); + Assert.assertNotNull(user.getPassword()); + user.getDefaultAppIsUserOverride(); + Assert.assertNotNull(user.getDefaultAppSourceRole()); + Assert.assertNotNull(user.getType()); + + // Probe + { + String tz = user.getTz(); + + user.setDefaultApp("search"); + user.setEmail("none@noway.com"); + user.setPassword("new-password"); + user.setRealName("SDK-name"); + if (service.versionCompare("4.3") >= 0) { + user.setRestartBackgroundJobs(false); + user.setTz("Pacific/Midway"); + } + user.setRoles("power"); + user.update(); + user.refresh(); + + Assert.assertEquals("search", user.getDefaultApp()); + Assert.assertEquals("none@noway.com", user.getEmail()); + Assert.assertEquals("SDK-name", user.getRealName()); + Assert.assertEquals(1, user.getRoles().length); + if (service.versionIsAtLeast("4.3")) { + Assert.assertEquals("Pacific/Midway", user.getTz()); + } + Assert.assertTrue(contains(user.getRoles(), "power")); + + if (service.versionIsAtLeast("4.3")) { + user.setTz(tz == null ? "" : tz); + } + user.setRoles(new String[] {"power"}); + user.update(); + user.refresh(); + Assert.assertTrue(contains(user.getRoles(), "power")); + } + + users.remove(username); + Assert.assertFalse(users.containsKey(username)); + } + } + + @SuppressWarnings("deprecation") + @Test + public void testClassicServiceArgs() { + ServiceArgs args = new ServiceArgs(); + args.app = "myapp"; + args.host = "myhost.splunk.com"; + args.owner = "myuser"; + args.port = 9999; + args.scheme = "https"; + args.token = "Splunk MY_SESSION_KEY"; + + Service service = new Service(args); + Assert.assertEquals(args.app, service.getApp()); + Assert.assertEquals(args.host, service.getHost()); + Assert.assertEquals(args.owner, service.getOwner()); + Assert.assertEquals((int) args.port, (int) service.getPort()); + Assert.assertEquals(args.scheme, service.getScheme()); + Assert.assertEquals(args.token, service.getToken()); + } + + @SuppressWarnings("deprecation") + @Test + public void testNewServiceArgs() { + ServiceArgs args = new ServiceArgs(); + args.setApp("myapp"); + args.setHost("myhost.splunk.com"); + args.setOwner("myuser"); + args.setPort(9999); + args.setScheme("https"); + args.setToken("Splunk MY_SESSION_KEY"); + + Assert.assertEquals("Arg setters didn't replicate value to deprecated fields.", + args.app, "myapp"); + + Service service = new Service(args); + Assert.assertEquals(args.app, service.getApp()); + Assert.assertEquals(args.host, service.getHost()); + Assert.assertEquals(args.owner, service.getOwner()); + Assert.assertEquals((int) args.port, (int) service.getPort()); + Assert.assertEquals(args.scheme, service.getScheme()); + Assert.assertEquals(args.token, service.getToken()); + } + + @Test + public void testNewServiceArgsAsMap() { + ServiceArgs args = new ServiceArgs(); + args.put("app", "myapp"); + args.put("host", "myhost.splunk.com"); + args.put("owner", "myuser"); + args.put("port", 9999); + args.put("scheme", "https"); + args.put("token", "Splunk MY_SESSION_KEY"); + + Service service = new Service(args); + Assert.assertEquals("myapp", service.getApp()); + Assert.assertEquals("myhost.splunk.com", service.getHost()); + Assert.assertEquals("myuser", service.getOwner()); + Assert.assertEquals(9999, (int) service.getPort()); + Assert.assertEquals("https", service.getScheme()); + Assert.assertEquals("Splunk MY_SESSION_KEY", service.getToken()); + } + + @Test + public void testNewServiceArgsWithDefaults() { + ServiceArgs args = new ServiceArgs(); + + Service service = new Service(args); + Assert.assertEquals(null, service.getApp()); + Assert.assertEquals("localhost", service.getHost()); + Assert.assertEquals(null, service.getOwner()); + Assert.assertEquals(8089, (int) service.getPort()); + Assert.assertEquals("https", service.getScheme()); + Assert.assertEquals(null, service.getToken()); + } + + @Test + public void testConstructors() { + Service s; + + s = new Service("localhost"); + Assert.assertEquals("localhost", s.getHost()); + Assert.assertEquals(8089, s.getPort()); + Assert.assertEquals("https", s.getScheme()); + + s = new Service("localhost", 9999); + Assert.assertEquals("localhost", s.getHost()); + Assert.assertEquals(9999, s.getPort()); + Assert.assertEquals("https", s.getScheme()); + + s = new Service("localhost", 9999, "http"); + Assert.assertEquals("localhost", s.getHost()); + Assert.assertEquals(9999, s.getPort()); + Assert.assertEquals("http", s.getScheme()); + } + + @Test + public void testSearch() throws IOException { + service.search(QUERY); // throws no exception + + Job job = service.search(QUERY, new Args()); + while (!job.isDone()) { + sleep(200); + } + + InputStream jobOutput = job.getResults(); + try { + ResultsReaderXml resultsReader = new ResultsReaderXml(jobOutput); + + Map<String, String> event; + int nEvents = 0; + + do { + event = resultsReader.getNextEvent(); + if (event != null) { + nEvents += 1; + } + } while (event != null); + + Assert.assertEquals(10, nEvents); + } + finally { + jobOutput.close(); + } + } + + @Test + public void testOneshot() throws IOException { + service.oneshotSearch(QUERY); // throws no exception + + InputStream jobOutput = service.oneshotSearch( + QUERY, + new Args("output_mode", "json") + ); + + try { + ResultsReaderJson resultsReader = new ResultsReaderJson(jobOutput); + + Map<String, String> event; + int nEvents = 0; + + do { + event = resultsReader.getNextEvent(); + if (event != null) { + nEvents += 1; + } + } while (event != null); + + Assert.assertEquals(10, nEvents); + } + finally { + jobOutput.close(); + } + } + + // === Utility === + + private static void checkResponse(ResponseMessage response) { + Assert.assertEquals(200, response.getStatus()); + + // Make sure we can at least load the Atom response + AtomFeed.parseStream(response.getContent()); + } + + // Wait for the given job to be ready + private static Job ready(Job job) { + while (!job.isReady()) { + sleep(10); + } + return job; + } + + @Test + public void testLoginWithNamespace() { + Args loginArgs = new Args(); + loginArgs.add("username", command.opts.get("username")); + loginArgs.add("password", command.opts.get("password")); + loginArgs.add("sharing", "user"); + loginArgs.add("owner", "admin"); + loginArgs.add("app", "search"); + loginArgs.add("host", command.opts.get("host")); + loginArgs.add("port", command.opts.get("port")); + + Service.connect(loginArgs); + } + + @Test + public void testHandleErrorsReturnedAsJson() { + JobExportArgs exportArgs = new JobExportArgs(); + + exportArgs.setOutputMode(JobExportArgs.OutputMode.JSON); + exportArgs.setSearchMode(JobExportArgs.SearchMode.REALTIME); + exportArgs.setEarliestTime("rt"); + exportArgs.setLatestTime("rt"); + + try { + service.export("notasearchcommand", exportArgs); + } catch (Exception e) { + Assert.assertTrue(e.getMessage().contains("Unknown search command")); + return; + } + Assert.fail(); + } + + @Test + public void testDelete() { + Args deleteArgs = Args.create("output_mode", "json"); + try { + service.delete("/services/search/jobs/foobar_doesntexist", deleteArgs); + } catch (HttpException e) { + Assert.assertEquals(404, e.getStatus()); + Assert.assertNotNull(e.getDetail()); + } + } + + @Test + public void testPost() { + HashMap<String, Object> args = new HashMap<String, Object>(); + args.put("foo", "bar"); + + ResponseMessage response; + response = service.post("/services/search/jobs", args); + Assert.assertEquals(200, response.getStatus()); + Assert.assertTrue(firstLineIsXmlDtd(response.getContent())); + } + + /* + Test whether the V2 and V1 Search APIs are switched properly based on the Type of Splunk Instance and Version. + */ + @Test + public void testEnableV2Api(){ + if(service.instanceType.equalsIgnoreCase("cloud")) { + if(service.versionIsEarlierThan("9.0.2209")){ + Assert.assertFalse(service.enableV2SearchApi()); + }else{ + Assert.assertTrue(service.enableV2SearchApi()); + } + }else{ + if(service.versionIsEarlierThan("9.0.2")){ + Assert.assertFalse(service.enableV2SearchApi()); + }else{ + Assert.assertTrue(service.enableV2SearchApi()); + } + } + } + + /* + Test when Service instance is created using token, it doesn't result in Null Pointer while accessing instanceType and version + */ + @Test + public void testServiceWithTokenAuth(){ + Service newService = new Service(service.getHost()); + newService.setToken(service.getToken()); + try{ + newService.enableV2SearchApi(); + newService.versionCompare("9.0.2"); + }catch (Exception ex){ + Assert.assertNull(ex); + } + } + +} diff --git a/splunk/src/test/java/com/splunk/SettingsTest.java b/splunk/src/test/java/com/splunk/SettingsTest.java new file mode 100644 index 00000000..d4d0218f --- /dev/null +++ b/splunk/src/test/java/com/splunk/SettingsTest.java @@ -0,0 +1,183 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +public class SettingsTest extends SDKTestCase { + + @Test + public void testGettersThrowNoExceptions() { + Settings settings = service.getSettings(); + + settings.getSplunkDB(); + settings.getSplunkHome(); + settings.getEnableSplunkWebSSL(); + settings.getHost(); + settings.getHttpPort(); + settings.getMgmtPort(); + settings.getMinFreeSpace(); + settings.getPass4SymmKey(); + settings.getServerName(); + settings.getSessionTimeout(); + settings.getStartWebServer(); + settings.getTrustedIP(); + } + + // This test can't properly work when Splunk is running on a different + // machine, so we just remove it for now. + /*@Test + public void testHttpPortSetter() throws Exception { + Settings settings = service.getSettings(); + + int originalHttpPort = settings.getHttpPort(); + if (!isPortInUse(originalHttpPort)) { + // Try to clean up from weird state where splunkweb isn't running + System.out.println( + "WARNING: splunkweb seems to be down. " + + "Trying to recover..."); + uncheckedSplunkRestart(); + waitForSplunkwebUp(originalHttpPort); + } + Assert.assertTrue(isPortInUse(originalHttpPort)); + + int newPort = originalHttpPort + 1; + while (isPortInUse(newPort)) { + newPort++; + } + changeHttpPort(newPort); + Assert.assertTrue(isPortInUse(newPort)); + Assert.assertFalse(isPortInUse(originalHttpPort)); + + changeHttpPort(originalHttpPort); + Assert.assertTrue(isPortInUse(originalHttpPort)); + Assert.assertFalse(isPortInUse(newPort)); + }*/ + + private void changeHttpPort(int newHttpPort) { + Settings settings = service.getSettings(); + settings.setHttpPort(newHttpPort); + settings.update(); + + // If you change the splunkweb port, a new splunkweb instance + // will be created on the new port. However the old splunkweb instance + // will remain until you do a full restart. + splunkRestart(); + waitForSplunkwebUp(newHttpPort); + + settings = service.getSettings(); + Assert.assertEquals(newHttpPort, settings.getHttpPort()); + } + + private void waitForSplunkwebUp(final int httpPort) { + // Wait for splunkweb to come back up + assertEventuallyTrue(new EventuallyTrueBehavior() { + { + tries = 20; + pauseTime = 1000; + } + + public boolean predicate() { + return isPortInUse(httpPort); + } + }); + } + + @Test + public void testMangementPort() throws Exception { + Settings settings = service.getSettings(); + int managementPort = settings.getMgmtPort(); + + settings.setMgmtPort(29111); + settings.update(); + settings.refresh(); + + Assert.assertEquals(29111, settings.getMgmtPort()); + + settings.setMgmtPort(managementPort); + settings.update(); + splunkRestart(); + } + + @Test + public void testSymmKey() throws Exception { + Settings settings = service.getSettings(); + String key = settings.getPass4SymmKey(); + + settings.setPasswordSymmKey(key + "_foo"); + settings.update(); + settings.refresh(); + + Assert.assertEquals(key + "_foo", settings.getPass4SymmKey()); + + settings.setPasswordSymmKey(key); + settings.update(); + splunkRestart(); + } + + @Test + public void testOtherSetters() throws Exception { + Settings settings = service.getSettings(); + + // Save original settings + String originalTimeout = settings.getSessionTimeout(); + boolean originalSSL = settings.getEnableSplunkWebSSL(); + String originalHost = settings.getHost(); + int originalMinSpace = settings.getMinFreeSpace(); + //int originalMgmtPort = settings.getMgmtPort(); + String originalServerName = settings.getServerName(); + boolean originalStartWeb = settings.getStartWebServer(); + + // Update + settings.setEnableSplunkWebSSL(!originalSSL); + settings.setHost("sdk-host"); + settings.setMinimumFreeSpace(originalMinSpace-100); + //settings.setMgmtHostPort(originalMgmtPort+1); + settings.setServerName("sdk-test-name"); + settings.setSessionTimeout("2h"); + //settings.setStartWebServer(!originalStartWeb); + settings.update(); + + clearRestartMessage(); + + Assert.assertEquals(!originalSSL, settings.getEnableSplunkWebSSL()); + Assert.assertEquals("sdk-host", settings.getHost()); + Assert.assertEquals(originalMinSpace - 100, settings.getMinFreeSpace()); + Assert.assertEquals("sdk-test-name", settings.getServerName()); + Assert.assertEquals("2h", settings.getSessionTimeout()); + //Assert.assertEquals(settings.getStartWebServer(), !originalStartWeb); + + // Restore + settings.setEnableSplunkWebSSL(originalSSL); + settings.setHost(originalHost); + settings.setMinimumFreeSpace(originalMinSpace); + settings.setServerName(originalServerName); + settings.setSessionTimeout(originalTimeout); + settings.setStartWebServer(originalStartWeb); + settings.update(); + + clearRestartMessage(); + + Assert.assertEquals(originalSSL, settings.getEnableSplunkWebSSL()); + Assert.assertEquals(originalHost, settings.getHost()); + Assert.assertEquals(originalMinSpace, settings.getMinFreeSpace()); + Assert.assertEquals(originalServerName, settings.getServerName()); + Assert.assertEquals(originalTimeout, settings.getSessionTimeout()); + Assert.assertEquals(originalStartWeb, settings.getStartWebServer()); + } +} diff --git a/splunk/src/test/java/com/splunk/TcpInputTest.java b/splunk/src/test/java/com/splunk/TcpInputTest.java new file mode 100644 index 00000000..543501e6 --- /dev/null +++ b/splunk/src/test/java/com/splunk/TcpInputTest.java @@ -0,0 +1,202 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; + +import java.io.IOException; +import java.io.OutputStream; +import java.io.PrintStream; +import java.net.Socket; + +public class TcpInputTest extends SDKTestCase { + private int tcpPort = -1; + private TcpInput tcpInput = null; + private String indexName; + private Index index = null; + + @Before + public void setUp() throws Exception { + super.setUp(); + + indexName = createTemporaryName(); + index = service.getIndexes().create(indexName); + + String tcpPortString = System.getenv("TEST_TCP_PORT"); + + if (tcpPortString == null) { + tcpPort = findNextUnusedPort(10000); + } + else { + tcpPort = Integer.parseInt(tcpPortString); + } + + tcpInput = service.getInputs().create( + String.valueOf(tcpPort), + InputKind.Tcp, + new Args("index", indexName)); + } + + @After + public void tearDown() throws Exception { + if (index != null && service.versionCompare("5.0") >= 0 && System.getenv("TRAVIS") == null) { + index.remove(); + } + + // WORKAROUND (SPL-75101): Removing TCP inputs doesn't work on Windows in Splunk 6.0.0. The HTTP call + // hangs forever, and, though the input vanishes from the REST API, the port is never unbound and cannot be + // reused until Splunk restarts. + if (service.versionCompare("6.0.0") != 0 || !service.getInfo().getOsName().equals("Windows")) { + if (tcpInput != null) { + tcpInput.remove(); + } + } + + super.tearDown(); + } + + @Test + public void testConnectionList() throws IOException { + // WORKAROUND (SPL-74835): Connections to the TCP input newly created in setUp will not be listed in + // Splunk 6.0.0 until after the next restart of splunkd. + if (service.versionCompare("6.0.0") == 0) { + uncheckedSplunkRestart(); + } + + final Socket socket = tcpInput.attach(); + Assert.assertTrue(socket.isConnected()); + + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 15; } + + @Override + public boolean predicate() { + TcpConnections connections = tcpInput.connections(); + String connection = connections.getConnection(); + String servername = connections.getServername(); + + if (connection == null && servername == null) { + return false; + } + + try { + socket.close(); + } catch (IOException e) { + Assert.fail("Should not throw!"); + } + + return true; + } + }); + } + + @Test + public void testGetters() { + Assert.assertNotNull(tcpInput.getGroup()); + Assert.assertNull(tcpInput.getRestrictToHost()); + + tcpInput.setDisabled(false); + tcpInput.update(); + } + + @Test + public void testAttachAndWrite() throws IOException { + writeEventsTo(tcpInput.attach()); + writeEventsTo(service.open(tcpInput.getPort())); + } + + private void writeEventsTo(Socket socket) throws IOException { + final int nEvents = index.getTotalEventCount(); + + PrintStream output = new PrintStream(socket.getOutputStream()); + output.print(createTimestamp() + " Boris the mad baboon!\r\n"); + output.flush(); + socket.close(); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { tries = 50; } + + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == nEvents + 1; + } + }); + } + + @Test + public void testSubmit() throws IOException { + final int nEvents = index.getTotalEventCount(); + + this.tcpInput.submit(createTimestamp() + " Boris the mad baboon!\r\n"); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == nEvents + 1; + } + }); + } + + @Test + public void testAttachWith() throws IOException { + final int nEvents = index.getTotalEventCount(); + final Index index = this.index; + + this.tcpInput.attachWith(new ReceiverBehavior() { + public void run(OutputStream stream) throws IOException { + String s = createTimestamp() + " Boris the mad baboon!\r\n"; + stream.write(s.getBytes("UTF-8")); + } + }); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == nEvents + 1; + } + }); + } + + // TODO: Move to InputTest once it has been ported over to the new suite. + @Test + public void testGetInputKindOfScript() { + Input scriptInput = new Input(service, "/data/inputs/script/$SPLUNK_HOME/etc/apps/myapp/bin/myscript.py"); + Assert.assertEquals(InputKind.Script, scriptInput.getKind()); + + Input scriptInputWin = new Input(service, "/data/inputs/script/$SPLUNK_HOME\\etc\\apps\\myapp\\bin\\myscript.py"); + Assert.assertEquals(InputKind.Script, scriptInputWin.getKind()); + + Input tcpRawInput = new Input(service, "/data/inputs/tcp/raw/6666"); + Assert.assertEquals(InputKind.Tcp, tcpRawInput.getKind()); + + Input tcpCookedInput = new Input(service, "/data/inputs/tcp/cooked/6666"); + Assert.assertEquals(InputKind.TcpSplunk, tcpCookedInput.getKind()); + + Input udpInput = new Input(service, "/data/inputs/udp/6666"); + Assert.assertEquals(InputKind.Udp, udpInput.getKind()); + + Input modularInput = new Input(service, "/data/inputs/my_modular_input/input_name"); + Assert.assertEquals(InputKind.create("my_modular_input"), modularInput.getKind()); + } +} diff --git a/splunk/src/test/java/com/splunk/TestDataNotInstalledException.java b/splunk/src/test/java/com/splunk/TestDataNotInstalledException.java new file mode 100644 index 00000000..444e799b --- /dev/null +++ b/splunk/src/test/java/com/splunk/TestDataNotInstalledException.java @@ -0,0 +1,25 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +public class TestDataNotInstalledException extends RuntimeException { + public TestDataNotInstalledException() { + super( + "The test data is not installed in your splunkd. " + + "Please see the documentation to install the test data."); + } +} diff --git a/splunk/src/test/java/com/splunk/UdpInputTest.java b/splunk/src/test/java/com/splunk/UdpInputTest.java new file mode 100644 index 00000000..149b0ef5 --- /dev/null +++ b/splunk/src/test/java/com/splunk/UdpInputTest.java @@ -0,0 +1,85 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.After; +import org.junit.Before; +import org.junit.Test; + +public class UdpInputTest extends SDKTestCase { + protected int udpPort; + protected UdpInput udpInput = null; + protected String indexName; + protected Index index = null; + + @Before + public void setUp() throws Exception { + super.setUp(); + + indexName = createTemporaryName(); + index = service.getIndexes().create(indexName); + + String udpPortString = System.getenv("TEST_UDP_PORT"); + + if (udpPortString == null) { + udpPort = 10000; + while (service.getInputs().containsKey(Integer.toString(udpPort))) { + udpPort++; + } + } + else { + udpPort = Integer.parseInt(udpPortString); + } + + udpInput = service.getInputs().create( + String.valueOf(udpPort), + InputKind.Udp, + new Args("index", indexName)); + } + + @After + public void tearDown() throws Exception { + if (index != null && service.versionCompare("5.0") >= 0 && System.getenv("TRAVIS") == null) { + index.remove(); + } + if (udpInput != null) { + udpInput.remove(); + } + + super.tearDown(); + } + + @Test + public void testSubmit() throws Exception { + final int nEvents = index.getTotalEventCount(); + + udpInput.submit(createTimestamp() + " Boris the mad baboon!\r\n"); + + assertEventuallyTrue(new EventuallyTrueBehavior() { + { + tries = 60; + } + + @Override + public boolean predicate() { + index.refresh(); + return index.getTotalEventCount() == nEvents + 1; + } + }); + } + +} diff --git a/splunk/src/test/java/com/splunk/UploadTest.java b/splunk/src/test/java/com/splunk/UploadTest.java new file mode 100644 index 00000000..f1549bcd --- /dev/null +++ b/splunk/src/test/java/com/splunk/UploadTest.java @@ -0,0 +1,45 @@ +/* + * Copyright 2011 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Test; + +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; +import java.util.Date; + +public class UploadTest extends SDKTestCase { + @Test + public void testOneshot() { + String filename = locateSystemLog(); + if (System.getenv("SPLUNK_HOME") != null) { + filename = System.getenv("SPLUNK_HOME") + "/copyright.txt"; + } + + service.getUploads().create(filename); + + for (Upload oneshot : service.getUploads().values()) { + oneshot.getBytesIndexed(); + oneshot.getOffset(); + oneshot.getSize(); + oneshot.getSize(); + oneshot.getSourcesIndexed(); + oneshot.getSpoolTime(); + } + } +} diff --git a/splunk/src/test/java/com/splunk/UtilTest.java b/splunk/src/test/java/com/splunk/UtilTest.java new file mode 100644 index 00000000..a4a582e4 --- /dev/null +++ b/splunk/src/test/java/com/splunk/UtilTest.java @@ -0,0 +1,92 @@ +/* + * Copyright 2012 Splunk, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"): you may + * not use this file except in compliance with the License. You may obtain + * a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + */ + +package com.splunk; + +import org.junit.Assert; +import org.junit.Test; + +import java.util.ArrayList; +import java.util.List; + +public class UtilTest extends SDKTestCase { + @Test + public void testJoin() { + List<String> emptyList = new ArrayList<String>(); + Assert.assertEquals("", Util.join("/", emptyList)); + + List<String> oneElementList = new ArrayList<String>(); + oneElementList.add("abcd"); + Assert.assertEquals("abcd", Util.join("/", oneElementList)); + + List<String> fullList = new ArrayList<String>(); + fullList.add("abcd"); + fullList.add("defg"); + Assert.assertEquals( + "abcd/defg", + Util.join("/", fullList) + ); + } + + @Test + public void testJoinOnArray() { + String[] emptyArray = {}; + Assert.assertEquals("", Util.join("/", emptyArray)); + + String[] oneElementArray = {"abcd"}; + Assert.assertEquals("abcd", Util.join("/", oneElementArray)); + + String[] fullArray = {"abcd", "defg"}; + Assert.assertEquals( + "abcd/defg", + Util.join("/", fullArray) + ); + } + + @Test + public void testSubstringAfterSucceeds() { + Assert.assertEquals( + "efg", + Util.substringAfter("abcdefg", "cd", "boris") + ); + } + + @Test + public void testSubstringAfterFails() { + Assert.assertEquals( + "boris", + Util.substringAfter("abcdefg", "pq", "boris") + ); + } + + @Test + public void testArgs() { + Args args = Args.create(); + Assert.assertTrue(args != null); + Assert.assertTrue(args instanceof Args); + + Assert.assertTrue(Args.encode((String) null).equals("")); + } + + @Test(expected=Exception.class) + public void testValue() { + Assert.assertEquals(1024, Value.toByteCount("1KB")); + Assert.assertEquals(1024 * 1024, Value.toByteCount("1MB")); + Assert.assertEquals(1024 * 1024 * 1024, Value.toByteCount("1GB")); + + Value.toByteCount("0GGGGB"); + } +} diff --git a/splunk/src/test/java/com/splunk/modularinput/EventTest.java b/splunk/src/test/java/com/splunk/modularinput/EventTest.java new file mode 100644 index 00000000..5d95cb86 --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/EventTest.java @@ -0,0 +1,183 @@ +package com.splunk.modularinput; + +import org.junit.Assert; +import org.junit.Test; +import org.w3c.dom.Document; + +import javax.xml.parsers.ParserConfigurationException; +import javax.xml.stream.XMLOutputFactory; +import javax.xml.stream.XMLStreamException; +import javax.xml.stream.XMLStreamWriter; +import javax.xml.transform.TransformerException; +import java.io.IOException; +import java.io.StringWriter; +import java.util.Date; +import java.util.logging.Level; + +/** + * Checks if Event and EventWriter behavior correctly. + */ +public class EventTest extends ModularInputTestCase { + /** + * An event without a data field should throw an error when asked to write itself onto a stream. Be sure + * that it does. + */ + @Test + public void testEventWithoutEnoughFieldsFails() throws XMLStreamException { + StringWriter sb = new StringWriter(); + XMLStreamWriter writer = XMLOutputFactory.newInstance().createXMLStreamWriter(sb); + + Event event = new Event(); + + try { + event.writeTo(writer); + } catch (MalformedDataException e) { + Assert.assertTrue(true); + return; + } + Assert.fail(); + } + + /** + * Generate XML from an event object with a small number of fields, and see if it matches what we expect. + */ + @Test + public void testXmlOfEventWithMinimalConfiguration() throws XMLStreamException, MalformedDataException, TransformerException, + ParserConfigurationException { + StringWriter sb = new StringWriter(); + XMLStreamWriter writer = XMLOutputFactory.newInstance().createXMLStreamWriter(sb); + + Event event = new Event(); + event.setTime(new Date(1372187084000L)); + event.setStanza("fubar"); + event.setData("This is a test of the emergency broadcast system."); + event.writeTo(writer); + Document found = stringToXmlDocument(sb.toString()); + + Document expected = resourceToXmlDocument("/modularinput/data/event_minimal.xml"); + + assertXmlEqual(expected, found); + } + + /** + * Generate XML from an event with all its fields set, and see if it matches what we expect. + */ + @Test + public void testXmlOfEventWithMoreConfiguration() throws MalformedDataException, XMLStreamException, TransformerException, + ParserConfigurationException { + StringWriter sb = new StringWriter(); + XMLStreamWriter writer = XMLOutputFactory.newInstance().createXMLStreamWriter(sb); + + Event event = new Event(); + event.setTime(new Date(1372274622493L)); + event.setStanza("fubar"); + event.setData("This is a test of the emergency broadcast system."); + event.setHost("localhost"); + event.setIndex("main"); + event.setSource("hilda"); + event.setSourceType("misc"); + event.setDone(true); + event.setUnbroken(true); + event.writeTo(writer); + Document found = stringToXmlDocument(sb.toString()); + + Document expected = resourceToXmlDocument("/modularinput/data/event_maximal.xml"); + + assertXmlEqual(expected, found); + } + + /** + * Write a pair of events with an EventWriter, and ensure that they are being encoded immediately and correctly + * onto the output stream. + */ + @Test + public void testWritingEventsOnEventWriter() throws XMLStreamException, TransformerException, + ParserConfigurationException, MalformedDataException { + StringWriter out = new StringWriter(); + StringWriter err = new StringWriter(); + + EventWriter ew = new EventWriter(out, err); + + Event event = new Event(); + event.setTime(new Date(1372275124466L)); + event.setStanza("fubar"); + event.setData("This is a test of the emergency broadcast system."); + event.setHost("localhost"); + event.setIndex("main"); + event.setSource("hilda"); + event.setSourceType("misc"); + event.setDone(true); + event.setUnbroken(true); + ew.writeEvent(event); + + Document found = stringToXmlDocument(out.toString() + "</stream>"); + Document expected = resourceToXmlDocument("/modularinput/data/stream_with_one_event.xml"); + + assertXmlEqual(expected, found); + Assert.assertEquals("", err.toString()); + + err.getBuffer().setLength(0); + + ew.writeEvent(event); + ew.close(); + + found = stringToXmlDocument(out.toString()); + expected = resourceToXmlDocument("/modularinput/data/stream_with_two_events.xml"); + assertXmlEqual(expected, found); + } + + /** + * An event which cannot write itself onto an output stream (such as because it doesn't have a data field set) + * should write an error to stderr. Check that it does so. + */ + @Test + public void testErrorInEventWriter() throws XMLStreamException { + StringWriter out = new StringWriter(); + StringWriter err = new StringWriter(); + + EventWriter ew = new EventWriter(out, err); + + Event event = new Event(); + try { + ew.writeEvent(event); + } catch (MalformedDataException e) { + Assert.assertTrue(err.toString().startsWith("WARN")); + return; + } + Assert.fail(); + } + + /** + * Check that the log method on EventWriter produces the expected error message on the stderr stream. + */ + @Test + public void testLoggingErrorsWithEventWriter() throws XMLStreamException, IOException { + StringWriter out = new StringWriter(); + StringWriter err = new StringWriter(); + + EventWriter ew = new EventWriter(out, err); + + ew.log(EventWriter.ERROR, "Something happened!"); + + Assert.assertEquals("ERROR Something happened!\n", err.toString()); + } + + /** + * Check that EventWriter.writeXmlDocument writes sensible XML to the output stream. + */ + @Test + public void testWriteXmlDocumentIsSane() throws XMLStreamException, IOException, TransformerException, ParserConfigurationException { + StringWriter out = new StringWriter(); + StringWriter err = new StringWriter(); + + EventWriter ew = new EventWriter(out, err); + + Document expectedXml = resourceToXmlDocument("/modularinput/data/event_maximal.xml"); + + ew.writeXmlDocument(expectedXml); + Document foundXml = stringToXmlDocument(out.toString()); + + assertXmlEqual(expectedXml, foundXml); + } + +} diff --git a/splunk/src/test/java/com/splunk/modularinput/InputDefinitionTest.java b/splunk/src/test/java/com/splunk/modularinput/InputDefinitionTest.java new file mode 100644 index 00000000..aa9fe324 --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/InputDefinitionTest.java @@ -0,0 +1,90 @@ +package com.splunk.modularinput; + +import com.splunk.SDKTestCase; +import org.junit.Assert; +import org.junit.Test; +import org.xml.sax.SAXException; + +import javax.xml.parsers.ParserConfigurationException; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.List; + +/** + * Test the parsing of InputDefinition classes from XML. + */ +public class InputDefinitionTest extends ModularInputTestCase { + /** + * Check whether the InputDefinition parsed from a stream with metadata and zero inputs is what we expect. + */ + @Test + public void testParseStreamWithZeroInputs() throws IOException, SAXException, ParserConfigurationException, + MalformedDataException { + InputDefinition expectedDefinition = new InputDefinition(); + expectedDefinition.setServerHost("tiny"); + expectedDefinition.setServerUri("https://127.0.0.1:8089"); + expectedDefinition.setCheckpointDir("/some/dir"); + expectedDefinition.setSessionKey("123102983109283019283"); + + InputStream stream = SDKTestCase.openResource("/modularinput/data/conf_with_0_inputs.xml"); + InputDefinition foundDefinition = InputDefinition.parseDefinition(stream); + + Assert.assertTrue(expectedDefinition.equals(foundDefinition)); + } + + /** + * Check whether the InputDefinition parsed from a stream with metadata and three inputs is what we expect. + */ + @Test + public void testParseStreamWithThreeInputs() throws ParserConfigurationException, SAXException, + MalformedDataException, IOException { + InputDefinition expectedDefinition = new InputDefinition(); + expectedDefinition.setServerHost("tiny"); + expectedDefinition.setServerUri("https://127.0.0.1:8089"); + expectedDefinition.setCheckpointDir("/some/dir"); + expectedDefinition.setSessionKey("123102983109283019283"); + + List<Parameter> parameters = new ArrayList<Parameter>(); + parameters.add(new SingleValueParameter("param1", "value1")); + parameters.add(new SingleValueParameter("param2", "value2")); + parameters.add(new SingleValueParameter("disabled", "0")); + parameters.add(new SingleValueParameter("index", "default")); + expectedDefinition.addInput("foobar://aaa", parameters); + + parameters = new ArrayList<Parameter>(); + parameters.add(new SingleValueParameter("param1", "value11")); + parameters.add(new SingleValueParameter("param2", "value22")); + parameters.add(new SingleValueParameter("disabled", "0")); + parameters.add(new SingleValueParameter("index", "default")); + parameters.add(new MultiValueParameter("multiValue") {{ + appendValue("value1"); + appendValue("value2"); + }}); + parameters.add(new MultiValueParameter("multiValue2") {{ + appendValue("value3"); + appendValue("value4"); + }}); + expectedDefinition.addInput("foobar://bbb", parameters); + + InputStream stream = SDKTestCase.openResource("/modularinput/data/conf_with_2_inputs.xml"); + InputDefinition foundDefinition = InputDefinition.parseDefinition(stream); + + Assert.assertTrue(expectedDefinition.equals(foundDefinition)); + } + + /** + * Checks that parsing an InputDefinition from malformed XML produces the expected exception. + */ + @Test + public void testParseMalformedInputDefinition() throws ParserConfigurationException, SAXException, IOException { + try { + InputStream stream = SDKTestCase.openResource("/modularinput/data/conf_with_invalid_inputs.xml"); + InputDefinition foundDefinition = InputDefinition.parseDefinition(stream); + } catch (MalformedDataException e) { + Assert.assertTrue(true); + return; + } + Assert.fail(); + } +} diff --git a/splunk/src/test/java/com/splunk/modularinput/ModularInputTestCase.java b/splunk/src/test/java/com/splunk/modularinput/ModularInputTestCase.java new file mode 100644 index 00000000..ef0a7c92 --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/ModularInputTestCase.java @@ -0,0 +1,220 @@ +package com.splunk.modularinput; + +import com.splunk.SDKTestCase; +import org.junit.Assert; +import org.junit.Test; +import org.w3c.dom.*; +import org.xml.sax.SAXException; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import javax.xml.transform.OutputKeys; +import javax.xml.transform.Transformer; +import javax.xml.transform.TransformerException; +import javax.xml.transform.TransformerFactory; +import javax.xml.transform.dom.DOMSource; +import javax.xml.transform.stream.StreamResult; +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.StringWriter; + +public class ModularInputTestCase { + /** + * XML parsing may introduce text nodes containing only white space between elements. These are purely formatting + * in our case, so we want to eliminate them. + * + * @param node a org.w3c.dom.Node object containing XML. + */ + public static void removeBlankTextNodes(Element node) { + NodeList children = node.getChildNodes(); + + // Iterate backwards through the collection since we're going to be removing elements + for (int i = children.getLength() - 1; i >= 0; i--) { + Node child = children.item(i); + if (child instanceof Text && ((Text)child).getData().trim().length() == 0) { + node.removeChild(child); + } + else if (child instanceof Element) { + removeBlankTextNodes((Element) child); + } + } + } + + /** + * Assert whether two org.w3c.dom.Node objects contain identical XML, ignoring whitespace. If they do not match, + * assertXmlEqual will recursively descend through the element tree to find where they do not match. + * + * @param expected an org.w3c.dom.Node object containing the expected XML document. + * @param found an org.w3c.dom.Node object containing the XML document actually produced. + * @throws javax.xml.transform.TransformerException + * @throws javax.xml.parsers.ParserConfigurationException + */ + public void assertXmlEqual(Node expected, Node found) throws TransformerException, ParserConfigurationException { + try { + Assert.assertTrue(expected.isEqualNode(found)); + } catch (AssertionError e) { + NodeList expectedChildren = expected.getChildNodes(); + NodeList foundChildren = found.getChildNodes(); + if (expectedChildren.getLength() != foundChildren.getLength()) { + throw new AssertionError("Expected node: \n" + + nodeToXml(expected) + "\n" + + "Generated node:\n" + + nodeToXml(found)); + } + for (int i = 0; i < expectedChildren.getLength(); i++) { + assertXmlEqual(expectedChildren.item(i), foundChildren.item(i)); + } + if (expected.getNodeType() == expected.TEXT_NODE && found.getNodeType() == found.TEXT_NODE) { + Assert.assertEquals(((Text)expected).getData(), ((Text)found).getData()); + } + throw new AssertionError("Parents unequal but couldn't find unmatched child in node " + expected.getNodeName()); + } + } + + /** + * Assert whether two org.w3c.dom.Document objects contain identical XML, ignoring whitespace. If they do not match, + * assertXmlEqual will recursively descend through the element tree to find where they do not match. + * + * @param expected an org.w3c.dom.Document object containing the expected XML document. + * @param found an org.w3c.dom.Document object containing the XML document actually produced. + * @throws javax.xml.transform.TransformerException + * @throws javax.xml.parsers.ParserConfigurationException + */ + public void assertXmlEqual(Document expected, Document found) throws TransformerException, ParserConfigurationException { + removeBlankTextNodes(expected.getDocumentElement()); + removeBlankTextNodes(found.getDocumentElement()); + expected.normalizeDocument(); + found.normalizeDocument(); + + assertXmlEqual((Node) expected, (Node) found); + } + + /** + * Open a resource from the Splunk SDK for Java project and parse it into an org.w3c.dom.Document object. + * + * @param path a path relative to the test directory of the SDK. + * @return an org.w3c.dom.Document object containing the parsed XML. + */ + public Document resourceToXmlDocument(String path) { + DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setIgnoringElementContentWhitespace(true); + DocumentBuilder documentBuilder = null; + try { + documentBuilder = documentBuilderFactory.newDocumentBuilder(); + } catch (ParserConfigurationException e) { + throw new AssertionError("Parser configuration failed: " + e.toString()); + } + + InputStream resource = SDKTestCase.openResource(path); + try { + Document doc = documentBuilder.parse(resource); + return doc; + } catch (SAXException e) { + throw new AssertionError("Could not parse XML file at " + path); + } catch (IOException e) { + throw new AssertionError("Could not read XML file at " + path); + } + } + + /** + * Parse XML in a string into an org.w3c.dom.Document object. + * + * @param xml a String containing XML. + * @return an org.w3c.dom.Document object. + */ + public Document stringToXmlDocument(String xml) { + DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setIgnoringElementContentWhitespace(true); + DocumentBuilder documentBuilder = null; + try { + documentBuilder = documentBuilderFactory.newDocumentBuilder(); + } catch (ParserConfigurationException e) { + throw new AssertionError("Could not configure parser: " + e.toString()); + } + + Document generatedDoc = null; + try { + generatedDoc = documentBuilder.parse(new ByteArrayInputStream(xml.getBytes("UTF-8"))); + return generatedDoc; + } catch (SAXException e) { + e.printStackTrace(); + throw new AssertionError("Error parsing XML passed to function: " + e.toString()); + } catch (IOException e) { + e.printStackTrace(); + throw new AssertionError("Error reading XML passed to function: " + e.toString()); + } + } + + /** + * Transform the given org.w3c.dom.Node object into a String containing the corresponding XML. + * + * This function is primarily for showing sensible error messages. + * + * @param node the org.w3c.dom.Node object to serialize. + * @return a String containing generated XML. + * @throws TransformerException + * @throws ParserConfigurationException + */ + public String nodeToXml(Node node) throws TransformerException, ParserConfigurationException { + TransformerFactory transformerFactory = TransformerFactory.newInstance(); + Transformer transformer = transformerFactory.newTransformer(); + transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); + transformer.setOutputProperty(OutputKeys.INDENT, "yes"); + transformer.setOutputProperty(OutputKeys.VERSION, "1.0"); + transformer.setOutputProperty(OutputKeys.STANDALONE, "yes"); + + Document doc = node.getOwnerDocument(); + + DOMSource source = new DOMSource(doc); + StringWriter buffer = new StringWriter(); + StreamResult result = new StreamResult(buffer); + transformer.transform(source, result); + String xml = buffer.toString(); + return xml; + } + + /** + * Tries the known cases supported by XmlUtil.normalizeBoolean, and asserts that it throws an error + * when passed an unknown case. + */ + @Test + public void testNormalizeBoolean() throws MalformedDataException { + String[] trueValues = new String[] {"true", "t", "TRUE ", "y", " YeS", "1", "ON"}; + String[] falseValues = new String[] {"false", "f", "FALSE ", " oFF", "no", "0", "n"}; + String[] invalidValues = new String[] {null, "boris", "fal"}; + + for (String s : trueValues) { + Assert.assertTrue(XmlUtil.normalizeBoolean(s)); + } + + for (String s : falseValues) { + Assert.assertFalse(XmlUtil.normalizeBoolean(s)); + } + + boolean fail; + for (String s : invalidValues) { + fail = true; + try { + XmlUtil.normalizeBoolean(null); + } catch (MalformedDataException e) { + fail = false; + } finally { + Assert.assertFalse(fail); + } + } + } + + /** + * Test the methods on SingleValueParameter to coerce its value to a boolean or various kinds of numbers. + */ + @Test + public void testCoercionMethods() throws MalformedDataException { + Assert.assertEquals(true, new SingleValueParameter("name", "TRuE ").getBoolean()); + Assert.assertEquals(5, new SingleValueParameter("name", "5").getInt()); + Assert.assertEquals(27, new SingleValueParameter("name", "27").getLong()); + Assert.assertEquals(5.2, new SingleValueParameter("name", "5.2").getFloat(), 1e-6); + Assert.assertEquals(5.2, new SingleValueParameter("name", "5.2").getDouble(), 1e-6); + } +} diff --git a/splunk/src/test/java/com/splunk/modularinput/SchemeTest.java b/splunk/src/test/java/com/splunk/modularinput/SchemeTest.java new file mode 100644 index 00000000..b01ced04 --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/SchemeTest.java @@ -0,0 +1,98 @@ +package com.splunk.modularinput; + +import org.junit.Test; +import org.w3c.dom.Document; + +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import javax.xml.transform.TransformerException; + +/** + * Tests for the com.splunk.modularinput.Scheme and com.splunk.modularinput.Argument classes that define a modular + * input scheme to send to Splunk. + */ +public class SchemeTest extends ModularInputTestCase { + /** + * Checks the Scheme generated by creating a Scheme object and setting no fields on it. This test checks for + * sane defaults in the class. + */ + @Test + public void testGenerateXmlFromSchemeWithDefaultValues() throws TransformerException, ParserConfigurationException { + // Generate a scheme with as many defaults in place as possible. + Scheme scheme = new Scheme("abcd"); + + Document generatedDocument = scheme.toXml(); + Document expectedDocument = resourceToXmlDocument("/modularinput/data/scheme_with_defaults.xml"); + + assertXmlEqual(expectedDocument, generatedDocument); + } + + /** + * Checks that the XML generated by a Scheme object with all its fields set and some arguments added matches + * what we expect. + */ + @Test + public void testGenerateXmlFromScheme() throws TransformerException, ParserConfigurationException { + Scheme scheme = new Scheme("abcd"); + scheme.setDescription("\uC3BC and \uC3B6 and <&> f\u00FCr"); + scheme.setStreamingMode(Scheme.StreamingMode.SIMPLE); + scheme.setUseExternalValidation(false); + scheme.setUseSingleInstance(true); + + Argument arg1 = new Argument("arg1"); + scheme.addArgument(arg1); + + Argument arg2 = new Argument("arg2"); + arg2.setDescription("\uC3BC and \uC3B6 and <&> f\u00FCr"); + arg2.setDataType(Argument.DataType.NUMBER); + arg2.setRequiredOnCreate(true); + arg2.setRequiredOnEdit(true); + arg2.setValidation("is_pos_int('some_name')"); + scheme.addArgument(arg2); + + Document generatedDocument = scheme.toXml(); + Document expectedDocument = resourceToXmlDocument("/modularinput/data/scheme_without_defaults.xml"); + + assertXmlEqual(expectedDocument, generatedDocument); + } + + /** + * Checks that the XML produced from an Argument class that is initialized but has no additional manipulations + * made to it is what we expect. This is mostly a check of the default values. + */ + @Test + public void testGenerateXmlFromArgumentWithDefaultValues() throws ParserConfigurationException, TransformerException { + Argument argument = new Argument("some_name"); + + Document generatedDoc = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); + argument.addToDocument(generatedDoc, generatedDoc); + + Document expectedDoc = resourceToXmlDocument("/modularinput/data/argument_with_defaults.xml"); + + assertXmlEqual(expectedDoc, generatedDoc); + } + + /** + * Checks that the XML generated by an Argument class with all its possible values set is what we expect. + */ + @Test + public void testGenerateXmlFromArgument() throws ParserConfigurationException, TransformerException { + Argument argument = new Argument("some_name"); + argument.setDescription("\uC3BC and \uC3B6 and <&> f\u00FCr"); + argument.setDataType(Argument.DataType.BOOLEAN); + argument.setValidation("is_pos_int('some_name')"); + argument.setRequiredOnEdit(true); + argument.setRequiredOnCreate(true); + + Document generatedDoc = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); + argument.addToDocument(generatedDoc, generatedDoc); + + Document expectedDoc = resourceToXmlDocument("/modularinput/data/argument_without_defaults.xml"); + + assertXmlEqual(expectedDoc, generatedDoc); + } + + + + +} diff --git a/splunk/src/test/java/com/splunk/modularinput/ScriptTest.java b/splunk/src/test/java/com/splunk/modularinput/ScriptTest.java new file mode 100644 index 00000000..2e4acb0b --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/ScriptTest.java @@ -0,0 +1,224 @@ +package com.splunk.modularinput; + +import com.splunk.SDKTestCase; +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import org.w3c.dom.Document; + +import javax.xml.parsers.ParserConfigurationException; +import javax.xml.stream.XMLStreamException; +import javax.xml.transform.TransformerException; +import java.io.InputStream; +import java.io.StringWriter; +import java.io.UnsupportedEncodingException; +import java.util.Date; + +/** + * Test the behavior of subclasses of the Script class. This is to check whether modular inputs really + * do what they're supposed to. + */ +public class ScriptTest extends ModularInputTestCase { + EventWriter eventWriter; + StringWriter out, err; + InputStream in; + + @Before + public void setUp() throws XMLStreamException { + out = new StringWriter(); + err = new StringWriter(); + + eventWriter = new EventWriter(out, err); + } + + /* + * A script that returns a null scheme should generate no output on stdout and an error on stderr + * saying that it the scheme was null. + */ + @Test + public void testErrorOnScriptWithNullScheme() throws XMLStreamException { + Script script = new Script() { + @Override + public Scheme getScheme() { + return null; + } + + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws + MalformedDataException, XMLStreamException { + // Not used. + } + }; + + + String[] args = new String[] {"--scheme"}; + int returnValue = script.run(args, eventWriter, in); + + Assert.assertEquals("", out.toString()); + Assert.assertEquals("FATAL Modular input script returned a null scheme.\n", err.toString()); + Assert.assertNotEquals(0, returnValue); + } + + /* + * Check that a scheme generated by a script is what we expect. + */ + @Test + public void testSchemeProperlyGeneratedByScript() throws TransformerException, ParserConfigurationException { + Script script = new Script() { + @Override + public Scheme getScheme() { + Scheme scheme = new Scheme("abcd"); + scheme.setDescription("\uC3BC and \uC3B6 and <&> f\u00FCr"); + scheme.setStreamingMode(Scheme.StreamingMode.SIMPLE); + scheme.setUseExternalValidation(false); + scheme.setUseSingleInstance(true); + + Argument arg1 = new Argument("arg1"); + scheme.addArgument(arg1); + + Argument arg2 = new Argument("arg2"); + arg2.setDescription("\uC3BC and \uC3B6 and <&> f\u00FCr"); + arg2.setDataType(Argument.DataType.NUMBER); + arg2.setRequiredOnCreate(true); + arg2.setRequiredOnEdit(true); + arg2.setValidation("is_pos_int('some_name')"); + scheme.addArgument(arg2); + + return scheme; + } + + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws MalformedDataException, XMLStreamException { + // Not used. + } + }; + + String[] args = new String[] {"--scheme"}; + int returnValue = script.run(args, eventWriter, in); + + Assert.assertEquals("", err.toString()); + Assert.assertEquals(0, returnValue); + + Document found = stringToXmlDocument(out.toString()); + Document expected = resourceToXmlDocument("/modularinput/data/scheme_without_defaults.xml"); + + assertXmlEqual(expected, found); + } + + /* + * Check that successful validation yield no text and a 0 exit value. + */ + @Test + public void testSuccessfulValidation() throws UnsupportedEncodingException { + Script script = new Script() { + @Override + public Scheme getScheme() { + return null; // Unused + } + + @Override + public void validateInput(ValidationDefinition definition) throws Exception { + // Always succeed + } + + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws MalformedDataException, XMLStreamException { + // Unused + } + }; + + String[] args = new String[] {"--validate-arguments"}; + int returnValue = script.run( + args, + eventWriter, + SDKTestCase.openResource("/modularinput/data/validation.xml") + ); + + Assert.assertEquals("", err.toString()); + Assert.assertEquals("", out.toString()); + Assert.assertEquals(0, returnValue); + } + + /* + * Check that failed validation writes sensible XML to stdout. + */ + @Test + public void testFailedValidation() throws TransformerException, ParserConfigurationException { + Script script = new Script() { + @Override + public Scheme getScheme() { + return null; // Unused + } + + @Override + public void validateInput(ValidationDefinition definition) throws Exception { + throw new MalformedDataException("Oh, the vogonity!"); + } + + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws MalformedDataException, XMLStreamException { + // Unused + } + }; + + String[] args = new String[] {"--validate-arguments"}; + int returnValue = script.run( + args, + eventWriter, + SDKTestCase.openResource("/modularinput/data/validation.xml") + ); + + Document expectedXml = resourceToXmlDocument("/modularinput/data/validation_error.xml"); + Document foundXml = stringToXmlDocument(out.toString()); + + Assert.assertEquals("", err.toString()); + assertXmlEqual(expectedXml, foundXml); + Assert.assertNotEquals(0, returnValue); + } + + /* + * Check that passing an input definition and writing a couple events goes smoothly. + */ + @Test + public void testWriteEvents() throws TransformerException, ParserConfigurationException { + Script script = new Script() { + + @Override + public Scheme getScheme() { + return null; // Unused + } + + @Override + public void streamEvents(InputDefinition inputs, EventWriter ew) throws MalformedDataException, + XMLStreamException { + Event event = new Event(); + event.setTime(new Date(1372275124466L)); + event.setStanza("fubar"); + event.setData("This is a test of the emergency broadcast system."); + event.setHost("localhost"); + event.setIndex("main"); + event.setSource("hilda"); + event.setSourceType("misc"); + event.setDone(true); + event.setUnbroken(true); + + ew.writeEvent(event); + ew.writeEvent(event); + } + }; + + String[] args = new String[] {}; + InputStream input = SDKTestCase.openResource("/modularinput/data/conf_with_2_inputs.xml"); + + int returnValue = script.run(args, eventWriter, input); + + Assert.assertEquals(0, returnValue); + Assert.assertEquals("", err.toString()); + + Document expectedXml = resourceToXmlDocument("/modularinput/data/stream_with_two_events.xml"); + Document foundXml = stringToXmlDocument(out.toString()); + assertXmlEqual(expectedXml, foundXml); + + } + +} diff --git a/splunk/src/test/java/com/splunk/modularinput/ValidationDefinitionTest.java b/splunk/src/test/java/com/splunk/modularinput/ValidationDefinitionTest.java new file mode 100644 index 00000000..6110c04e --- /dev/null +++ b/splunk/src/test/java/com/splunk/modularinput/ValidationDefinitionTest.java @@ -0,0 +1,50 @@ +package com.splunk.modularinput; + +import com.splunk.SDKTestCase; +import org.junit.Assert; +import org.junit.Test; +import org.xml.sax.SAXException; + +import javax.xml.parsers.ParserConfigurationException; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.List; + +/** + * Checks that parsing XML into ValidationDefinitions works correctly. + */ +public class ValidationDefinitionTest extends ModularInputTestCase { + /** + * Checks that the ValidationDefinition parsed from XML is what we expect. + */ + @Test + public void testParseValidationDefinition() throws ParserConfigurationException, SAXException, MalformedDataException, + IOException { + InputStream stream = SDKTestCase.openResource("/modularinput/data/validation.xml"); + ValidationDefinition found = ValidationDefinition.parseDefinition(stream); + + ValidationDefinition expected = new ValidationDefinition(); + expected.setServerHost("tiny"); + expected.setServerUri("https://127.0.0.1:8089"); + expected.setCheckpointDir("/opt/splunk/var/lib/splunk/modinputs"); + expected.setSessionKey("123102983109283019283"); + expected.setName("aaa"); + List<Parameter> parameters = new ArrayList<Parameter>(); + parameters.add(new SingleValueParameter("param1", "value1")); + parameters.add(new SingleValueParameter("param2", "value2")); + parameters.add(new SingleValueParameter("disabled", "0")); + parameters.add(new SingleValueParameter("index", "default")); + MultiValueParameter mvp = new MultiValueParameter("multiValue"); + mvp.appendValue("value1"); + mvp.appendValue("value2"); + parameters.add(mvp); + mvp = new MultiValueParameter("multiValue2"); + mvp.appendValue("value3"); + mvp.appendValue("value4"); + parameters.add(mvp); + expected.setParameters(parameters); + + Assert.assertTrue(expected.equals(found)); + } +} diff --git a/splunk/src/test/java/com/splunk/raw_field.xml b/splunk/src/test/java/com/splunk/raw_field.xml new file mode 100644 index 00000000..2638985a --- /dev/null +++ b/splunk/src/test/java/com/splunk/raw_field.xml @@ -0,0 +1,11 @@ +<?xml version='1.0' encoding='UTF-8'?> +<results preview='0'> +<meta> +<fieldOrder> +<field>_raw</field> +</fieldOrder> +</meta> + <result offset='0'> + <field k='_raw'><v xml:space='preserve' trunc='0'>07-13-2012 09:27:27.307 -0700 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</v></field> + </result> +</results> diff --git a/tests/com/splunk/splunk.license b/splunk/src/test/java/com/splunk/splunk.license similarity index 100% rename from tests/com/splunk/splunk.license rename to splunk/src/test/java/com/splunk/splunk.license diff --git a/splunk/src/test/java/com/splunk/splunk_at_least_cupcake.license b/splunk/src/test/java/com/splunk/splunk_at_least_cupcake.license new file mode 100644 index 00000000..51828bbd --- /dev/null +++ b/splunk/src/test/java/com/splunk/splunk_at_least_cupcake.license @@ -0,0 +1,33 @@ +<?xml version="1.0" encoding="UTF-8"?> +<license> + <signature>dTEDyZNMuiTE7Nu1Y3ZUr8l9pbGaX/RRo/eAhsGBHuo23VyYzaiyHnPHyr8IPL7d3opT/4EBfrCNI4HGwN1EOdiES9mt91fDQvEFx8f+p+RJnlFJfRQqbbWZWWjqxfJvYIlBc9GDiZ0xSo+Bc+DuYdlkG4f+WywHIH/k9HN6snqCxVojRJwiJAGjDn5FmUVIcaKCF84MaRVFPmRlicNzQ6pYvQjimPaUHNoP5NB9rgWg4ehaZ+bfR2AcjpgSBNiJOwKRI9EdNLA7GPXphcujyKynl45RSWZmqd5vQMHIH4a2BTeK+0QwPoJni4CUtN19yUFUNOiXHjx6Aunjw9qVtA==</signature> + <payload> + <type>enterprise</type> + <group_id>Enterprise</group_id> + <quota>104857600</quota> + <max_violations>5</max_violations> + <window_period>30</window_period> + <creation_time>1397458800</creation_time> + <label>Splunk Internal License DO NOT DISTRIBUTE</label> + <expiration_time>1397804400</expiration_time> + <features> + <feature>Auth</feature> + <feature>FwdData</feature> + <feature>RcvData</feature> + <feature>LocalSearch</feature> + <feature>DistSearch</feature> + <feature>RcvSearch</feature> + <feature>ScheduledSearch</feature> + <feature>Alerting</feature> + <feature>DeployClient</feature> + <feature>DeployServer</feature> + <feature>SplunkWeb</feature> + <feature>SigningProcessor</feature> + <feature>SyslogOutputProcessor</feature> + <feature>AllowDuplicateKeys</feature> + <feature>CanBeRemoteMaster</feature> + </features> + <sourcetypes/> + <guid>C759B91D-3D25-438F-95CA-092C512DFBEC</guid> + </payload> +</license> \ No newline at end of file diff --git a/splunk/src/test/resources/data/atom/atom_feed_with_message.xml b/splunk/src/test/resources/data/atom/atom_feed_with_message.xml new file mode 100644 index 00000000..44a5ad0f --- /dev/null +++ b/splunk/src/test/resources/data/atom/atom_feed_with_message.xml @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .--> +<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> +<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> + <title>roles + https://localhost:8089/services/authorization/roles + 2013-01-22T08:52:24-08:00 + + + Splunk + + + 0 + 30 + 0 + + This role will be disabled after the Enterprise Trial License expires + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/atom/atom_with_feed.xml b/splunk/src/test/resources/data/atom/atom_with_feed.xml new file mode 100644 index 00000000..82b9947e --- /dev/null +++ b/splunk/src/test/resources/data/atom/atom_with_feed.xml @@ -0,0 +1,99 @@ + + + + + localapps + https://localhost:8089/servicesNS/nobody/system/apps/local + 2012-12-19T11:07:48-08:00 + + + Splunk + + + + 1 + 30 + 0 + + + gettingstarted + https://localhost:8089/servicesNS/nobody/system/apps/local/gettingstarted + 2012-12-19T11:07:48-08:00 + + + nobody + + + + + + + + + + Splunk + 1 + 1 + Get started with Splunk. This app introduces you to many of Splunk's features. You'll learn how to use Splunk to index data, search and investigate, add knowledge, monitor and alert, report and analyze. + 0 + + + system + 1 + 1 + 1 + 1 + 0 + 1 + 1 + nobody + + + + + * + + + + + power + + + + + 0 + app + + + + + + + author + check_for_updates + configured + description + label + manageable + version + visible + + + + + + + + + + + Getting started + 1 + 0 + 1.0 + 1 + + + + + diff --git a/splunk/src/test/resources/data/atom/atom_with_several_entries.xml b/splunk/src/test/resources/data/atom/atom_with_several_entries.xml new file mode 100644 index 00000000..c3571f00 --- /dev/null +++ b/splunk/src/test/resources/data/atom/atom_with_several_entries.xml @@ -0,0 +1,101 @@ + + + + + localapps + https://localhost:8089/services/apps/local + 2012-12-19T15:27:58-08:00 + + + Splunk + + + + 12 + 30 + 0 + + + gettingstarted + https://localhost:8089/services/apps/local/gettingstarted + 2012-12-19T15:27:58-08:00 + + + system + + + + + + + + + + Splunk + 1 + 1 + Get started with Splunk. This app introduces you to many of Splunk's features. You'll learn how to use Splunk to index data, search and investigate, add knowledge, monitor and alert, report and analyze. + 0 + 1111011system*power0app + Getting started + 0 + 0 + 1.0 + 1 + + + + + launcher + https://localhost:8089/services/apps/local/launcher + 2012-12-19T15:27:58-08:00 + + + system + + + + + + + + + 1 + 1 + 0 + 1111011system*power0app + Home + 0 + 0 + 1 + + + + + learned + https://localhost:8089/services/apps/local/learned + 2012-12-19T15:27:58-08:00 + + + system + + + + + + + + + + 1 + 0 + 0 + 1111011system**0app + learned + 1 + 0 + 0 + + + + diff --git a/splunk/src/test/resources/data/atom/atom_with_simple_entries.xml b/splunk/src/test/resources/data/atom/atom_with_simple_entries.xml new file mode 100644 index 00000000..e241123e --- /dev/null +++ b/splunk/src/test/resources/data/atom/atom_with_simple_entries.xml @@ -0,0 +1,30 @@ + + + + + services + https://localhost:8089/services/ + 2012-12-20T09:48:01-08:00 + + + Splunk + + + alerts + https://localhost:8089/services/alerts + 2012-12-20T09:48:01-08:00 + + + + apps + https://localhost:8089/services/apps + 2012-12-20T09:48:01-08:00 + + + + auth + https://localhost:8089/services/auth + 2012-12-20T09:48:01-08:00 + + + diff --git a/splunk/src/test/resources/data/atom_test_data.json b/splunk/src/test/resources/data/atom_test_data.json new file mode 100644 index 00000000..e64311c5 --- /dev/null +++ b/splunk/src/test/resources/data/atom_test_data.json @@ -0,0 +1,274 @@ +{ + "atom_with_feed": { + "metadata": { + "title": "localapps", + "id": "https://localhost:8089/servicesNS/nobody/system/apps/local", + "updated": "2012-12-19T11:07:48-08:00", + "generator": {"build": "144175", "version": "5.0.2"}, + "author": "Splunk", + "links": { + "create": "/servicesNS/nobody/system/apps/local/_new", + "_reload": "/servicesNS/nobody/system/apps/local/_reload" + }, + "totalResults": "1", + "itemsPerPage": "30", + "startIndex": "0", + "messages": [] + }, + "entries": [ + { + "title": "gettingstarted", + "id": "https://localhost:8089/servicesNS/nobody/system/apps/local/gettingstarted", + "updated": "2012-12-19T11:07:48-08:00", + "author": "nobody", + "links": { + "alternate": "/servicesNS/nobody/system/apps/local/gettingstarted", + "list": "/servicesNS/nobody/system/apps/local/gettingstarted", + "_reload": "/servicesNS/nobody/system/apps/local/gettingstarted/_reload", + "edit": "/servicesNS/nobody/system/apps/local/gettingstarted", + "remove": "/servicesNS/nobody/system/apps/local/gettingstarted", + "disable": "/servicesNS/nobody/system/apps/local/gettingstarted/disable", + "package": "/servicesNS/nobody/system/apps/local/gettingstarted/package" + }, + "content": { + "author": "Splunk", + "check_for_updates": "1", + "configured": "1", + "description": "Get started with Splunk. This app introduces you to many of Splunk's features. You'll learn how to use Splunk to index data, search and investigate, add knowledge, monitor and alert, report and analyze.", + "disabled": "0", + "eai:acl": { + "app": "system", + "can_change_perms": "1", + "can_list": "1", + "can_share_app": "1", + "can_share_global": "1", + "can_share_user": "0", + "can_write": "1", + "modifiable": "1", + "owner": "nobody", + "perms": { + "read": ["*"], + "write": ["power"] + }, + "removable": "0", + "sharing": "app" + }, + "eai:attributes": { + "optionalFields": ["author", "check_for_updates", + "configured", "description", + "label", "manageable", "version", + "visible"], + "requiredFields": [], + "wildcardFields": [] + }, + "label": "Getting started", + "manageable": "1", + "state_change_requires_restart": "0", + "version": "1.0", + "visible": "1" + } + } + ] + }, + "atom_with_several_entries": { + "metadata": { + "title": "localapps", + "id": "https://localhost:8089/services/apps/local", + "updated": "2012-12-19T15:27:58-08:00", + "generator": {"version": "140437"}, + "author": "Splunk", + "links": { + "create": "/services/apps/local/_new", + "_reload": "/services/apps/local/_reload" + }, + "totalResults": "12", + "itemsPerPage": "30", + "startIndex": "0", + "messages": [] + }, + "entries": [ + { + "title": "gettingstarted", + "id": "https://localhost:8089/services/apps/local/gettingstarted", + "updated": "2012-12-19T15:27:58-08:00", + "author": "system", + "links": { + "alternate": "/services/apps/local/gettingstarted", + "list": "/services/apps/local/gettingstarted", + "_reload": "/services/apps/local/gettingstarted/_reload", + "edit": "/services/apps/local/gettingstarted", + "remove": "/services/apps/local/gettingstarted", + "disable": "/services/apps/local/gettingstarted/disable", + "package": "/services/apps/local/gettingstarted/package" + }, + "content": { + "author": "Splunk", + "check_for_updates": "1", + "configured": "1", + "description": "Get started with Splunk. This app introduces you to many of Splunk's features. You'll learn how to use Splunk to index data, search and investigate, add knowledge, monitor and alert, report and analyze.", + "disabled": "0", + "eai:acl": { + "app": "", + "can_change_perms": "1", + "can_list": "1", + "can_share_app": "1", + "can_share_global": "1", + "can_share_user": "0", + "can_write": "1", + "modifiable": "1", + "owner": "system", + "perms": { + "read": ["*"], + "write": ["power"] + }, + "removable": "0", + "sharing": "app" + }, + "label": "Getting started", + "manageable": "0", + "state_change_requires_restart": "0", + "version": "1.0", + "visible": "1" + } + }, + { + "title": "launcher", + "id": "https://localhost:8089/services/apps/local/launcher", + "updated": "2012-12-19T15:27:58-08:00", + "author": "system", + "links": { + "alternate": "/services/apps/local/launcher", + "list": "/services/apps/local/launcher", + "_reload": "/services/apps/local/launcher/_reload", + "edit": "/services/apps/local/launcher", + "remove": "/services/apps/local/launcher", + "package": "/services/apps/local/launcher/package" + }, + "content": { + "check_for_updates": "1", + "configured": "1", + "disabled": "0", + "eai:acl": { + "app": "", + "can_change_perms": "1", + "can_list": "1", + "can_share_app": "1", + "can_share_global": "1", + "can_share_user": "0", + "can_write": "1", + "modifiable": "1", + "owner": "system", + "perms": { + "read": ["*"], + "write": ["power"] + }, + "removable": "0", + "sharing": "app" + }, + "label": "Home", + "manageable": "0", + "state_change_requires_restart": "0", + "visible": "1" + } + }, + + { + "title": "learned", + "id": "https://localhost:8089/services/apps/local/learned", + "updated": "2012-12-19T15:27:58-08:00", + "author": "system", + "links": { + "alternate": "/services/apps/local/learned", + "list": "/services/apps/local/learned", + "_reload": "/services/apps/local/learned/_reload", + "edit": "/services/apps/local/learned", + "remove": "/services/apps/local/learned", + "disable": "/services/apps/local/learned/disable", + "package": "/services/apps/local/learned/package" + }, + "content": { + "check_for_updates": "1", + "configured": "0", + "disabled": "0", + "eai:acl": { + "app": "", + "can_change_perms": "1", + "can_list": "1", + "can_share_app": "1", + "can_share_global": "1", + "can_share_user": "0", + "can_write": "1", + "modifiable": "1", + "owner": "system", + "perms": {"read": ["*"], "write": ["*"]}, + "removable": "0", + "sharing": "app" + }, + "label": "learned", + "manageable": "1", + "state_change_requires_restart": "0", + "visible": "0" + } + } + ] + }, + "atom_with_simple_entries": { + "metadata": { + "title": "services", + "id": "https://localhost:8089/services/", + "updated": "2012-12-20T09:48:01-08:00", + "generator": {"version": "140437"}, + "author": "Splunk", + "links": {}, + "messages": [] + }, + "entries": [ + { + "title": "alerts", + "id": "https://localhost:8089/services/alerts", + "updated": "2012-12-20T09:48:01-08:00", + "links": { + "alternate": "/services/alerts" + } + }, + { + "title": "apps", + "id": "https://localhost:8089/services/apps", + "updated": "2012-12-20T09:48:01-08:00", + "links": { + "alternate": "/services/apps" + } + }, + { + "title": "auth", + "id": "https://localhost:8089/services/auth", + "updated": "2012-12-20T09:48:01-08:00", + "links": { + "alternate": "/services/auth" + } + } + ] + }, + "atom_feed_with_message": { + "metadata": { + "title": "roles", + "id": "https://localhost:8089/services/authorization/roles", + "updated": "2013-01-22T08:52:24-08:00", + "generator": {"build": "146385", "version": "5.0.2"}, + "author": "Splunk", + "links": { + "create": "/services/authorization/roles/_new" + }, + "startIndex": "0", + "totalResults": "0", + "itemsPerPage": "30", + "messages": [ + { + "type": "WARN", + "message": "This role will be disabled after the Enterprise Trial License expires" + } + ] + }, + "entries": [] + } +} diff --git a/splunk/src/test/resources/data/datamodels/data_model_for_pivot.json b/splunk/src/test/resources/data/datamodels/data_model_for_pivot.json new file mode 100644 index 00000000..98265fd6 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/data_model_for_pivot.json @@ -0,0 +1,336 @@ +{ + "displayName":"pivot test data", + "description":"", + "modelName":"pivot_test_data", + "objectSummary":{ + "Transaction-Based":0, + "Interfaces":0, + "Interface Implementations":0, + "Search-Based":0, + "Event-Based":2 + }, + "objects":[ + { + "fields":[ + { + "editable":false, + "fieldSearch":"", + "fieldName":"_time", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"timestamp", + "displayName":"_time" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"host", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"host" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"source", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"source" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"sourcetype" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"test_data", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"objectCount", + "displayName":"test data" + } + ], + "objectSearchNoFields":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\", \"test_data.is_child\" AS \"is_child\", \"test_data.is_not_child\" AS \"is_not_child\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25 | eval \"is_child\"=if(searchmatch(\"\"),1,0) | eval \"is_not_child\"=if(searchmatch(\"NOT( )\"),1,0) | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\"", + "constraints":[ + + ], + "displayName":"test data", + "previewSearch":" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25", + "objectSearch":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\", \"test_data.is_child\" AS \"is_child\", \"test_data.is_not_child\" AS \"is_not_child\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25 | eval \"is_child\"=if(searchmatch(\"\"),1,0) | eval \"is_not_child\"=if(searchmatch(\"NOT( )\"),1,0) | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"test_data.has_boris\", \"test_data.hostip\", \"test_data.epsilon\", \"test_data.is_child\", \"test_data.is_not_child\"", + "objectName":"test_data", + "calculations":[ + { + "editable":true, + "outputFields":[ + { + "editable":true, + "fieldSearch":"", + "fieldName":"has_boris", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"boolean", + "displayName":"has_boris" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"2f8rvff3gsm", + "expression":"if(boris != null, \"true\", \"false\")", + "calculationType":"Eval" + }, + { + "editable":true, + "outputFields":[ + { + "editable":true, + "fieldSearch":"", + "fieldName":"hostip", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"ipv4", + "displayName":"hostip" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"bs7krya32co", + "expression":"129.0.0.1", + "calculationType":"Eval" + }, + { + "editable":true, + "outputFields":[ + { + "editable":true, + "fieldSearch":"", + "fieldName":"epsilon", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"number", + "displayName":"epsilon" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"bsbno65h5v", + "expression":"25", + "calculationType":"Eval" + }, + { + "editable":false, + "outputFields":[ + { + "editable":false, + "fieldSearch":"", + "fieldName":"is_child", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"childCount", + "displayName":"is_child" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"ec9664b60b8de96cd9d7a0114e89e358d1620c19", + "expression":"if(searchmatch(\"\"),1,0)", + "calculationType":"Eval" + }, + { + "editable":false, + "outputFields":[ + { + "editable":false, + "fieldSearch":"", + "fieldName":"is_not_child", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"childCount", + "displayName":"is_not_child" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"64f71e104ac3b7cdbf665046891b79adb58ddf6d", + "expression":"if(searchmatch(\"NOT( )\"),1,0)", + "calculationType":"Eval" + } + ], + "autoextractSearch":"", + "comment":"", + "parentName":"BaseEvent", + "children":[ + "child" + ], + "lineage":"test_data", + "tsidxNamespace":"" + }, + { + "fields":[ + { + "editable":false, + "fieldSearch":"", + "fieldName":"_time", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"timestamp", + "displayName":"_time" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"host", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"host" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"source", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"source" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"BaseEvent", + "comment":"", + "type":"string", + "displayName":"sourcetype" + }, + { + "editable":false, + "fieldSearch":"", + "fieldName":"child", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data.child", + "comment":"", + "type":"objectCount", + "displayName":"child" + } + ], + "objectSearchNoFields":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25 | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\"", + "constraints":[ + + ], + "displayName":"child", + "previewSearch":" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25", + "objectSearch":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=129.0.0.1 | eval \"epsilon\"=25 | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"test_data.has_boris\", \"test_data.hostip\", \"test_data.epsilon\"", + "objectName":"child", + "calculations":[ + { + "editable":true, + "outputFields":[ + { + "editable":true, + "fieldSearch":"", + "fieldName":"hostip", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"ipv4", + "displayName":"hostip" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"bs7krya32co", + "expression":"129.0.0.1", + "calculationType":"Eval" + }, + { + "editable":true, + "outputFields":[ + { + "editable":true, + "fieldSearch":"", + "fieldName":"epsilon", + "required":false, + "multivalue":false, + "hidden":false, + "owner":"test_data", + "comment":"", + "type":"number", + "displayName":"epsilon" + } + ], + "owner":"test_data", + "comment":"", + "calculationID":"bsbno65h5v", + "expression":"25", + "calculationType":"Eval" + } + ], + "autoextractSearch":"", + "comment":"", + "parentName":"test_data", + "children":[ + + ], + "lineage":"test_data.child", + "tsidxNamespace":"" + } + ], + "objectNameList":[ + "test_data", + "child" + ] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/data_model_with_test_objects.json b/splunk/src/test/resources/data/datamodels/data_model_with_test_objects.json new file mode 100644 index 00000000..180755cc --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/data_model_with_test_objects.json @@ -0,0 +1,258 @@ +{ + "objects":[ + { + "objectName":"event1", + "comment":"ဩᚙ௵ comment on event1", + "autoextractSearch":" (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) ", + "calculations":[ + { + "owner":"event1", + "calculationID":"93fzsv03wa7", + "outputFields":[ + { + "owner":"event1", + "type":"string", + "hidden":true, + "fieldSearch":"new_field=* ", + "fieldName":"new_field", + "multivalue":false, + "displayName":"My New Field", + "editable":true, + "required":true, + "comment":"" + } + ], + "comment":"", + "editable":true, + "calculationType":"Eval", + "expression":"if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\")" + }, + { + "owner":"event1", + "calculationID":"sr3mc8o3mjr", + "outputFields":[ + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname", + "type":"ipv4", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname=* ", + "editable":true, + "lookupOutputFieldName":"reverse_hostname", + "displayName":"\u0bf5aad", + "required":true + } + ], + "comment":"", + "editable":true, + "lookupName":"dnslookup", + "inputField":"host", + "calculationType":"Lookup", + "lookupField":"a_lookup_field" + }, + { + "owner":"event1", + "calculationID":"a5v1k82ymic", + "outputFields":[ + { + "owner":"event1", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"from", + "multivalue":false, + "displayName":"from", + "editable":true, + "required":false, + "comment":"" + }, + { + "owner":"event1", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"to", + "multivalue":false, + "displayName":"to", + "editable":true, + "required":false, + "comment":"" + } + ], + "comment":"", + "editable":true, + "inputField":"_raw", + "calculationType":"Rex", + "expression":" From: (?.*) To: (?.*) " + }, + { + "owner":"event1", + "calculationID":"pbe9bd0rp4", + "outputFields":[ + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname_lon", + "type":"number", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname_lon=* ", + "editable":true, + "lookupOutputFieldName":"lon", + "displayName":"output_from_reverse_hostname_lon", + "required":true + }, + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname_lat", + "type":"number", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname_lat=* ", + "editable":true, + "lookupOutputFieldName":"lat", + "displayName":"output_from_reverse_hostname_lat", + "required":true + }, + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname_City", + "type":"string", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname_City=* ", + "editable":true, + "lookupOutputFieldName":"City", + "displayName":"output_from_reverse_hostname_City", + "required":true + }, + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname_Region", + "type":"string", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname_Region=* ", + "editable":true, + "lookupOutputFieldName":"Region", + "displayName":"output_from_reverse_hostname_Region", + "required":true + }, + { + "multivalue":false, + "hidden":false, + "fieldName":"output_from_reverse_hostname_Country", + "type":"string", + "owner":"event1", + "comment":"", + "fieldSearch":"output_from_reverse_hostname_Country=* ", + "editable":true, + "lookupOutputFieldName":"Country", + "displayName":"output_from_reverse_hostname_Country", + "required":true + } + ], + "comment":"ဩᚙ௵ comment of pbe9bd0rp4", + "editable":true, + "inputField":"output_from_reverse_hostname", + "calculationType":"GeoIP" + } + ], + "previewSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* ", + "children":[ + + ], + "objectSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | rename \"event1.new_field\" AS \"new_field\", \"event1.output_from_reverse_hostname\" AS \"output_from_reverse_hostname\", \"event1.from\" AS \"from\", \"event1.to\" AS \"to\", \"event1.output_from_reverse_hostname_lon\" AS \"output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\" AS \"output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\" AS \"output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\" AS \"output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\" AS \"output_from_reverse_hostname_Country\" | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"event1.new_field\", \"event1.output_from_reverse_hostname\", \"event1.from\", \"event1.to\", \"event1.output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\"", + "constraints":[ + { + "owner":"event1", + "search":"uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")" + } + ], + "lineage":"event1", + "tsidxNamespace":"", + "displayName":"event1 ဩᚙ", + "fields":[ + { + "owner":"BaseEvent", + "type":"timestamp", + "hidden":false, + "fieldSearch":"", + "fieldName":"_time", + "multivalue":false, + "displayName":"_time", + "editable":false, + "required":false, + "comment":"" + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"host", + "multivalue":false, + "displayName":"host", + "editable":false, + "required":false, + "comment":"" + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"source", + "multivalue":false, + "displayName":"source", + "editable":false, + "required":false, + "comment":"" + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "multivalue":false, + "displayName":"sourcetype", + "editable":false, + "required":false, + "comment":"" + }, + { + "owner":"event1", + "type":"objectCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"event1", + "multivalue":false, + "displayName":"event1", + "editable":false, + "required":false, + "comment":"" + } + ], + "parentName":"BaseEvent", + "objectSearchNoFields":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | rename \"event1.new_field\" AS \"new_field\", \"event1.output_from_reverse_hostname\" AS \"output_from_reverse_hostname\", \"event1.from\" AS \"from\", \"event1.to\" AS \"to\", \"event1.output_from_reverse_hostname_lon\" AS \"output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\" AS \"output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\" AS \"output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\" AS \"output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\" AS \"output_from_reverse_hostname_Country\" | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\"" + } + ], + "displayName":"\u0bf5\u0bf1\u0bf0\u0bef - search 1", + "objectSummary":{ + "Event-Based":1, + "Search-Based":0, + "Transaction-Based":0, + "Interfaces":0, + "Interface Implementations":0 + }, + "description":"A description", + "objectNameList":[ + "event1" + ] +} diff --git a/splunk/src/test/resources/data/datamodels/empty_data_model.json b/splunk/src/test/resources/data/datamodels/empty_data_model.json new file mode 100644 index 00000000..8ea88c18 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/empty_data_model.json @@ -0,0 +1,5 @@ +{ + "description":"Empty model", + "displayName":"A human readable name", + "objects": [] +} diff --git a/splunk/src/test/resources/data/datamodels/inheritance_test_data.json b/splunk/src/test/resources/data/datamodels/inheritance_test_data.json new file mode 100644 index 00000000..c09e5e4b --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/inheritance_test_data.json @@ -0,0 +1,375 @@ +{ + "objects":[ + { + "objectSearch":" | search (boris=hilda) | rename \"is_level_1\" AS \"level_0.is_level_1\", \"is_not_level_1\" AS \"level_0.is_not_level_1\" | rename \"level_0.is_level_1\" AS \"is_level_1\", \"level_0.is_not_level_1\" AS \"is_not_level_1\" | eval \"is_level_1\"=if(searchmatch(\" (natasha=meep) \"),1,0) | eval \"is_not_level_1\"=if(searchmatch(\"NOT( (natasha=meep) )\"),1,0) | rename \"is_level_1\" AS \"level_0.is_level_1\", \"is_not_level_1\" AS \"level_0.is_not_level_1\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"level_0.is_level_1\", \"level_0.is_not_level_1\"", + "constraints":[ + { + "owner":"level_0", + "search":"boris=hilda" + } + ], + "lineage":"level_0", + "objectName":"level_0", + "displayName":"level 0", + "autoextractSearch":" (boris=hilda) ", + "calculations":[ + { + "owner":"level_0", + "calculationID":"5d76326e6a312efd4630317be0a7212cb99a9c14", + "expression":"if(searchmatch(\" (natasha=meep) \"),1,0)", + "editable":false, + "calculationType":"Eval", + "outputFields":[ + { + "owner":"level_0", + "type":"childCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"is_level_1", + "displayName":"is_level_1", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "comment":"" + }, + { + "owner":"level_0", + "calculationID":"8c7a163a740a9c27dd2a99b70e45fa7bd1e3ee9b", + "expression":"if(searchmatch(\"NOT( (natasha=meep) )\"),1,0)", + "editable":false, + "calculationType":"Eval", + "outputFields":[ + { + "owner":"level_0", + "type":"childCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"is_not_level_1", + "displayName":"is_not_level_1", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "comment":"" + } + ], + "previewSearch":" | search (boris=hilda) ", + "objectSearchNoFields":" | search (boris=hilda) | rename \"is_level_1\" AS \"level_0.is_level_1\", \"is_not_level_1\" AS \"level_0.is_not_level_1\" | rename \"level_0.is_level_1\" AS \"is_level_1\", \"level_0.is_not_level_1\" AS \"is_not_level_1\" | eval \"is_level_1\"=if(searchmatch(\" (natasha=meep) \"),1,0) | eval \"is_not_level_1\"=if(searchmatch(\"NOT( (natasha=meep) )\"),1,0) | rename \"is_level_1\" AS \"level_0.is_level_1\", \"is_not_level_1\" AS \"level_0.is_not_level_1\"", + "tsidxNamespace":"", + "comment":"", + "fields":[ + { + "owner":"BaseEvent", + "type":"timestamp", + "hidden":false, + "fieldSearch":"", + "fieldName":"_time", + "displayName":"_time", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"host", + "displayName":"host", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"source", + "displayName":"source", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "displayName":"sourcetype", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"level_0", + "type":"objectCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"level_0", + "displayName":"level 0", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "parentName":"BaseEvent", + "children":[ + "level_1" + ] + }, + { + "objectSearch":" | search (boris=hilda) | rename \"is_level_2\" AS \"level_0.level_1.is_level_2\", \"is_not_level_2\" AS \"level_0.level_1.is_not_level_2\" | rename \"level_0.level_1.is_level_2\" AS \"is_level_2\", \"level_0.level_1.is_not_level_2\" AS \"is_not_level_2\" | search (natasha=meep) | eval \"is_level_2\"=if(searchmatch(\" (prr=4) \"),1,0) | eval \"is_not_level_2\"=if(searchmatch(\"NOT( (prr=4) )\"),1,0) | rename \"is_level_2\" AS \"level_0.level_1.is_level_2\", \"is_not_level_2\" AS \"level_0.level_1.is_not_level_2\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"level_0.level_1.is_level_2\", \"level_0.level_1.is_not_level_2\"", + "constraints":[ + { + "owner":"level_0", + "search":"boris=hilda" + }, + { + "owner":"level_0.level_1", + "search":"natasha=meep" + } + ], + "lineage":"level_0.level_1", + "objectName":"level_1", + "displayName":"level 1", + "autoextractSearch":" (boris=hilda) ", + "calculations":[ + { + "owner":"level_0.level_1", + "calculationID":"3077412e0686c92fe9f1bbf6ae58e8c6daf98cfd", + "expression":"if(searchmatch(\" (prr=4) \"),1,0)", + "editable":false, + "calculationType":"Eval", + "outputFields":[ + { + "owner":"level_0.level_1", + "type":"childCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"is_level_2", + "displayName":"is_level_2", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "comment":"" + }, + { + "owner":"level_0.level_1", + "calculationID":"4a30d30bca031a36e4fde3de802c5b60f9efde95", + "expression":"if(searchmatch(\"NOT( (prr=4) )\"),1,0)", + "editable":false, + "calculationType":"Eval", + "outputFields":[ + { + "owner":"level_0.level_1", + "type":"childCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"is_not_level_2", + "displayName":"is_not_level_2", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "comment":"" + } + ], + "previewSearch":" | search (boris=hilda) (natasha=meep) ", + "objectSearchNoFields":" | search (boris=hilda) | rename \"is_level_2\" AS \"level_0.level_1.is_level_2\", \"is_not_level_2\" AS \"level_0.level_1.is_not_level_2\" | rename \"level_0.level_1.is_level_2\" AS \"is_level_2\", \"level_0.level_1.is_not_level_2\" AS \"is_not_level_2\" | search (natasha=meep) | eval \"is_level_2\"=if(searchmatch(\" (prr=4) \"),1,0) | eval \"is_not_level_2\"=if(searchmatch(\"NOT( (prr=4) )\"),1,0) | rename \"is_level_2\" AS \"level_0.level_1.is_level_2\", \"is_not_level_2\" AS \"level_0.level_1.is_not_level_2\"", + "tsidxNamespace":"", + "comment":"", + "fields":[ + { + "owner":"BaseEvent", + "type":"timestamp", + "hidden":false, + "fieldSearch":"", + "fieldName":"_time", + "displayName":"_time", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"host", + "displayName":"host", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"source", + "displayName":"source", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "displayName":"sourcetype", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"level_0.level_1", + "type":"objectCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"level_1", + "displayName":"level 1", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "parentName":"level_0", + "children":[ + "level_2" + ] + }, + { + "objectSearch":" | search (boris=hilda) (natasha=meep) (prr=4) | fields \"_time\", \"host\", \"source\", \"sourcetype\"", + "constraints":[ + { + "owner":"level_0", + "search":"boris=hilda" + }, + { + "owner":"level_0.level_1", + "search":"natasha=meep" + }, + { + "owner":"level_0.level_1.level_2", + "search":"prr=4" + } + ], + "lineage":"level_0.level_1.level_2", + "objectName":"level_2", + "displayName":"level 2", + "autoextractSearch":" (boris=hilda) ", + "calculations":[ + + ], + "previewSearch":" | search (boris=hilda) (natasha=meep) (prr=4) ", + "objectSearchNoFields":" | search (boris=hilda) (natasha=meep) (prr=4) ", + "tsidxNamespace":"", + "comment":"", + "fields":[ + { + "owner":"BaseEvent", + "type":"timestamp", + "hidden":false, + "fieldSearch":"", + "fieldName":"_time", + "displayName":"_time", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"host", + "displayName":"host", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"source", + "displayName":"source", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"BaseEvent", + "type":"string", + "hidden":false, + "fieldSearch":"", + "fieldName":"sourcetype", + "displayName":"sourcetype", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + }, + { + "owner":"level_0.level_1.level_2", + "type":"objectCount", + "hidden":false, + "fieldSearch":"", + "fieldName":"level_2", + "displayName":"level 2", + "editable":false, + "comment":"", + "required":false, + "multivalue":false + } + ], + "parentName":"level_1", + "children":[ + + ] + } + ], + "displayName":"inheritance test", + "objectSummary":{ + "Event-Based":3, + "Search-Based":0, + "Transaction-Based":0, + "Interfaces":0, + "Interface Implementations":0 + }, + "modelName":"inheritance_test", + "description":"Data model description to test lineages.", + "objectNameList":[ + "level_0", + "level_1", + "level_2" + ] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/model_with_empty_headers.json b/splunk/src/test/resources/data/datamodels/model_with_empty_headers.json new file mode 100644 index 00000000..4bebc53c --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/model_with_empty_headers.json @@ -0,0 +1,5 @@ +{ + "displayName": "", + "description": "", + "objects": [] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/model_with_multiple_types.json b/splunk/src/test/resources/data/datamodels/model_with_multiple_types.json new file mode 100644 index 00000000..e1c16fc6 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/model_with_multiple_types.json @@ -0,0 +1,604 @@ +{ + "objectNameList":[ + "event1", + "transaction1", + "search1", + "subsearch" + ], + "objectSummary":{ + "Search-Based":2, + "Transaction-Based":1, + "Event-Based":1, + "Interfaces":0, + "Interface Implementations":0 + }, + "displayName":"\u0bf5\u0bf1\u0bf0\u0bef - search 1", + "description":"A description", + "modelName":"search1", + "objects":[ + { + "constraints":[ + { + "search":"uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")", + "owner":"event1" + } + ], + "tsidxNamespace":"", + "objectSearchNoFields":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | rename \"event1.new_field\" AS \"new_field\", \"event1.output_from_reverse_hostname\" AS \"output_from_reverse_hostname\", \"event1.from\" AS \"from\", \"event1.to\" AS \"to\", \"event1.output_from_reverse_hostname_lon\" AS \"output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\" AS \"output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\" AS \"output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\" AS \"output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\" AS \"output_from_reverse_hostname_Country\" | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\"", + "objectSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | rename \"event1.new_field\" AS \"new_field\", \"event1.output_from_reverse_hostname\" AS \"output_from_reverse_hostname\", \"event1.from\" AS \"from\", \"event1.to\" AS \"to\", \"event1.output_from_reverse_hostname_lon\" AS \"output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\" AS \"output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\" AS \"output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\" AS \"output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\" AS \"output_from_reverse_hostname_Country\" | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | rename \"new_field\" AS \"event1.new_field\", \"output_from_reverse_hostname\" AS \"event1.output_from_reverse_hostname\", \"from\" AS \"event1.from\", \"to\" AS \"event1.to\", \"output_from_reverse_hostname_lon\" AS \"event1.output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\" AS \"event1.output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\" AS \"event1.output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\" AS \"event1.output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\" AS \"event1.output_from_reverse_hostname_Country\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"event1.new_field\", \"event1.output_from_reverse_hostname\", \"event1.from\", \"event1.to\", \"event1.output_from_reverse_hostname_lon\", \"event1.output_from_reverse_hostname_lat\", \"event1.output_from_reverse_hostname_City\", \"event1.output_from_reverse_hostname_Region\", \"event1.output_from_reverse_hostname_Country\"", + "calculations":[ + { + "expression":"if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\")", + "outputFields":[ + { + "multivalue":false, + "type":"string", + "comment":"", + "required":true, + "editable":true, + "hidden":true, + "fieldName":"new_field", + "displayName":"My New Field", + "owner":"event1", + "fieldSearch":"new_field=* " + } + ], + "comment":"", + "calculationID":"93fzsv03wa7", + "editable":true, + "calculationType":"Eval", + "owner":"event1" + }, + { + "lookupField":"a_lookup_field", + "outputFields":[ + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"reverse_hostname", + "fieldSearch":"output_from_reverse_hostname=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"\u0bf5aad", + "fieldName":"output_from_reverse_hostname", + "type":"ipv4", + "owner":"event1" + } + ], + "comment":"", + "calculationID":"sr3mc8o3mjr", + "editable":true, + "lookupName":"dnslookup", + "inputField":"host", + "calculationType":"Lookup", + "owner":"event1" + }, + { + "expression":" From: (?.*) To: (?.*) ", + "outputFields":[ + { + "multivalue":false, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"from", + "displayName":"from", + "owner":"event1", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"to", + "displayName":"to", + "owner":"event1", + "fieldSearch":"" + } + ], + "comment":"", + "calculationID":"a5v1k82ymic", + "editable":true, + "inputField":"_raw", + "calculationType":"Rex", + "owner":"event1" + }, + { + "outputFields":[ + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"lon", + "fieldSearch":"output_from_reverse_hostname_lon=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"output_from_reverse_hostname_lon", + "fieldName":"output_from_reverse_hostname_lon", + "type":"number", + "owner":"event1" + }, + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"lat", + "fieldSearch":"output_from_reverse_hostname_lat=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"output_from_reverse_hostname_lat", + "fieldName":"output_from_reverse_hostname_lat", + "type":"number", + "owner":"event1" + }, + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"City", + "fieldSearch":"output_from_reverse_hostname_City=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"output_from_reverse_hostname_City", + "fieldName":"output_from_reverse_hostname_City", + "type":"string", + "owner":"event1" + }, + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"Region", + "fieldSearch":"output_from_reverse_hostname_Region=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"output_from_reverse_hostname_Region", + "fieldName":"output_from_reverse_hostname_Region", + "type":"string", + "owner":"event1" + }, + { + "editable":true, + "multivalue":false, + "lookupOutputFieldName":"Country", + "fieldSearch":"output_from_reverse_hostname_Country=* ", + "required":true, + "hidden":false, + "comment":"", + "displayName":"output_from_reverse_hostname_Country", + "fieldName":"output_from_reverse_hostname_Country", + "type":"string", + "owner":"event1" + } + ], + "comment":"", + "calculationID":"pbe9bd0rp4", + "editable":true, + "inputField":"output_from_reverse_hostname", + "calculationType":"GeoIP", + "owner":"event1" + } + ], + "children":[ + + ], + "previewSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* ", + "comment":"", + "fields":[ + { + "multivalue":false, + "type":"timestamp", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"_time", + "displayName":"_time", + "owner":"BaseEvent", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"string", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"host", + "displayName":"host", + "owner":"BaseEvent", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"string", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"source", + "displayName":"source", + "owner":"BaseEvent", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"string", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"sourcetype", + "displayName":"sourcetype", + "owner":"BaseEvent", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"objectCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"event1", + "displayName":"event1", + "owner":"event1", + "fieldSearch":"" + } + ], + "objectName":"event1", + "displayName":"event1", + "parentName":"BaseEvent", + "lineage":"event1", + "autoextractSearch":" (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) " + }, + { + "constraints":[ + + ], + "objectsToGroup":[ + "event1" + ], + "tsidxNamespace":"", + "objectSearchNoFields":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | transaction mvlist=t keepevicted=f maxspan=100m maxpause=25s host from | search *", + "transactionMaxPause":"25s", + "groupByFields":[ + "host", + "from" + ], + "objectSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | transaction mvlist=t keepevicted=f maxspan=100m maxpause=25s host from | search * | fields \"eventcount\", \"duration\", \"_time\", \"host\", \"source\", \"sourcetype\", \"new_field\", \"output_from_reverse_hostname\", \"from\", \"to\", \"output_from_reverse_hostname_lon\", \"output_from_reverse_hostname_lat\", \"output_from_reverse_hostname_City\", \"output_from_reverse_hostname_Region\", \"output_from_reverse_hostname_Country\"", + "calculations":[ + + ], + "children":[ + + ], + "previewSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | head 10000 | transaction keepevicted=f maxspan=100m maxpause=25s host from | search *", + "comment":"", + "fields":[ + { + "multivalue":false, + "type":"number", + "comment":"", + "required":true, + "editable":false, + "hidden":false, + "fieldName":"eventcount", + "displayName":"eventcount", + "owner":"BaseEventSet", + "fieldSearch":"eventcount=* " + }, + { + "multivalue":false, + "type":"number", + "comment":"", + "required":true, + "editable":false, + "hidden":false, + "fieldName":"duration", + "displayName":"duration", + "owner":"BaseEventSet", + "fieldSearch":"duration=* " + }, + { + "multivalue":false, + "type":"timestamp", + "comment":"", + "required":true, + "editable":false, + "hidden":false, + "fieldName":"_time", + "displayName":"_time", + "owner":"BaseEventSet", + "fieldSearch":"_time=* " + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"host", + "displayName":"host", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"source", + "displayName":"source", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"sourcetype", + "displayName":"sourcetype", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"new_field", + "displayName":"new_field", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname", + "displayName":"output_from_reverse_hostname", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"from", + "displayName":"from", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"to", + "displayName":"to", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname_lon", + "displayName":"output_from_reverse_hostname_lon", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname_lat", + "displayName":"output_from_reverse_hostname_lat", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname_City", + "displayName":"output_from_reverse_hostname_City", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname_Region", + "displayName":"output_from_reverse_hostname_Region", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":true, + "type":"string", + "comment":"", + "required":false, + "editable":true, + "hidden":false, + "fieldName":"output_from_reverse_hostname_Country", + "displayName":"output_from_reverse_hostname_Country", + "owner":"BaseTransaction", + "fieldSearch":"" + }, + { + "multivalue":false, + "type":"objectCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"transaction1", + "displayName":"transaction1", + "owner":"transaction1", + "fieldSearch":"" + } + ], + "objectName":"transaction1", + "transactionMaxTimeSpan":"100m", + "displayName":"transaction1", + "parentName":"BaseTransaction", + "lineage":"transaction1", + "autoextractSearch":" | search (uri=\"*.php\" OR uri=\"*.py\"\nNOT (referer=null OR referer=\"-\")) | eval \"new_field\"=if(cidrmatch(\"192.0.0.0/16\", clientip), \"local\", \"other\") | lookup dnslookup a_lookup_field AS host OUTPUT reverse_hostname AS output_from_reverse_hostname | rex field=_raw \" From: (?.*) To: (?.*) \" max_match=1 | iplocation \"output_from_reverse_hostname\" prefix=output_from_reverse_hostname_ | search new_field=* output_from_reverse_hostname=* output_from_reverse_hostname_lon=* output_from_reverse_hostname_lat=* output_from_reverse_hostname_City=* output_from_reverse_hostname_Region=* output_from_reverse_hostname_Country=* | transaction mvlist=t keepevicted=f maxspan=100m maxpause=25s host from | search *" + }, + { + "constraints":[ + + ], + "tsidxNamespace":"", + "objectSearchNoFields":"| search search index=_internal | head 10| rename \"is_subsearch\" AS \"search1.is_subsearch\", \"is_not_subsearch\" AS \"search1.is_not_subsearch\" | rename \"search1.is_subsearch\" AS \"is_subsearch\", \"search1.is_not_subsearch\" AS \"is_not_subsearch\" | eval \"is_subsearch\"=if(searchmatch(\" (boris=meep) \"),1,0) | eval \"is_not_subsearch\"=if(searchmatch(\"NOT( (boris=meep) )\"),1,0) | rename \"is_subsearch\" AS \"search1.is_subsearch\", \"is_not_subsearch\" AS \"search1.is_not_subsearch\"", + "objectSearch":"| search search index=_internal | head 10| rename \"is_subsearch\" AS \"search1.is_subsearch\", \"is_not_subsearch\" AS \"search1.is_not_subsearch\" | rename \"search1.is_subsearch\" AS \"is_subsearch\", \"search1.is_not_subsearch\" AS \"is_not_subsearch\" | eval \"is_subsearch\"=if(searchmatch(\" (boris=meep) \"),1,0) | eval \"is_not_subsearch\"=if(searchmatch(\"NOT( (boris=meep) )\"),1,0) | rename \"is_subsearch\" AS \"search1.is_subsearch\", \"is_not_subsearch\" AS \"search1.is_not_subsearch\" | fields \"search1.is_subsearch\", \"search1.is_not_subsearch\"", + "calculations":[ + { + "expression":"if(searchmatch(\" (boris=meep) \"),1,0)", + "outputFields":[ + { + "multivalue":false, + "type":"childCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"is_subsearch", + "displayName":"is_subsearch", + "owner":"search1", + "fieldSearch":"" + } + ], + "comment":"", + "calculationID":"0ed17fcd0954d6299d64bf4e1556514229b61fa8", + "editable":false, + "calculationType":"Eval", + "owner":"search1" + }, + { + "expression":"if(searchmatch(\"NOT( (boris=meep) )\"),1,0)", + "outputFields":[ + { + "multivalue":false, + "type":"childCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"is_not_subsearch", + "displayName":"is_not_subsearch", + "owner":"search1", + "fieldSearch":"" + } + ], + "comment":"", + "calculationID":"ce565b44f7e01bb1ea9afb742f5bb361f94e39b2", + "editable":false, + "calculationType":"Eval", + "owner":"search1" + } + ], + "children":[ + "subsearch" + ], + "previewSearch":"| search search index=_internal | head 10", + "comment":"", + "fields":[ + { + "multivalue":false, + "type":"objectCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"search1", + "displayName":"search1", + "owner":"search1", + "fieldSearch":"" + } + ], + "objectName":"search1", + "displayName":"search1", + "baseSearch":"search index=_internal | head 10", + "parentName":"BaseSearch", + "lineage":"search1", + "autoextractSearch":"| search search index=_internal | head 10" + }, + { + "constraints":[ + { + "search":"boris=meep", + "owner":"search1.subsearch" + } + ], + "tsidxNamespace":"", + "objectSearchNoFields":"| search search index=_internal | head 10 | search (boris=meep) ", + "objectSearch":"| search search index=_internal | head 10 | search (boris=meep) ", + "calculations":[ + + ], + "children":[ + + ], + "previewSearch":"| search search index=_internal | head 10 | search (boris=meep) ", + "comment":"", + "fields":[ + { + "multivalue":false, + "type":"objectCount", + "comment":"", + "required":false, + "editable":false, + "hidden":false, + "fieldName":"subsearch", + "displayName":"subsearch", + "owner":"search1.subsearch", + "fieldSearch":"" + } + ], + "objectName":"subsearch", + "displayName":"subsearch", + "baseSearch":"search index=_internal | head 10", + "parentName":"search1", + "lineage":"search1.subsearch", + "autoextractSearch":"| search search index=_internal | head 10" + } + ] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/model_with_unicode_headers.json b/splunk/src/test/resources/data/datamodels/model_with_unicode_headers.json new file mode 100644 index 00000000..23b78086 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/model_with_unicode_headers.json @@ -0,0 +1,5 @@ +{ + "displayName": "ဩᚙ௵", + "description": "௵௱௰௯", + "objects": [] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/object_with_one_search.json b/splunk/src/test/resources/data/datamodels/object_with_one_search.json new file mode 100644 index 00000000..58c77c87 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/object_with_one_search.json @@ -0,0 +1,14 @@ +{ + "displayName": "ဩᚙ௵", + "description": "௵௱௰௯", + "objects": [ + { + "objectName": "search1", + "displayName": "௵௱௰௯ - search 1", + "parentName": "BaseEvent", + "fields": [], + "calculations": [], + "constraints": [] + } + ] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/datamodels/object_with_two_searches.json b/splunk/src/test/resources/data/datamodels/object_with_two_searches.json new file mode 100644 index 00000000..4bec5934 --- /dev/null +++ b/splunk/src/test/resources/data/datamodels/object_with_two_searches.json @@ -0,0 +1,22 @@ +{ + "displayName": "ဩᚙ௵ 2", + "description": "௵௱௰௯", + "objects": [ + { + "objectName": "search1", + "displayName": "௵௱௰௯ - search 1", + "parentName": "BaseEvent", + "fields": [], + "calculations": [], + "constraints": [] + }, + { + "objectName": "search2", + "displayName": "௵௱௰௯ - search 2", + "parentName": "BaseEvent", + "fields": [], + "calculations": [], + "constraints": [] + } + ] +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/export/4.2.5/export_results.xml b/splunk/src/test/resources/data/export/4.2.5/export_results.xml new file mode 100644 index 00000000..99fcb959 --- /dev/null +++ b/splunk/src/test/resources/data/export/4.2.5/export_results.xml @@ -0,0 +1,88 @@ + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.2.5.6/etc" + + + + + GET + + + 16 + + + + + POST + + + 3 + + + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.2.5.6/etc" + + + + + GET + + + 16 + + + + + POST + + + 7 + + + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.2.5.6/etc" + + + + + GET + + + 16 + + + + + POST + + + 7 + + + diff --git a/splunk/src/test/resources/data/export/4.3.5/export_results.xml b/splunk/src/test/resources/data/export/4.3.5/export_results.xml new file mode 100644 index 00000000..8c3c200d --- /dev/null +++ b/splunk/src/test/resources/data/export/4.3.5/export_results.xml @@ -0,0 +1,87 @@ + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.3.5/etc" + + + + + GET + + + 37 + + + + + POST + + + 5 + + + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.3.5/etc" + + + + + GET + + + 41 + + + + + POST + + + 6 + + + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-4.3.5/etc" + + + + + GET + + + 41 + + + + + POST + + + 6 + + + diff --git a/splunk/src/test/resources/data/export/5.0.1/export_results.xml b/splunk/src/test/resources/data/export/5.0.1/export_results.xml new file mode 100644 index 00000000..9d0b2e59 --- /dev/null +++ b/splunk/src/test/resources/data/export/5.0.1/export_results.xml @@ -0,0 +1,78 @@ + + + + +method +count(_raw) + + + + + GET + + + 3544 + + + + + POST + + + 437 + + + + + + +method +count(_raw) + + + + + GET + + + 3544 + + + + + POST + + + 437 + + + + + + +method +count(_raw) + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-5.0.2/etc" + + + + + GET + + + 3544 + + + + + POST + + + 437 + + + diff --git a/splunk/src/test/resources/data/export/5.0.1/nonreporting.xml b/splunk/src/test/resources/data/export/5.0.1/nonreporting.xml new file mode 100644 index 00000000..4784491a --- /dev/null +++ b/splunk/src/test/resources/data/export/5.0.1/nonreporting.xml @@ -0,0 +1,232 @@ + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + base lispy: [ AND index::_internal ] + search context: user="admin", app="search", bs-pathname="/Users/fross/splunks/splunk-5.0.2/etc" + + + + + _internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9 + + + 1:4419005 + + + 1360608181 + + 02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=indexertpool, qsize=0, workers=6, qwork_units=0 + + 0 + + + fross-mbp15.local + _internal + + + splunkd + + + .060 + + + 2013-02-11 10:43:01.060 PST + + + fross-mbp15.local + + + _internal + + + 1 + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + + + _internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9 + + + 1:4418999 + + + 1360608181 + + 02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=bundlereplthreadpool, qsize=0, workers=0, qwork_units=0 + + 1 + + + fross-mbp15.local + _internal + + + splunkd + + + .060 + + + 2013-02-11 10:43:01.060 PST + + + fross-mbp15.local + + + _internal + + + 1 + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + + _internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9 + + + 1:4418632 + + + 1360608170 + + 127.0.0.1 - admin [11/Feb/2013:10:42:49.790 -0800] "POST /services/search/jobs/export HTTP/1.1" 200 440404 - - - 257ms + + 51 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .790 + + + 2013-02-11 10:42:49.790 PST + + + fross-mbp15.local + + + _internal + + + 1 + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log + + + splunkd_access + + + fross-mbp15.local + + + + + _internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9 + + + 1:4418626 + + + 1360608157 + + 127.0.0.1 - admin [11/Feb/2013:10:42:36.527 -0800] "POST /services/search/jobs/export HTTP/1.1" 200 4937 - - - 219ms + + 52 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .527 + + + 2013-02-11 10:42:36.527 PST + + + fross-mbp15.local + + + _internal + + + 1 + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log + + + splunkd_access + + + fross-mbp15.local + + + diff --git a/splunk/src/test/resources/data/export_test_data.json b/splunk/src/test/resources/data/export_test_data.json new file mode 100644 index 00000000..aecf9454 --- /dev/null +++ b/splunk/src/test/resources/data/export_test_data.json @@ -0,0 +1,480 @@ +{ + "5.0.1": { + "with_preview": [ + { + "fields": [ + "method", + "count(_raw)" + ], + "results": [ + { + "fields": { + "count(_raw)": "3544", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "437", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "results": [ + { + "fields": { + "count(_raw)": "3544", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "437", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0.2/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "3544", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "437", + "method": "POST" + } + } + ], + "is_preview": false + } + ], + "nonreporting": { + "fields": [ + "_bkt", + "_cd", + "_indextime", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "host", + "index", + "linecount", + "source", + "sourcetype", + "splunk_server" + ], + "results": [ + { + "RAW_XML": "02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=indexertpool, qsize=0, workers=6, qwork_units=0", + "fields": { + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "index": "_internal", + "sourcetype": "splunkd", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log", + "_subsecond": ".060", + "_bkt": "_internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9", + "splunk_server": "fross-mbp15.local", + "_time": "2013-02-11 10:43:01.060 PST", + "linecount": "1", + "_sourcetype": "splunkd", + "_indextime": "1360608181", + "_raw": "02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=indexertpool, qsize=0, workers=6, qwork_units=0", + "host": "fross-mbp15.local", + "_serial": "0", + "_cd": "1:4419005" + } + }, + { + "RAW_XML": "02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=bundlereplthreadpool, qsize=0, workers=0, qwork_units=0", + "fields": { + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "index": "_internal", + "sourcetype": "splunkd", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log", + "_subsecond": ".060", + "_bkt": "_internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9", + "splunk_server": "fross-mbp15.local", + "_time": "2013-02-11 10:43:01.060 PST", + "linecount": "1", + "_sourcetype": "splunkd", + "_indextime": "1360608181", + "_raw": "02-11-2013 10:43:01.060 -0800 INFO Metrics - group=tpool, name=bundlereplthreadpool, qsize=0, workers=0, qwork_units=0", + "host": "fross-mbp15.local", + "_serial": "1", + "_cd": "1:4418999" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [11/Feb/2013:10:42:49.790 -0800] \"POST /services/search/jobs/export HTTP/1.1\" 200 440404 - - - 257ms", + "fields": { + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "index": "_internal", + "sourcetype": "splunkd_access", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log", + "_subsecond": ".790", + "_bkt": "_internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9", + "splunk_server": "fross-mbp15.local", + "_time": "2013-02-11 10:42:49.790 PST", + "linecount": "1", + "_sourcetype": "splunkd_access", + "_indextime": "1360608170", + "_raw": "127.0.0.1 - admin [11/Feb/2013:10:42:49.790 -0800] \"POST /services/search/jobs/export HTTP/1.1\" 200 440404 - - - 257ms", + "host": "fross-mbp15.local", + "_serial": "51", + "_cd": "1:4418632" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [11/Feb/2013:10:42:36.527 -0800] \"POST /services/search/jobs/export HTTP/1.1\" 200 4937 - - - 219ms", + "fields": { + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "index": "_internal", + "sourcetype": "splunkd_access", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log", + "_subsecond": ".527", + "_bkt": "_internal~1~BC03CEFB-A9C5-4DF5-9D8D-2558AD6E6EA9", + "splunk_server": "fross-mbp15.local", + "_time": "2013-02-11 10:42:36.527 PST", + "linecount": "1", + "_sourcetype": "splunkd_access", + "_indextime": "1360608157", + "_raw": "127.0.0.1 - admin [11/Feb/2013:10:42:36.527 -0800] \"POST /services/search/jobs/export HTTP/1.1\" 200 4937 - - - 219ms", + "host": "fross-mbp15.local", + "_serial": "52", + "_cd": "1:4418626" + } + } + ], + "is_preview": false + }, + "without_preview": { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0.2/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "3544", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "437", + "method": "POST" + } + } + ], + "is_preview": false + } + }, + "4.3.5": { + "with_preview": [ + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.3.5/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "37", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "5", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.3.5/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "41", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "6", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.3.5/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "41", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "6", + "method": "POST" + } + } + ], + "is_preview": false + } + ], + "without_preview": { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.3.5/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "41", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "6", + "method": "POST" + } + } + ], + "is_preview": false + } + }, + "4.2.5": { + "with_preview": [ + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.2.5.6/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "16", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "3", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.2.5.6/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "16", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "7", + "method": "POST" + } + } + ], + "is_preview": true + }, + { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.2.5.6/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "16", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "7", + "method": "POST" + } + } + ], + "is_preview": false + } + ], + "without_preview": { + "fields": [ + "method", + "count(_raw)" + ], + "messages": [ + { + "type": "DEBUG", + "value": "base lispy: [ AND index::_internal ]" + }, + { + "type": "DEBUG", + "value": "search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-4.2.5.6/etc\"" + } + ], + "results": [ + { + "fields": { + "count(_raw)": "16", + "method": "GET" + } + }, + { + "fields": { + "count(_raw)": "7", + "method": "POST" + } + } + ], + "is_preview": false + } + } +} diff --git a/splunk/src/test/resources/data/pivot/empty_pivot.json b/splunk/src/test/resources/data/pivot/empty_pivot.json new file mode 100644 index 00000000..3ecef141 --- /dev/null +++ b/splunk/src/test/resources/data/pivot/empty_pivot.json @@ -0,0 +1,13 @@ +{ + "dataModel": "mymodel", + "baseClass": "myobject", + "filters": [], + "cells": [], + "rows": [], + "columns": [], + "rowFormat": { + + }, + "colFormat": {} + +} \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/4.2.5/results-empty.xml b/splunk/src/test/resources/data/results/4.2.5/results-empty.xml new file mode 100644 index 00000000..e69de29b diff --git a/splunk/src/test/resources/data/results/4.2.5/results-preview.xml b/splunk/src/test/resources/data/results/4.2.5/results-preview.xml new file mode 100644 index 00000000..619fe611 --- /dev/null +++ b/splunk/src/test/resources/data/results/4.2.5/results-preview.xml @@ -0,0 +1,255 @@ + + + + +_indextime +_kv +_raw +_serial +_sourcetype +_subsecond +_time +active_streams +blocking +bytes +client_app +clientip +component +count +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +display_row_numbers +earliest +enable_event_actions +enable_field_actions +entity_name +eventtype +field_list +file +fillcontents +filter +host +ident +index +length +linecount +log_level +max_block_secs +max_lines +max_lines_constraint +max_pages +message +method +min_freq +min_lines +offset +other +output_mode +output_time_format +punct +q +queue_size +referer +referer_domain +req_time +reverse_order +root +s +segmentation +show_empty_fields +sid +source +sourcetype +spent +splunk_server +status +time_format +timeendpos +timestartpos +truncation_mode +uri +uri_path +uri_query +user +useragent +version + + + + + 1355947338 + + + 1 + + 12-19-2012 12:02:18.172 -0800 INFO IndexProcessor - rtsearch connection established, filter = '[ AND index::_internal search ]', active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0 + + 0 + + + splunkd + + + .172 + + + 2012-12-19T12:02:18.172-08:00 + + + 1 + + + FALSE + + + IndexProcessor + + + 12 + + + 19 + + + 2 + + + december + + + 18 + + + wednesday + + + 2012 + + + -480 + + + splunkd-log + + + '[ AND index::_internal search ]' + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + 0 + + + rtsearch connection established, filter = '[ AND index::_internal search ]', active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0 + + + --_::._-____-___,__=_'[__::__]',__=_,__=_,__=_,__= + + + 10000 + + + /Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 11 + + + + + 1355947338 + + + 1 + + 2012-12-19 12:02:18,066 - admin search search index=_internal | head 10 + + 1 + + + searches + + + .066 + + + 2012-12-19T12:02:18.066-08:00 + + + 12 + + + 19 + + + 2 + + + december + + + 18 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 1 + + + --_::,_-_t__=_|__ + + + /Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/searches.log + + + searches + + + fross-mbp15.local + + + 24 + + + 11 + + + diff --git a/splunk/src/test/resources/data/results/4.2.5/results.xml b/splunk/src/test/resources/data/results/4.2.5/results.xml new file mode 100644 index 00000000..a7be7a7f --- /dev/null +++ b/splunk/src/test/resources/data/results/4.2.5/results.xml @@ -0,0 +1,336 @@ + + + + +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +active_hist_searches +active_realtime_searches +alert_actions +app +autoload +bytes +clientip +component +cookie +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +dispatch_time +drop_count +earliest +eventtype +file +group +host +ident +index +line +linecount +log_level +message +method +other +punct +q +referer +referer_domain +req_time +requestid +result_count +return_to +root +run_time +savedsearch_id +savedsearch_name +scheduled_time +sid +source +sourcetype +spent +splunk_server +status +suppressed +thread_id +timeendpos +timestartpos +trigger_condition_state +uri +uri_domain +uri_path +uri_query +user +useragent +version + + + + + 1:5282 + + + 1355947283 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:12:01:22.845 -0800] "GET /services/search/timeparser/tz HTTP/1.1" 200 2891 - - - 1ms + + 0 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .845 + + + 2012-12-19T12:01:22.845-08:00 + + + 2891 + + + 127.0.0.1 + + + 12 + + + 19 + + + 1 + + + december + + + 22 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + tz + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + - - - 1ms + + + ..._-__[//:::._-]_"_////_/."___-_-_-_ + + + 19/Dec/2012:12:01:22.845 -0800 + + + services + + + /Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 1 + + + fross-mbp15.local + + + 200 + + + 49 + + + 31 + + + /services/search/timeparser/tz + + + /services/search/timeparser/tz + + + admin + + + HTTP/1.1 + + + + + 1:5211 + + + 1355947283 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:12:01:22.762 -0800] "POST /en-US/account/login HTTP/1.1" 200 1897 "http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0" - 50d21d12c31e60610 35ms + + 1 + + + fross-mbp15.local + _internal + + + splunk_web_access + + + .762 + + + 2012-12-19T12:01:22.762-08:00 + + + 1897 + + + 127.0.0.1 + + + 12 + + + 19 + + + 1 + + + december + + + 22 + + + wednesday + + + 2012 + + + -480 + + + login + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + POST + + + - 50d21d12c31e60610 35ms + + + ..._-__[//:::._-]_"_/-//_/."___"://:/-//?=%-%%%%%% + + + http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0 + + + http://localhost:8000 + + + 19/Dec/2012:12:01:22.762 -0800 + + + %2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0 + + + en-US + + + /Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/web_access.log + + + splunk_web_access + + + 35 + + + fross-mbp15.local + + + 200 + + + 49 + + + 31 + + + /en-US/account/login + + + /en-US/account/login + + + admin + + + Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0 + + + HTTP/1.1 + + + diff --git a/splunk/src/test/resources/data/results/4.3.5/results-empty.xml b/splunk/src/test/resources/data/results/4.3.5/results-empty.xml new file mode 100644 index 00000000..e69de29b diff --git a/splunk/src/test/resources/data/results/4.3.5/results-preview.xml b/splunk/src/test/resources/data/results/4.3.5/results-preview.xml new file mode 100644 index 00000000..2ca3ff2a --- /dev/null +++ b/splunk/src/test/resources/data/results/4.3.5/results-preview.xml @@ -0,0 +1,1057 @@ + + + + +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +active_hist_searches +active_realtime_searches +app +appCodeName +appName +browser +bytes +class +client_app +clientip +component +count +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +delimiter +display_row_numbers +drop_count +earliest +enable_event_actions +enable_field_actions +entity_name +eventtype +field_list +fields +file +fillcontents +group +host +ident +index +jobStatus +latest +line +linecount +log_level +max_lines +max_lines_constraint +max_time +mean_preview_period +message +message_level +method +min_freq +min_lines +name +namespace +offset +other +output_mode +output_time_format +platform +prefix +punct +q +referer +referer_domain +req_time +requestid +reverse_order +root +s +search +segmentation +show_empty_fields +sid +sortDir +sortKey +sort_dir +sort_key +source +sourcetype +spent +splunk_server +staticFields +status +time_format +timeendpos +timestartpos +truncation_mode +uri +uri_path +uri_query +user +userAgent +useragent +version + + + + + 54:8568 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + 731 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + + --_::,_t[]_:_-_:__():_////-../// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8562 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + 732 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8674 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + 728 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8662 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + 729 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_////-..//// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8651 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + 730 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:9267 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 726 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9262 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 727 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9769 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 724 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9764 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 725 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:10097 + + + 1355946614 + + + 1 + + 12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 722 + + + fross-mbp15.local + _internal + + + splunkd + + + .351 + + + 2012-12-19T11:50:14.351-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 50 + + + december + + + 14 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/4.3.5/results.xml b/splunk/src/test/resources/data/results/4.3.5/results.xml new file mode 100644 index 00000000..065cba48 --- /dev/null +++ b/splunk/src/test/resources/data/results/4.3.5/results.xml @@ -0,0 +1,626 @@ + + + + +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +bytes +client_app +clientip +cookie +count +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +display_row_numbers +earliest +enable_event_actions +enable_field_actions +entity_name +eventtype +field_list +file +fillcontents +host +ident +index +latest +linecount +max_lines +max_lines_constraint +method +min_freq +min_lines +offset +other +output_mode +output_time_format +punct +q +referer +referer_domain +req_time +reverse_order +root +s +segmentation +show_empty_fields +sid +source +sourcetype +spent +splunk_server +status +time_format +timeendpos +timestartpos +truncation_mode +uri +uri_domain +uri_path +uri_query +user +useragent +version + + + + + 54:23786 + + + 1355946940 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:55:39.296 -0800] "POST /en-US/api/shelper HTTP/1.1" 200 1398 "http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0" - 50d21bbb4b5224c10 3ms + + 0 + + + fross-mbp15.local + _internal + + + splunk_web_access + + + .296 + + + 2012-12-19T11:55:39.296-08:00 + + + 1398 + + + 127.0.0.1 + + + 11 + + + 19 + + + 55 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + rt-1h + + + shelper + + + fross-mbp15.local + + + - + + + _internal + + + rt + + + 1 + + + POST + + + - 50d21bbb4b5224c10 3ms + + + ..._-__[//:::._-]_"_/-//_/."___"://:/-///?=%%%%%%% + + + search%20search%20index%3D_internal%20%7C%20head%2010 + + + http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt + + + http://localhost:8000 + + + 19/Dec/2012:11:55:39.296 -0800 + + + en-US + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_access.log + + + splunk_web_access + + + 3 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /en-US/api/shelper + + + /en-US/api/shelper + + + admin + + + Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0 + + + HTTP/1.1 + + + + + 54:23689 + + + 1355946940 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:55:39.265 -0800] "GET /services/search/jobs/rt_1355946914.13 HTTP/1.1" 200 10957 - - - 4ms + + 1 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .265 + + + 2012-12-19T11:55:39.265-08:00 + + + 10957 + + + 127.0.0.1 + + + 11 + + + 19 + + + 55 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + rt_1355946914.13 + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + - - - 4ms + + + ..._-__[//:::._-]_"_////._/."___-_-_-_ + + + 19/Dec/2012:11:55:39.265 -0800 + + + services + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 4 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /services/search/jobs/rt_1355946914.13 + + + /services/search/jobs/rt_1355946914.13 + + + admin + + + HTTP/1.1 + + + + + 54:23682 + + + 1355946940 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:55:39.258 -0800] "GET /servicesNS/admin/search/properties/event_renderers?fillcontents=1 HTTP/1.1" 200 3657 - - - 1ms + + 2 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .258 + + + 2012-12-19T11:55:39.258-08:00 + + + 3657 + + + 127.0.0.1 + + + 11 + + + 19 + + + 55 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + event_renderers + + + 1 + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + - - - 1ms + + + ..._-__[//:::._-]_"_/////?=_/."___-_-_-_ + + + 19/Dec/2012:11:55:39.258 -0800 + + + servicesNS + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 1 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /servicesNS/admin/search/properties/event_renderers?fillcontents=1 + + + /servicesNS/admin/search/properties/event_renderers + + + fillcontents=1 + + + admin + + + HTTP/1.1 + + + + + 54:23670 + + + 1355946940 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:55:39.231 -0800] "GET /services/search/jobs/rt_1355946914.13/events?count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract HTTP/1.1" 200 32837 - - - 6ms + + 3 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .231 + + + 2012-12-19T11:55:39.231-08:00 + + + 32837 + + + 127.0.0.1 + + + 0 + + + 11 + + + 19 + + + 55 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + events + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + 10 + + + GET + + + -10 + + + - - - 6ms + + + xml + + + %25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z + + + ..._-__[//:::._-]_"_////./?=&=&=&=%.%&=&=&=-&=%-%- + + + 19/Dec/2012:11:55:39.231 -0800 + + + services + + + full + + + True + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 6 + + + fross-mbp15.local + + + 200 + + + %25s.%25Q + + + 49 + + + 19 + + + abstract + + + /services/search/jobs/rt_1355946914.13/events?count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract + + + /services/search/jobs/rt_1355946914.13/events + + + count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract + + + admin + + + HTTP/1.1 + + + diff --git a/splunk/src/test/resources/data/results/5.0.2/results-empty.xml b/splunk/src/test/resources/data/results/5.0.2/results-empty.xml new file mode 100644 index 00000000..3cf9ecac --- /dev/null +++ b/splunk/src/test/resources/data/results/5.0.2/results-empty.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/5.0.2/results-empty_preview.xml b/splunk/src/test/resources/data/results/5.0.2/results-empty_preview.xml new file mode 100644 index 00000000..929fa87f --- /dev/null +++ b/splunk/src/test/resources/data/results/5.0.2/results-empty_preview.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/5.0.2/results-preview.xml b/splunk/src/test/resources/data/results/5.0.2/results-preview.xml new file mode 100644 index 00000000..ab5b5965 --- /dev/null +++ b/splunk/src/test/resources/data/results/5.0.2/results-preview.xml @@ -0,0 +1,448 @@ + + + + +_bkt +_cd +_confstr +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +abandoned_channels +active_hist_searches +active_realtime_searches +app +appCodeName +appName +appVersion +average_kbps +avg_age +browser +bytes +chillOrFreeze +class +client_app +clientip +component +count +current_size +current_size_kb +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +delimiter +digest +dispatched +display_row_numbers +drop_count +earliest +enable_event_actions +enable_field_actions +entity_name +eps +ev +eventtype +field_list +fields +file +fillcontents +flushBlockSig +fork_recovermetadata +group +host +ident +inactive_channels +index +instantaneous_eps +instantaneous_kbps +jobStatus +kb +kbps +largest_size +latest +line +linecount +load_average +log_level +max_age +max_lines +max_lines_constraint +max_size_kb +message +message_level +method +min_freq +min_lines +name +namespace +new_channels +numMsgs +offset +other +output_mode +output_time_format +platform +punct +q +qsize +qwork_units +rebuild_metadata +reclaimed_channels +referer +referer_domain +refresh +removed_channels +replicate_semislice +req_time +requestid +retryMove_1hotBkt +reverse_order +roll_hotBkt +root +s +search +segmentation +series +service_externProc +service_maxSizes +service_volumes +show_empty_fields +sid +size_hotBkt +skipped +smallest_size +sortDir +sortKey +sort_dir +sort_key +source +sourcetype +spent +splunk_server +staticFields +status +sync_hotBkt +task +templateTime +throttle_optimize +time_format +timedout_channels +timeendpos +timestamp +timestartpos +total_k_processed +truncation_mode +update_bktManifest +update_checksums +uri +uri_path +uri_query +user +userAgent +useragent +version +viewTime +wait +with_new +workers + + + + + _internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 20:6362329 + + + 1355942859 + + + 1 + + 12-19-2012 10:47:39.098 -0800 INFO Metrics - group=mpool, max_used_interval=11760, max_used=106926, avg_rsv=256, capacity=536870912, used=0, rep_used=0 + + 20446 + + + fross-mbp15.local + _internal + + + splunkd + + + .098 + + + 2012-12-19T10:47:39.098-08:00 + + + Metrics + + + 10 + + + 19 + + + 47 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + mpool + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=mpool, max_used_interval=11760, max_used=106926, avg_rsv=256, capacity=536870912, used=0, rep_used=0 + + + --_::._-____-_=,_=,_=,_=,_=,_=,_= + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + _internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 20:6362402 + + + 1355942859 + + + 1 + + 12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=sendout, cpu_seconds=0.000000, executes=48, cumulative_hits=927340 + + 20436 + + + fross-mbp15.local + _internal + + + splunkd + + + .099 + + + 2012-12-19T10:47:39.099-08:00 + + + Metrics + + + 10 + + + 19 + + + 47 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + pipeline + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=pipeline, name=merging, processor=sendout, cpu_seconds=0.000000, executes=48, cumulative_hits=927340 + + + merging + + + --_::._-____-_=,_=,_=,_=.,_=,_= + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + _internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 20:6362395 + + + 1355942859 + + + 1 + + 12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=readerin, cpu_seconds=0.000000, executes=48, cumulative_hits=927707 + + 20437 + + + fross-mbp15.local + _internal + + + splunkd + + + .099 + + + 2012-12-19T10:47:39.099-08:00 + + + Metrics + + + 10 + + + 19 + + + 47 + + + december + + + 39 + + + wednesday + + + 2012 + + + -480 + + + pipeline + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=pipeline, name=merging, processor=readerin, cpu_seconds=0.000000, executes=48, cumulative_hits=927707 + + + merging + + + --_::._-____-_=,_=,_=,_=.,_=,_= + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + diff --git a/splunk/src/test/resources/data/results/5.0.2/results.xml b/splunk/src/test/resources/data/results/5.0.2/results.xml new file mode 100644 index 00000000..5571fabf --- /dev/null +++ b/splunk/src/test/resources/data/results/5.0.2/results.xml @@ -0,0 +1,501 @@ + + + + +_bkt +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +abandoned_channels +active_hist_searches +active_realtime_searches +average_kbps +avg_age +bytes +chillOrFreeze +clientip +component +cookie +current_size +current_size_kb +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +drop_count +eps +ev +eventtype +file +flushBlockSig +fork_recovermetadata +group +host +ident +inactive_channels +index +instantaneous_eps +instantaneous_kbps +kb +kbps +largest_size +linecount +load_average +log_level +max_age +max_size_kb +message +method +name +namespace +new_channels +numMsgs +other +punct +qsize +qwork_units +rebuild_metadata +reclaimed_channels +referer +referer_domain +removed_channels +replicate_semislice +req_time +retryMove_1hotBkt +roll_hotBkt +root +series +service_externProc +service_maxSizes +service_volumes +sid +size_hotBkt +smallest_size +source +sourcetype +spent +splunk_server +status +sync_hotBkt +task +throttle_optimize +timedout_channels +timeendpos +timestartpos +total_k_processed +update_bktManifest +update_checksums +uri +uri_domain +uri_path +uri_query +user +useragent +version +workers + + + + + _internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 21:59296 + + + 1355946377 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:46:15.549 -0800] "GET /services/messages HTTP/1.1" 200 1984 - - - 1ms + + 0 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .549 + + + 2012-12-19T11:46:15.549-08:00 + + + 1984 + + + 127.0.0.1 + + + 11 + + + 19 + + + 46 + + + december + + + 15 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + messages + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + - - - 1ms + + + ..._-__[//:::._-]_"_//_/."___-_-_-_ + + + 19/Dec/2012:11:46:15.549 -0800 + + + services + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 1 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /services/messages + + + /services/messages + + + admin + + + HTTP/1.1 + + + + + _internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 21:59301 + + + 1355946377 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:46:15.544 -0800] "GET /en-US/api/messages/index HTTP/1.1" 200 341 "http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0" - 50d219878b6ae2790 7ms + + 1 + + + fross-mbp15.local + _internal + + + splunk_web_access + + + .544 + + + 2012-12-19T11:46:15.544-08:00 + + + 341 + + + 127.0.0.1 + + + 11 + + + 19 + + + 46 + + + december + + + 15 + + + wednesday + + + 2012 + + + -480 + + + index + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + search + + + - 50d219878b6ae2790 7ms + + + ..._-__[//:::._-]_"_/-///_/."___"://:/-//?=.&="_"/ + + + http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search + + + http://localhost:8000 + + + 19/Dec/2012:11:46:15.544 -0800 + + + en-US + + + 1355946305.42 + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/web_access.log + + + splunk_web_access + + + 7 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /en-US/api/messages/index + + + /en-US/api/messages/index + + + admin + + + Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0 + + + HTTP/1.1 + + + + + _internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B + + + 21:59281 + + + 1355946374 + + + 1 + + 127.0.0.1 - admin [19/Dec/2012:11:46:14.260 -0800] "GET /services/messages HTTP/1.1" 200 1984 - - - 1ms + + 2 + + + fross-mbp15.local + _internal + + + splunkd_access + + + .260 + + + 2012-12-19T11:46:14.260-08:00 + + + 1984 + + + 127.0.0.1 + + + 11 + + + 19 + + + 46 + + + december + + + 14 + + + wednesday + + + 2012 + + + -480 + + + splunkd-access + + + messages + + + fross-mbp15.local + + + - + + + _internal + + + 1 + + + GET + + + - - - 1ms + + + ..._-__[//:::._-]_"_//_/."___-_-_-_ + + + 19/Dec/2012:11:46:14.260 -0800 + + + services + + + /Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log + + + splunkd_access + + + 1 + + + fross-mbp15.local + + + 200 + + + 49 + + + 19 + + + /services/messages + + + /services/messages + + + admin + + + HTTP/1.1 + + + diff --git a/splunk/src/test/resources/data/results/results.csv b/splunk/src/test/resources/data/results/results.csv new file mode 100644 index 00000000..64040eb7 --- /dev/null +++ b/splunk/src/test/resources/data/results/results.csv @@ -0,0 +1,4 @@ +"sum(kb)","series" +"14372242.758775","twitter" +"267802.333926","splunkd" +"5979.036338","splunkd_access" \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/results.xml b/splunk/src/test/resources/data/results/results.xml new file mode 100644 index 00000000..b34137ab --- /dev/null +++ b/splunk/src/test/resources/data/results/results.xml @@ -0,0 +1,53 @@ + + + + +series +sum(kb) + + + + base lispy: [ AND ] + search context: user='admin', app='search', bs-pathname='/some/path' + + + + twitter + + + 14372242.758775 + + + + + splunkd + + + 267802.333926 + + + + + flurry + + + 12576.454102 + + + + + splunkd_access + + + 5979.036338 + + + + + splunk_web_access + + + 5838.935649 + + + diff --git a/splunk/src/test/resources/data/results/results4.json b/splunk/src/test/resources/data/results/results4.json new file mode 100644 index 00000000..98711985 --- /dev/null +++ b/splunk/src/test/resources/data/results/results4.json @@ -0,0 +1,14 @@ +[ + { + "sum(kb)":"14372242.758775", + "series":"twitter" + }, + { + "sum(kb)":"267802.333926", + "series":"splunkd" + }, + { + "sum(kb)":"5979.036338", + "series":"splunkd_access" + } +] diff --git a/splunk/src/test/resources/data/results/results5.json b/splunk/src/test/resources/data/results/results5.json new file mode 100644 index 00000000..6475c51b --- /dev/null +++ b/splunk/src/test/resources/data/results/results5.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0/etc\""}],"results":[{"sum(kb)":"14372242.758775","series":"twitter"},{"sum(kb)":"267802.333926","series":"splunkd"},{"sum(kb)":"5979.036338","series":"splunkd_access"}]} diff --git a/splunk/src/test/resources/data/results/resultsExport.json b/splunk/src/test/resources/data/results/resultsExport.json new file mode 100644 index 00000000..ca65e81f --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsExport.json @@ -0,0 +1,69 @@ +{"preview":true,"offset":0,"lastrow":true,"result":{"host":"Andy-PC","count":"62"}} +{"preview":true,"offset":0,"result":{"host":"Andy-PC","count":"1682"}} +{"preview":true,"offset":1,"result":{"host":"andy-pc","count":"3"}} +{"preview":true,"offset":2,"lastrow":true,"result":{"host":"three.four.com","count":"1495"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"232"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"2766"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"2579"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"1786"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"3543"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"3356"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"3184"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"4242"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"4055"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"7052"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"6176"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"5989"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"10034"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"8388"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"7689"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"12668"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"11176"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"10323"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"13996"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"28317"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"11651"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"15030"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"28834"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"12685"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"17160"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"29899"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"14815"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"20432"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"31535"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"18087"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"23862"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"33250"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"21517"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"29732"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"36185"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"27772"}} +{"preview":false,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":false,"offset":1,"result":{"host":"ANDY-PC","count":"29732"}} +{"preview":false,"offset":2,"result":{"host":"Andy-PC","count":"36185"}} +{"preview":false,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":false,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"35994"}} diff --git a/splunk/src/test/resources/data/results/resultsExport.xml b/splunk/src/test/resources/data/results/resultsExport.xml new file mode 100644 index 00000000..1e388611 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsExport.xml @@ -0,0 +1,907 @@ + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + Andy-PC + + + 62 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + Andy-PC + + + 1682 + + + + + andy-pc + + + 3 + + + + + three.four.com + + + 1495 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 232 + + + + + Andy-PC + + + 2766 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 2579 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 1786 + + + + + Andy-PC + + + 3543 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 3356 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 3184 + + + + + Andy-PC + + + 4242 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 4055 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 4446 + + + + + Andy-PC + + + 4873 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 4686 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 9222 + + + + + Andy-PC + + + 7261 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 7074 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 11722 + + + + + Andy-PC + + + 10039 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 9377 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 12668 + + + + + Andy-PC + + + 11176 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 10323 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 13996 + + + + + Andy-PC + + + 28317 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 11651 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 16034 + + + + + Andy-PC + + + 29336 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 13689 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 19382 + + + + + Andy-PC + + + 31010 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 17037 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 20432 + + + + + Andy-PC + + + 31535 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 18087 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 23862 + + + + + Andy-PC + + + 33250 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 21517 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 27080 + + + + + Andy-PC + + + 34859 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 24735 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 28092 + + + + + Andy-PC + + + 35365 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 25747 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 29732 + + + + + Andy-PC + + + 36185 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 30641 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 29732 + + + + + Andy-PC + + + 36185 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 35994 + + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMV.csv b/splunk/src/test/resources/data/results/resultsMV.csv new file mode 100644 index 00000000..b78d26a4 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMV.csv @@ -0,0 +1,3 @@ +"_bkt","_cd","_indextime","_raw","_serial","_si","_sourcetype","_subsecond","_time",host,index,linecount,source,sourcetype,"splunk_server" +"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","115:4933",1354063445,"11-27-2012 16:44:05.208 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00",0,"dfoster-mbp17.local +_internal",splunkd,".208","2012-11-27T16:44:05.208-08:00","dfoster-mbp17.local","_internal",1,"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log",splunkd,"dfoster-mbp17.local" diff --git a/splunk/src/test/resources/data/results/resultsMV.xml b/splunk/src/test/resources/data/results/resultsMV.xml new file mode 100644 index 00000000..4ef5d7e3 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMV.xml @@ -0,0 +1,68 @@ + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + + _internal~115~BC509B13-C34D-4A69-B216-488806E9EA63 + + + 115:4502 + + + 1354063414 + + 11-27-2012 16:43:34.271 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00 + + 0 + + + dfoster-mbp17.local + _internal + + + splunkd + + + .271 + + + 2012-11-27T16:43:34.271-08:00 + + + dfoster-mbp17.local + + + _internal + + + 1 + + + /Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log + + + splunkd + + + dfoster-mbp17.local + + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMV4.json b/splunk/src/test/resources/data/results/resultsMV4.json new file mode 100644 index 00000000..a32aa549 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMV4.json @@ -0,0 +1,18 @@ +[ + { + "_cd": "187:18991", + "_indextime": "1354063535", + "_raw": "11-27-2012 16:45:34.924 -0800 INFO WatchedFile - Will begin reading at offset=22899111 for file='/Applications/splunk_434/var/log/splunk/metrics.log'.", + "_serial": "0", + "_si": "dfoster-mbp17.local\n_internal", + "_sourcetype": "splunkd", + "_subsecond": ".924", + "_time": "2012-11-27T16:45:34.924-08:00", + "host": "dfoster-mbp17.local", + "index": "_internal", + "linecount": "1", + "source": "/Applications/splunk_434/var/log/splunk/splunkd.log", + "sourcetype": "splunkd", + "splunk_server": "dfoster-mbp17.local" + } +] \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMV5.json b/splunk/src/test/resources/data/results/resultsMV5.json new file mode 100644 index 00000000..da98dee3 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMV5.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"115:5186","_indextime":"1354063462","_raw":"127.0.0.1 - admin [27/Nov/2012:16:44:22.581 -0800] \"GET /services/messages?count=-1 HTTP/1.1\" 200 1998 - - - 1ms","_serial":"0","_si":"dfoster-mbp17.local\n_internal","_sourcetype":"splunkd_access","_subsecond":".581","_time":"2012-11-27T16:44:22.581-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","sourcetype":"splunkd_access","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMVFuture.json b/splunk/src/test/resources/data/results/resultsMVFuture.json new file mode 100644 index 00000000..643b1c8e --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVFuture.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"115:5186","_indextime":"1354063462","_raw":"127.0.0.1 - admin [27/Nov/2012:16:44:22.581 -0800] \"GET /services/messages?count=-1 HTTP/1.1\" 200 1998 - - - 1ms","_serial":"0","_si":["dfoster-mbp17.local","_internal"],"_sourcetype":"splunkd_access","_subsecond":".581","_time":"2012-11-27T16:44:22.581-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","sourcetype":"splunkd_access","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMVOneshot.csv b/splunk/src/test/resources/data/results/resultsMVOneshot.csv new file mode 100644 index 00000000..9118b992 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVOneshot.csv @@ -0,0 +1,4 @@ + +"_bkt","_cd","_indextime","_raw","_serial","_si","_sourcetype","_subsecond","_time",host,index,linecount,source,sourcetype,"splunk_server" +"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","114:33623",1354062581,"127.0.0.1 - admin [27/Nov/2012:16:29:39.149 -0800] ""GET /services/messages?count=-1 HTTP/1.1"" 200 1998 - - - 1ms",0,"dfoster-mbp17.local +_internal","splunkd_access",".149","2012-11-27T16:29:39.149-08:00","dfoster-mbp17.local","_internal",1,"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","splunkd_access","dfoster-mbp17.local" diff --git a/splunk/src/test/resources/data/results/resultsMVOneshot.xml b/splunk/src/test/resources/data/results/resultsMVOneshot.xml new file mode 100644 index 00000000..a03c5746 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVOneshot.xml @@ -0,0 +1,69 @@ + + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + + _internal~114~BC509B13-C34D-4A69-B216-488806E9EA63 + + + 114:33595 + + + 1354062575 + + 11-27-2012 16:29:35.217 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00 + + 0 + + + dfoster-mbp17.local + _internal + + + splunkd + + + .217 + + + 2012-11-27T16:29:35.217-08:00 + + + dfoster-mbp17.local + + + _internal + + + 1 + + + /Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log + + + splunkd + + + dfoster-mbp17.local + + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMVOneshot4.json b/splunk/src/test/resources/data/results/resultsMVOneshot4.json new file mode 100644 index 00000000..0dc668c7 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVOneshot4.json @@ -0,0 +1,19 @@ + +[ + { + "_cd": "184:21387", + "_indextime": "1353099184", + "_raw": "2012-11-16 12:53:04.502 -0800 Interrupt signal received", + "_serial": "0", + "_si": "dfoster-mbp17.local\n_internal", + "_sourcetype": "splunkd_stderr", + "_subsecond": ".502", + "_time": "2012-11-16T12:53:04.502-08:00", + "host": "dfoster-mbp17.local", + "index": "_internal", + "linecount": "1", + "source": "/Applications/splunk_434/var/log/splunk/splunkd_stderr.log", + "sourcetype": "splunkd_stderr", + "splunk_server": "dfoster-mbp17.local" + } +] \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMVOneshot5.json b/splunk/src/test/resources/data/results/resultsMVOneshot5.json new file mode 100644 index 00000000..50846818 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVOneshot5.json @@ -0,0 +1,2 @@ + +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"114:34048","_indextime":"1354062607","_raw":"11-27-2012 16:30:06.140 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00","_serial":"0","_si":"dfoster-mbp17.local\n_internal","_sourcetype":"splunkd","_subsecond":".140","_time":"2012-11-27T16:30:06.140-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log","sourcetype":"splunkd","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsMVOneshotFuture.json b/splunk/src/test/resources/data/results/resultsMVOneshotFuture.json new file mode 100644 index 00000000..0d200b61 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsMVOneshotFuture.json @@ -0,0 +1,2 @@ + +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"114:34048","_indextime":"1354062607","_raw":"11-27-2012 16:30:06.140 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00","_serial":"0","_si":["dfoster-mbp17.local","_internal"],"_sourcetype":"splunkd","_subsecond":".140","_time":"2012-11-27T16:30:06.140-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log","sourcetype":"splunkd","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/data/results/resultsPreview.xml b/splunk/src/test/resources/data/results/resultsPreview.xml new file mode 100644 index 00000000..54939576 --- /dev/null +++ b/splunk/src/test/resources/data/results/resultsPreview.xml @@ -0,0 +1,1057 @@ + + + + +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +active_hist_searches +active_realtime_searches +app +appCodeName +appName +browser +bytes +class +client_app +clientip +component +count +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +delimiter +display_row_numbers +drop_count +earliest +enable_event_actions +enable_field_actions +entity_name +eventtype +field_list +fields +file +fillcontents +group +host +ident +index +jobStatus +latest +line +linecount +log_level +max_lines +max_lines_constraint +max_time +mean_preview_period +message +message_level +method +min_freq +min_lines +name +namespace +offset +other +output_mode +output_time_format +platform +prefix +punct +q +referer +referer_domain +req_time +requestid +reverse_order +root +s +search +segmentation +show_empty_fields +sid +sortDir +sortKey +sort_dir +sort_key +source +sourcetype +spent +splunk_server +staticFields +status +time_format +timeendpos +timestartpos +truncation_mode +uri +uri_path +uri_query +user +userAgent +useragent +version + + + + + 54:8568 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + 731 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + + --_::,_t[]_:_-_:__():_////-../// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8562 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + 732 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8674 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + 728 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8662 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + 729 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_////-..//// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8651 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + 730 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:9267 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 726 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9262 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 727 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9769 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 724 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9764 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 725 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:10097 + + + 1355946614 + + + 1 + + 12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 722 + + + fross-mbp15.local + _internal + + + splunkd + + + .351 + + + 2012-12-19T11:50:14.351-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 50 + + + december + + + 14 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + \ No newline at end of file diff --git a/splunk/src/test/resources/data/resultsreader_test_data.json b/splunk/src/test/resources/data/resultsreader_test_data.json new file mode 100644 index 00000000..bfc047a3 --- /dev/null +++ b/splunk/src/test/resources/data/resultsreader_test_data.json @@ -0,0 +1,1693 @@ +{ + "5.0.2": { + "results-empty_preview": { + "fields": [], + "results": [], + "is_preview": true + }, + "results-empty": { + "fields": [], + "results": [], + "is_preview": false + }, + "results": { + "fields": [ + "_bkt", + "_cd", + "_indextime", + "_kv", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "abandoned_channels", + "active_hist_searches", + "active_realtime_searches", + "average_kbps", + "avg_age", + "bytes", + "chillOrFreeze", + "clientip", + "component", + "cookie", + "current_size", + "current_size_kb", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "drop_count", + "eps", + "ev", + "eventtype", + "file", + "flushBlockSig", + "fork_recovermetadata", + "group", + "host", + "ident", + "inactive_channels", + "index", + "instantaneous_eps", + "instantaneous_kbps", + "kb", + "kbps", + "largest_size", + "linecount", + "load_average", + "log_level", + "max_age", + "max_size_kb", + "message", + "method", + "name", + "namespace", + "new_channels", + "numMsgs", + "other", + "punct", + "qsize", + "qwork_units", + "rebuild_metadata", + "reclaimed_channels", + "referer", + "referer_domain", + "removed_channels", + "replicate_semislice", + "req_time", + "retryMove_1hotBkt", + "roll_hotBkt", + "root", + "series", + "service_externProc", + "service_maxSizes", + "service_volumes", + "sid", + "size_hotBkt", + "smallest_size", + "source", + "sourcetype", + "spent", + "splunk_server", + "status", + "sync_hotBkt", + "task", + "throttle_optimize", + "timedout_channels", + "timeendpos", + "timestartpos", + "total_k_processed", + "update_bktManifest", + "update_checksums", + "uri", + "uri_domain", + "uri_path", + "uri_query", + "user", + "useragent", + "version", + "workers" + ], + "results": [ + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:46:15.549 -0800] \"GET /services/messages HTTP/1.1\" 200 1984 - - - 1ms", + "fields": { + "date_hour": "11", + "_subsecond": ".549", + "uri": "/services/messages", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "46", + "file": "messages", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log", + "_bkt": "_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "GET", + "status": "200", + "_serial": "0", + "date_second": "15", + "date_wday": "wednesday", + "punct": "..._-__[//:::._-]_\"_//_/.\"___-_-_-_", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "_indextime": "1355946377", + "user": "admin", + "_kv": "1", + "_cd": "21:59296", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/services/messages", + "ident": "-", + "timestartpos": "19", + "date_month": "december", + "bytes": "1984", + "spent": "1", + "_time": "2012-12-19T11:46:15.549-08:00", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:46:15.549 -0800] \"GET /services/messages HTTP/1.1\" 200 1984 - - - 1ms", + "req_time": "19/Dec/2012:11:46:15.549 -0800", + "root": "services", + "other": "- - - 1ms" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:46:15.544 -0800] \"GET /en-US/api/messages/index HTTP/1.1\" 200 341 \"http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d219878b6ae2790 7ms", + "fields": { + "date_hour": "11", + "referer": "http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search", + "_subsecond": ".544", + "uri": "/en-US/api/messages/index", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "46", + "file": "index", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:46:15.544 -0800] \"GET /en-US/api/messages/index HTTP/1.1\" 200 341 \"http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d219878b6ae2790 7ms", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunk_web_access", + "namespace": "search", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/web_access.log", + "_bkt": "_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "GET", + "status": "200", + "_serial": "1", + "date_second": "15", + "date_wday": "wednesday", + "sid": "1355946305.42", + "punct": "..._-__[//:::._-]_\"_/-///_/.\"___\"://:/-//?=.&=\"_\"/", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_access", + "req_time": "19/Dec/2012:11:46:15.544 -0800", + "user": "admin", + "_kv": "1", + "_cd": "21:59301", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/en-US/api/messages/index", + "ident": "-", + "_indextime": "1355946377", + "timestartpos": "19", + "root": "en-US", + "bytes": "341", + "spent": "7", + "_time": "2012-12-19T11:46:15.544-08:00", + "timeendpos": "49", + "date_month": "december", + "useragent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0", + "referer_domain": "http://localhost:8000", + "other": "- 50d219878b6ae2790 7ms" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:46:14.260 -0800] \"GET /services/messages HTTP/1.1\" 200 1984 - - - 1ms", + "fields": { + "date_hour": "11", + "_subsecond": ".260", + "uri": "/services/messages", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "46", + "file": "messages", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log", + "_bkt": "_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "GET", + "status": "200", + "_serial": "2", + "date_second": "14", + "date_wday": "wednesday", + "punct": "..._-__[//:::._-]_\"_//_/.\"___-_-_-_", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "_indextime": "1355946374", + "user": "admin", + "_kv": "1", + "_cd": "21:59281", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/services/messages", + "ident": "-", + "timestartpos": "19", + "date_month": "december", + "bytes": "1984", + "spent": "1", + "_time": "2012-12-19T11:46:14.260-08:00", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:46:14.260 -0800] \"GET /services/messages HTTP/1.1\" 200 1984 - - - 1ms", + "req_time": "19/Dec/2012:11:46:14.260 -0800", + "root": "services", + "other": "- - - 1ms" + } + } + ], + "is_preview": false + }, + "results-preview": { + "fields": [ + "_bkt", + "_cd", + "_confstr", + "_indextime", + "_kv", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "abandoned_channels", + "active_hist_searches", + "active_realtime_searches", + "app", + "appCodeName", + "appName", + "appVersion", + "average_kbps", + "avg_age", + "browser", + "bytes", + "chillOrFreeze", + "class", + "client_app", + "clientip", + "component", + "count", + "current_size", + "current_size_kb", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "delimiter", + "digest", + "dispatched", + "display_row_numbers", + "drop_count", + "earliest", + "enable_event_actions", + "enable_field_actions", + "entity_name", + "eps", + "ev", + "eventtype", + "field_list", + "fields", + "file", + "fillcontents", + "flushBlockSig", + "fork_recovermetadata", + "group", + "host", + "ident", + "inactive_channels", + "index", + "instantaneous_eps", + "instantaneous_kbps", + "jobStatus", + "kb", + "kbps", + "largest_size", + "latest", + "line", + "linecount", + "load_average", + "log_level", + "max_age", + "max_lines", + "max_lines_constraint", + "max_size_kb", + "message", + "message_level", + "method", + "min_freq", + "min_lines", + "name", + "namespace", + "new_channels", + "numMsgs", + "offset", + "other", + "output_mode", + "output_time_format", + "platform", + "punct", + "q", + "qsize", + "qwork_units", + "rebuild_metadata", + "reclaimed_channels", + "referer", + "referer_domain", + "refresh", + "removed_channels", + "replicate_semislice", + "req_time", + "requestid", + "retryMove_1hotBkt", + "reverse_order", + "roll_hotBkt", + "root", + "s", + "search", + "segmentation", + "series", + "service_externProc", + "service_maxSizes", + "service_volumes", + "show_empty_fields", + "sid", + "size_hotBkt", + "skipped", + "smallest_size", + "sortDir", + "sortKey", + "sort_dir", + "sort_key", + "source", + "sourcetype", + "spent", + "splunk_server", + "staticFields", + "status", + "sync_hotBkt", + "task", + "templateTime", + "throttle_optimize", + "time_format", + "timedout_channels", + "timeendpos", + "timestamp", + "timestartpos", + "total_k_processed", + "truncation_mode", + "update_bktManifest", + "update_checksums", + "uri", + "uri_path", + "uri_query", + "user", + "userAgent", + "useragent", + "version", + "viewTime", + "wait", + "with_new", + "workers" + ], + "results": [ + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "47", + "message": "group=mpool, max_used_interval=11760, max_used=106926, avg_rsv=256, capacity=536870912, used=0, rep_used=0", + "index": "_internal", + "group": "mpool", + "sourcetype": "splunkd", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log", + "_bkt": "_internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "date_wday": "wednesday", + "date_hour": "10", + "date_second": "39", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,_=,_=,_=,_=,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355942859", + "_kv": "1", + "log_level": "INFO", + "_cd": "20:6362329", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".098", + "_time": "2012-12-19T10:47:39.098-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 10:47:39.098 -0800 INFO Metrics - group=mpool, max_used_interval=11760, max_used=106926, avg_rsv=256, capacity=536870912, used=0, rep_used=0", + "_serial": "20446" + }, + "RAW_XML": "12-19-2012 10:47:39.098 -0800 INFO Metrics - group=mpool, max_used_interval=11760, max_used=106926, avg_rsv=256, capacity=536870912, used=0, rep_used=0" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "47", + "message": "group=pipeline, name=merging, processor=sendout, cpu_seconds=0.000000, executes=48, cumulative_hits=927340", + "index": "_internal", + "group": "pipeline", + "sourcetype": "splunkd", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log", + "_bkt": "_internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "date_wday": "wednesday", + "date_hour": "10", + "date_second": "39", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,_=,_=,_=.,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355942859", + "_kv": "1", + "log_level": "INFO", + "_cd": "20:6362402", + "name": "merging", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".099", + "_time": "2012-12-19T10:47:39.099-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=sendout, cpu_seconds=0.000000, executes=48, cumulative_hits=927340", + "_serial": "20436" + }, + "RAW_XML": "12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=sendout, cpu_seconds=0.000000, executes=48, cumulative_hits=927340" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "47", + "message": "group=pipeline, name=merging, processor=readerin, cpu_seconds=0.000000, executes=48, cumulative_hits=927707", + "index": "_internal", + "group": "pipeline", + "sourcetype": "splunkd", + "linecount": "1", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-5.0.2/var/log/splunk/metrics.log", + "_bkt": "_internal~20~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B", + "date_wday": "wednesday", + "date_hour": "10", + "date_second": "39", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,_=,_=,_=.,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355942859", + "_kv": "1", + "log_level": "INFO", + "_cd": "20:6362395", + "name": "merging", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".099", + "_time": "2012-12-19T10:47:39.099-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=readerin, cpu_seconds=0.000000, executes=48, cumulative_hits=927707", + "_serial": "20437" + }, + "RAW_XML": "12-19-2012 10:47:39.099 -0800 INFO Metrics - group=pipeline, name=merging, processor=readerin, cpu_seconds=0.000000, executes=48, cumulative_hits=927707" + } + ], + "is_preview": true + } + }, + "4.3.5": { + "results-empty": { + "fields": [], + "results": [], + "is_preview": null + }, + "results": { + "fields": [ + "_cd", + "_indextime", + "_kv", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "bytes", + "client_app", + "clientip", + "cookie", + "count", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "display_row_numbers", + "earliest", + "enable_event_actions", + "enable_field_actions", + "entity_name", + "eventtype", + "field_list", + "file", + "fillcontents", + "host", + "ident", + "index", + "latest", + "linecount", + "max_lines", + "max_lines_constraint", + "method", + "min_freq", + "min_lines", + "offset", + "other", + "output_mode", + "output_time_format", + "punct", + "q", + "referer", + "referer_domain", + "req_time", + "reverse_order", + "root", + "s", + "segmentation", + "show_empty_fields", + "sid", + "source", + "sourcetype", + "spent", + "splunk_server", + "status", + "time_format", + "timeendpos", + "timestartpos", + "truncation_mode", + "uri", + "uri_domain", + "uri_path", + "uri_query", + "user", + "useragent", + "version" + ], + "results": [ + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:55:39.296 -0800] \"POST /en-US/api/shelper HTTP/1.1\" 200 1398 \"http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d21bbb4b5224c10 3ms", + "fields": { + "date_hour": "11", + "referer": "http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt", + "_subsecond": ".296", + "uri": "/en-US/api/shelper", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "55", + "file": "shelper", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunk_web_access", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "POST", + "status": "200", + "_serial": "0", + "date_second": "39", + "date_wday": "wednesday", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:55:39.296 -0800] \"POST /en-US/api/shelper HTTP/1.1\" 200 1398 \"http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d21bbb4b5224c10 3ms", + "punct": "..._-__[//:::._-]_\"_/-//_/.\"___\"://:/-///?=%%%%%%%", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_access", + "req_time": "19/Dec/2012:11:55:39.296 -0800", + "user": "admin", + "_kv": "1", + "earliest": "rt-1h", + "_cd": "54:23786", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/en-US/api/shelper", + "ident": "-", + "_indextime": "1355946940", + "timestartpos": "19", + "root": "en-US", + "bytes": "1398", + "spent": "3", + "q": "search%20search%20index%3D_internal%20%7C%20head%2010", + "_time": "2012-12-19T11:55:39.296-08:00", + "timeendpos": "49", + "date_month": "december", + "useragent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0", + "referer_domain": "http://localhost:8000", + "other": "- 50d21bbb4b5224c10 3ms", + "latest": "rt" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:55:39.265 -0800] \"GET /services/search/jobs/rt_1355946914.13 HTTP/1.1\" 200 10957 - - - 4ms", + "fields": { + "date_hour": "11", + "_subsecond": ".265", + "uri": "/services/search/jobs/rt_1355946914.13", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "55", + "file": "rt_1355946914.13", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_wday": "wednesday", + "method": "GET", + "status": "200", + "_serial": "1", + "date_second": "39", + "date_year": "2012", + "punct": "..._-__[//:::._-]_\"_////._/.\"___-_-_-_", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "_indextime": "1355946940", + "user": "admin", + "_kv": "1", + "_cd": "54:23689", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/services/search/jobs/rt_1355946914.13", + "ident": "-", + "timestartpos": "19", + "date_month": "december", + "bytes": "10957", + "spent": "4", + "_time": "2012-12-19T11:55:39.265-08:00", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:55:39.265 -0800] \"GET /services/search/jobs/rt_1355946914.13 HTTP/1.1\" 200 10957 - - - 4ms", + "req_time": "19/Dec/2012:11:55:39.265 -0800", + "root": "services", + "other": "- - - 4ms" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:55:39.258 -0800] \"GET /servicesNS/admin/search/properties/event_renderers?fillcontents=1 HTTP/1.1\" 200 3657 - - - 1ms", + "fields": { + "date_hour": "11", + "_subsecond": ".258", + "uri": "/servicesNS/admin/search/properties/event_renderers?fillcontents=1", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "55", + "file": "event_renderers", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "GET", + "fillcontents": "1", + "status": "200", + "_serial": "2", + "date_second": "39", + "date_wday": "wednesday", + "punct": "..._-__[//:::._-]_\"_/////?=_/.\"___-_-_-_", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "req_time": "19/Dec/2012:11:55:39.258 -0800", + "user": "admin", + "_kv": "1", + "_cd": "54:23682", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/servicesNS/admin/search/properties/event_renderers", + "ident": "-", + "timestartpos": "19", + "date_month": "december", + "bytes": "3657", + "spent": "1", + "_time": "2012-12-19T11:55:39.258-08:00", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:55:39.258 -0800] \"GET /servicesNS/admin/search/properties/event_renderers?fillcontents=1 HTTP/1.1\" 200 3657 - - - 1ms", + "_indextime": "1355946940", + "root": "servicesNS", + "other": "- - - 1ms", + "uri_query": "fillcontents=1" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:11:55:39.231 -0800] \"GET /services/search/jobs/rt_1355946914.13/events?count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract HTTP/1.1\" 200 32837 - - - 6ms", + "fields": { + "date_hour": "11", + "max_lines": "10", + "_kv": "1", + "spent": "6", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "55", + "file": "events", + "clientip": "127.0.0.1", + "index": "_internal", + "_serial": "3", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "req_time": "19/Dec/2012:11:55:39.231 -0800", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "GET", + "status": "200", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "segmentation": "full", + "output_mode": "xml", + "date_second": "39", + "date_wday": "wednesday", + "time_format": "%25s.%25Q", + "punct": "..._-__[//:::._-]_\"_////./?=&=&=&=%.%&=&=&=-&=%-%-", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "_indextime": "1355946940", + "user": "admin", + "show_empty_fields": "True", + "offset": "-10", + "_cd": "54:23670", + "truncation_mode": "abstract", + "count": "0", + "uri_path": "/services/search/jobs/rt_1355946914.13/events", + "ident": "-", + "timestartpos": "19", + "date_month": "december", + "bytes": "32837", + "uri": "/services/search/jobs/rt_1355946914.13/events?count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract", + "_time": "2012-12-19T11:55:39.231-08:00", + "output_time_format": "%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:11:55:39.231 -0800] \"GET /services/search/jobs/rt_1355946914.13/events?count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract HTTP/1.1\" 200 32837 - - - 6ms", + "_subsecond": ".231", + "root": "services", + "other": "- - - 6ms", + "uri_query": "count=0&segmentation=full&output_mode=xml&time_format=%25s.%25Q&max_lines=10&show_empty_fields=True&offset=-10&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&field_list=&truncation_mode=abstract" + } + } + ], + "is_preview": false + }, + "results-preview": { + "fields": [ + "_cd", + "_indextime", + "_kv", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "active_hist_searches", + "active_realtime_searches", + "app", + "appCodeName", + "appName", + "browser", + "bytes", + "class", + "client_app", + "clientip", + "component", + "count", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "delimiter", + "display_row_numbers", + "drop_count", + "earliest", + "enable_event_actions", + "enable_field_actions", + "entity_name", + "eventtype", + "field_list", + "fields", + "file", + "fillcontents", + "group", + "host", + "ident", + "index", + "jobStatus", + "latest", + "line", + "linecount", + "log_level", + "max_lines", + "max_lines_constraint", + "max_time", + "mean_preview_period", + "message", + "message_level", + "method", + "min_freq", + "min_lines", + "name", + "namespace", + "offset", + "other", + "output_mode", + "output_time_format", + "platform", + "prefix", + "punct", + "q", + "referer", + "referer_domain", + "req_time", + "requestid", + "reverse_order", + "root", + "s", + "search", + "segmentation", + "show_empty_fields", + "sid", + "sortDir", + "sortKey", + "sort_dir", + "sort_key", + "source", + "sourcetype", + "spent", + "splunk_server", + "staticFields", + "status", + "time_format", + "timeendpos", + "timestartpos", + "truncation_mode", + "uri", + "uri_path", + "uri_query", + "user", + "userAgent", + "useragent", + "version" + ], + "results": [ + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "48", + "message": "CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunk_web_service", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "55", + "date_year": "2012", + "component": "root", + "punct": "--_::,_t[]_:_-_:__():_////-..///", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_service", + "_indextime": "1355946537", + "requestid": "50d21a262616082d0", + "_kv": "1", + "line": "535", + "_cd": "54:8568", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".424", + "_time": "2012-12-19T11:48:55.424-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 11:48:55,424 INFO\t[50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle", + "_serial": "731" + }, + "RAW_XML": "2012-12-19 11:48:55,424 INFO\t[50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle" + }, + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "48", + "message": "CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunk_web_service", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "55", + "date_year": "2012", + "component": "root", + "punct": "--_::,_t[]_:_-_:__():_///", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_service", + "_indextime": "1355946537", + "requestid": "50d21a262616082d0", + "_kv": "1", + "line": "535", + "_cd": "54:8562", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".424", + "_time": "2012-12-19T11:48:55.424-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 11:48:55,424 INFO\t[50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules", + "_serial": "732" + }, + "RAW_XML": "2012-12-19 11:48:55,424 INFO\t[50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules" + }, + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "48", + "message": "CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunk_web_service", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "55", + "date_year": "2012", + "component": "root", + "punct": "--_::,_t[]_:_-_:__():_///", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_service", + "_indextime": "1355946537", + "requestid": "50d21a262616082d0", + "_kv": "1", + "line": "535", + "_cd": "54:8674", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".425", + "_time": "2012-12-19T11:48:55.425-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates", + "_serial": "728" + }, + "RAW_XML": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates" + }, + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "48", + "message": "CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunk_web_service", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "55", + "date_year": "2012", + "component": "root", + "punct": "--_::,_t[]_:_-_:__():_////-..////", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_service", + "_indextime": "1355946537", + "requestid": "50d21a262616082d0", + "_kv": "1", + "line": "535", + "_cd": "54:8662", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".425", + "_time": "2012-12-19T11:48:55.425-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed", + "_serial": "729" + }, + "RAW_XML": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed" + }, + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "48", + "message": "CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunk_web_service", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "55", + "date_year": "2012", + "component": "root", + "punct": "--_::,_t[]_:_-_:__():_///", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_service", + "_indextime": "1355946537", + "requestid": "50d21a262616082d0", + "_kv": "1", + "line": "535", + "_cd": "54:8651", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".425", + "_time": "2012-12-19T11:48:55.425-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed", + "_serial": "730" + }, + "RAW_XML": "2012-12-19 11:48:55,425 INFO\t[50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "49", + "message": "group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "index": "_internal", + "group": "search_concurrency", + "sourcetype": "splunkd", + "active_realtime_searches": "0", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "12", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,__,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355946552", + "_kv": "1", + "log_level": "INFO", + "_cd": "54:9267", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "active_hist_searches": "0", + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".313", + "_time": "2012-12-19T11:49:12.313-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 11:49:12.313 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "_serial": "726" + }, + "RAW_XML": "12-19-2012 11:49:12.313 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "49", + "message": "group=realtime_search_data, system total, drop_count=0", + "drop_count": "0", + "index": "_internal", + "group": "realtime_search_data", + "sourcetype": "splunkd", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "12", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,__,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355946552", + "_kv": "1", + "log_level": "INFO", + "_cd": "54:9262", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".313", + "_time": "2012-12-19T11:49:12.313-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0", + "_serial": "727" + }, + "RAW_XML": "12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "49", + "message": "group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "index": "_internal", + "group": "search_concurrency", + "sourcetype": "splunkd", + "active_realtime_searches": "0", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "43", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,__,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355946583", + "_kv": "1", + "log_level": "INFO", + "_cd": "54:9769", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "active_hist_searches": "0", + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".322", + "_time": "2012-12-19T11:49:43.322-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 11:49:43.322 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "_serial": "724" + }, + "RAW_XML": "12-19-2012 11:49:43.322 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "49", + "message": "group=realtime_search_data, system total, drop_count=0", + "drop_count": "0", + "index": "_internal", + "group": "realtime_search_data", + "sourcetype": "splunkd", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "43", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,__,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355946583", + "_kv": "1", + "log_level": "INFO", + "_cd": "54:9764", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".322", + "_time": "2012-12-19T11:49:43.322-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0", + "_serial": "725" + }, + "RAW_XML": "12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0" + }, + { + "fields": { + "date_zone": "-480", + "date_mday": "19", + "date_minute": "50", + "message": "group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "index": "_internal", + "group": "search_concurrency", + "sourcetype": "splunkd", + "active_realtime_searches": "0", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "11", + "date_second": "14", + "date_year": "2012", + "component": "Metrics", + "punct": "--_::._-____-_=,__,_=,_=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355946614", + "_kv": "1", + "log_level": "INFO", + "_cd": "54:10097", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "active_hist_searches": "0", + "timestartpos": "0", + "date_month": "december", + "_subsecond": ".351", + "_time": "2012-12-19T11:50:14.351-08:00", + "timeendpos": "29", + "_raw": "12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0", + "_serial": "722" + }, + "RAW_XML": "12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0" + } + ], + "is_preview": true + } + }, + "4.2.5": { + "results-empty": { + "fields": [], + "results": [], + "is_preview": null + }, + "results": { + "fields": [ + "_cd", + "_indextime", + "_kv", + "_raw", + "_serial", + "_si", + "_sourcetype", + "_subsecond", + "_time", + "active_hist_searches", + "active_realtime_searches", + "alert_actions", + "app", + "autoload", + "bytes", + "clientip", + "component", + "cookie", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "dispatch_time", + "drop_count", + "earliest", + "eventtype", + "file", + "group", + "host", + "ident", + "index", + "line", + "linecount", + "log_level", + "message", + "method", + "other", + "punct", + "q", + "referer", + "referer_domain", + "req_time", + "requestid", + "result_count", + "return_to", + "root", + "run_time", + "savedsearch_id", + "savedsearch_name", + "scheduled_time", + "sid", + "source", + "sourcetype", + "spent", + "splunk_server", + "status", + "suppressed", + "thread_id", + "timeendpos", + "timestartpos", + "trigger_condition_state", + "uri", + "uri_domain", + "uri_path", + "uri_query", + "user", + "useragent", + "version" + ], + "results": [ + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:12:01:22.845 -0800] \"GET /services/search/timeparser/tz HTTP/1.1\" 200 2891 - - - 1ms", + "fields": { + "date_hour": "12", + "_subsecond": ".845", + "uri": "/services/search/timeparser/tz", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "1", + "file": "tz", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunkd_access", + "eventtype": "splunkd-access", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_wday": "wednesday", + "method": "GET", + "status": "200", + "_serial": "0", + "date_second": "22", + "date_year": "2012", + "punct": "..._-__[//:::._-]_\"_////_/.\"___-_-_-_", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd_access", + "_indextime": "1355947283", + "user": "admin", + "_kv": "1", + "_cd": "1:5282", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/services/search/timeparser/tz", + "ident": "-", + "timestartpos": "31", + "date_month": "december", + "bytes": "2891", + "spent": "1", + "_time": "2012-12-19T12:01:22.845-08:00", + "timeendpos": "49", + "_raw": "127.0.0.1 - admin [19/Dec/2012:12:01:22.845 -0800] \"GET /services/search/timeparser/tz HTTP/1.1\" 200 2891 - - - 1ms", + "req_time": "19/Dec/2012:12:01:22.845 -0800", + "root": "services", + "other": "- - - 1ms" + } + }, + { + "RAW_XML": "127.0.0.1 - admin [19/Dec/2012:12:01:22.762 -0800] \"POST /en-US/account/login HTTP/1.1\" 200 1897 \"http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d21d12c31e60610 35ms", + "fields": { + "date_hour": "12", + "referer": "http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0", + "_subsecond": ".762", + "uri": "/en-US/account/login", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "1", + "file": "login", + "clientip": "127.0.0.1", + "index": "_internal", + "sourcetype": "splunk_web_access", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/web_access.log", + "linecount": "1", + "version": "HTTP/1.1", + "date_year": "2012", + "method": "POST", + "status": "200", + "_serial": "1", + "date_second": "22", + "date_wday": "wednesday", + "_raw": "127.0.0.1 - admin [19/Dec/2012:12:01:22.762 -0800] \"POST /en-US/account/login HTTP/1.1\" 200 1897 \"http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0\" - 50d21d12c31e60610 35ms", + "punct": "..._-__[//:::._-]_\"_/-//_/.\"___\"://:/-//?=%-%%%%%%", + "host": "fross-mbp15.local", + "_sourcetype": "splunk_web_access", + "req_time": "19/Dec/2012:12:01:22.762 -0800", + "user": "admin", + "_kv": "1", + "return_to": "%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0", + "_cd": "1:5211", + "_si": [ + "fross-mbp15.local", + "_internal" + ], + "uri_path": "/en-US/account/login", + "ident": "-", + "_indextime": "1355947283", + "timestartpos": "31", + "root": "en-US", + "bytes": "1897", + "spent": "35", + "_time": "2012-12-19T12:01:22.762-08:00", + "timeendpos": "49", + "date_month": "december", + "useragent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0", + "referer_domain": "http://localhost:8000", + "other": "- 50d21d12c31e60610 35ms" + } + } + ], + "is_preview": false + }, + "results-preview": { + "fields": [ + "_indextime", + "_kv", + "_raw", + "_serial", + "_sourcetype", + "_subsecond", + "_time", + "active_streams", + "blocking", + "bytes", + "client_app", + "clientip", + "component", + "count", + "date_hour", + "date_mday", + "date_minute", + "date_month", + "date_second", + "date_wday", + "date_year", + "date_zone", + "display_row_numbers", + "earliest", + "enable_event_actions", + "enable_field_actions", + "entity_name", + "eventtype", + "field_list", + "file", + "fillcontents", + "filter", + "host", + "ident", + "index", + "length", + "linecount", + "log_level", + "max_block_secs", + "max_lines", + "max_lines_constraint", + "max_pages", + "message", + "method", + "min_freq", + "min_lines", + "offset", + "other", + "output_mode", + "output_time_format", + "punct", + "q", + "queue_size", + "referer", + "referer_domain", + "req_time", + "reverse_order", + "root", + "s", + "segmentation", + "show_empty_fields", + "sid", + "source", + "sourcetype", + "spent", + "splunk_server", + "status", + "time_format", + "timeendpos", + "timestartpos", + "truncation_mode", + "uri", + "uri_path", + "uri_query", + "user", + "useragent", + "version" + ], + "results": [ + { + "fields": { + "max_block_secs": "0", + "date_zone": "-480", + "date_mday": "19", + "date_minute": "2", + "message": "rtsearch connection established, filter = '[ AND index::_internal search ]', active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0", + "index": "_internal", + "log_level": "INFO", + "sourcetype": "splunkd", + "eventtype": "splunkd-log", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "12", + "date_second": "18", + "date_year": "2012", + "component": "IndexProcessor", + "punct": "--_::._-____-___,__=_'[__::__]',__=_,__=_,__=_,__=", + "host": "fross-mbp15.local", + "_sourcetype": "splunkd", + "_indextime": "1355947338", + "_kv": "1", + "blocking": "FALSE", + "timestartpos": "11", + "queue_size": "10000", + "date_month": "december", + "_subsecond": ".172", + "filter": "'[ AND index::_internal search ]'", + "_time": "2012-12-19T12:02:18.172-08:00", + "active_streams": "1", + "timeendpos": "29", + "_raw": "12-19-2012 12:02:18.172 -0800 INFO IndexProcessor - rtsearch connection established, filter = '[ AND index::_internal search ]', active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0", + "_serial": "0" + }, + "RAW_XML": "12-19-2012 12:02:18.172 -0800 INFO IndexProcessor - rtsearch connection established, filter = '[ AND index::_internal search ]', active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0" + }, + { + "fields": { + "date_zone": "local", + "date_mday": "19", + "date_minute": "2", + "index": "_internal", + "sourcetype": "searches", + "splunk_server": "fross-mbp15.local", + "source": "/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/searches.log", + "linecount": "1", + "date_wday": "wednesday", + "date_hour": "12", + "date_second": "18", + "date_year": "2012", + "punct": "--_::,_-_t__=_|__", + "host": "fross-mbp15.local", + "_sourcetype": "searches", + "_indextime": "1355947338", + "_kv": "1", + "timestartpos": "11", + "date_month": "december", + "_subsecond": ".066", + "_time": "2012-12-19T12:02:18.066-08:00", + "timeendpos": "24", + "_raw": "2012-12-19 12:02:18,066 - admin\tsearch search index=_internal | head 10", + "_serial": "1" + }, + "RAW_XML": "2012-12-19 12:02:18,066 - admin\tsearch search index=_internal | head 10" + } + ], + "is_preview": true + } + } +} diff --git a/splunk/src/test/resources/modularinput/data/argument_with_defaults.xml b/splunk/src/test/resources/modularinput/data/argument_with_defaults.xml new file mode 100644 index 00000000..5b4814a1 --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/argument_with_defaults.xml @@ -0,0 +1,5 @@ + + string + false + false + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/argument_without_defaults.xml b/splunk/src/test/resources/modularinput/data/argument_without_defaults.xml new file mode 100644 index 00000000..fe3a1bbb --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/argument_without_defaults.xml @@ -0,0 +1,7 @@ + + 쎼 and 쎶 and <&> für + is_pos_int('some_name') + boolean + true + true + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/conf_with_0_inputs.xml b/splunk/src/test/resources/modularinput/data/conf_with_0_inputs.xml new file mode 100644 index 00000000..c7243666 Binary files /dev/null and b/splunk/src/test/resources/modularinput/data/conf_with_0_inputs.xml differ diff --git a/splunk/src/test/resources/modularinput/data/conf_with_2_inputs.xml b/splunk/src/test/resources/modularinput/data/conf_with_2_inputs.xml new file mode 100644 index 00000000..7e4ed3b0 Binary files /dev/null and b/splunk/src/test/resources/modularinput/data/conf_with_2_inputs.xml differ diff --git a/splunk/src/test/resources/modularinput/data/conf_with_invalid_inputs.xml b/splunk/src/test/resources/modularinput/data/conf_with_invalid_inputs.xml new file mode 100644 index 00000000..f3dd460f Binary files /dev/null and b/splunk/src/test/resources/modularinput/data/conf_with_invalid_inputs.xml differ diff --git a/splunk/src/test/resources/modularinput/data/event_maximal.xml b/splunk/src/test/resources/modularinput/data/event_maximal.xml new file mode 100644 index 00000000..e13ac5e7 --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/event_maximal.xml @@ -0,0 +1,9 @@ + + + hilda + misc + main + localhost + This is a test of the emergency broadcast system. + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/event_minimal.xml b/splunk/src/test/resources/modularinput/data/event_minimal.xml new file mode 100644 index 00000000..1aa9a243 --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/event_minimal.xml @@ -0,0 +1,5 @@ + + + This is a test of the emergency broadcast system. + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/scheme_with_defaults.xml b/splunk/src/test/resources/modularinput/data/scheme_with_defaults.xml new file mode 100644 index 00000000..217dd10e --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/scheme_with_defaults.xml @@ -0,0 +1,11 @@ + + + abcd + true + false + xml + + + + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/scheme_without_defaults.xml b/splunk/src/test/resources/modularinput/data/scheme_without_defaults.xml new file mode 100644 index 00000000..acd5c24d --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/scheme_without_defaults.xml @@ -0,0 +1,24 @@ + + + abcd + 쎼 and 쎶 and <&> für + false + true + simple + + + + string + false + false + + + 쎼 and 쎶 and <&> für + is_pos_int('some_name') + number + true + true + + + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/stream_with_one_event.xml b/splunk/src/test/resources/modularinput/data/stream_with_one_event.xml new file mode 100644 index 00000000..46460c98 --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/stream_with_one_event.xml @@ -0,0 +1,11 @@ + + + + hilda + misc + main + localhost + This is a test of the emergency broadcast system. + + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/stream_with_two_events.xml b/splunk/src/test/resources/modularinput/data/stream_with_two_events.xml new file mode 100644 index 00000000..4438bade --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/stream_with_two_events.xml @@ -0,0 +1,20 @@ + + + + hilda + misc + main + localhost + This is a test of the emergency broadcast system. + + + + + hilda + misc + main + localhost + This is a test of the emergency broadcast system. + + + \ No newline at end of file diff --git a/splunk/src/test/resources/modularinput/data/validation.xml b/splunk/src/test/resources/modularinput/data/validation.xml new file mode 100644 index 00000000..aa804d2e Binary files /dev/null and b/splunk/src/test/resources/modularinput/data/validation.xml differ diff --git a/splunk/src/test/resources/modularinput/data/validation_error.xml b/splunk/src/test/resources/modularinput/data/validation_error.xml new file mode 100644 index 00000000..58d89283 --- /dev/null +++ b/splunk/src/test/resources/modularinput/data/validation_error.xml @@ -0,0 +1 @@ +Oh, the vogonity! \ No newline at end of file diff --git a/splunk/src/test/resources/results.csv b/splunk/src/test/resources/results.csv new file mode 100644 index 00000000..64040eb7 --- /dev/null +++ b/splunk/src/test/resources/results.csv @@ -0,0 +1,4 @@ +"sum(kb)","series" +"14372242.758775","twitter" +"267802.333926","splunkd" +"5979.036338","splunkd_access" \ No newline at end of file diff --git a/splunk/src/test/resources/results.xml b/splunk/src/test/resources/results.xml new file mode 100644 index 00000000..b34137ab --- /dev/null +++ b/splunk/src/test/resources/results.xml @@ -0,0 +1,53 @@ + + + + +series +sum(kb) + + + + base lispy: [ AND ] + search context: user='admin', app='search', bs-pathname='/some/path' + + + + twitter + + + 14372242.758775 + + + + + splunkd + + + 267802.333926 + + + + + flurry + + + 12576.454102 + + + + + splunkd_access + + + 5979.036338 + + + + + splunk_web_access + + + 5838.935649 + + + diff --git a/splunk/src/test/resources/results4.json b/splunk/src/test/resources/results4.json new file mode 100644 index 00000000..98711985 --- /dev/null +++ b/splunk/src/test/resources/results4.json @@ -0,0 +1,14 @@ +[ + { + "sum(kb)":"14372242.758775", + "series":"twitter" + }, + { + "sum(kb)":"267802.333926", + "series":"splunkd" + }, + { + "sum(kb)":"5979.036338", + "series":"splunkd_access" + } +] diff --git a/splunk/src/test/resources/results5.json b/splunk/src/test/resources/results5.json new file mode 100644 index 00000000..6475c51b --- /dev/null +++ b/splunk/src/test/resources/results5.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Users/fross/splunks/splunk-5.0/etc\""}],"results":[{"sum(kb)":"14372242.758775","series":"twitter"},{"sum(kb)":"267802.333926","series":"splunkd"},{"sum(kb)":"5979.036338","series":"splunkd_access"}]} diff --git a/splunk/src/test/resources/resultsExport.json b/splunk/src/test/resources/resultsExport.json new file mode 100644 index 00000000..ca65e81f --- /dev/null +++ b/splunk/src/test/resources/resultsExport.json @@ -0,0 +1,69 @@ +{"preview":true,"offset":0,"lastrow":true,"result":{"host":"Andy-PC","count":"62"}} +{"preview":true,"offset":0,"result":{"host":"Andy-PC","count":"1682"}} +{"preview":true,"offset":1,"result":{"host":"andy-pc","count":"3"}} +{"preview":true,"offset":2,"lastrow":true,"result":{"host":"three.four.com","count":"1495"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"232"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"2766"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"2579"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"1786"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"3543"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"3356"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"3184"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"4242"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"4055"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"7052"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"6176"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"133"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"5989"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"10034"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"8388"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"7689"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"12668"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"11176"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"10323"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"13996"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"28317"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"11651"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"15030"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"28834"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"12685"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"17160"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"29899"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"14815"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"20432"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"31535"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"18087"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"23862"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"33250"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"21517"}} +{"preview":true,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":true,"offset":1,"result":{"host":"ANDY-PC","count":"29732"}} +{"preview":true,"offset":2,"result":{"host":"Andy-PC","count":"36185"}} +{"preview":true,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":true,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"27772"}} +{"preview":false,"offset":0,"result":{"host":"172.16.35.130","count":"16"}} +{"preview":false,"offset":1,"result":{"host":"ANDY-PC","count":"29732"}} +{"preview":false,"offset":2,"result":{"host":"Andy-PC","count":"36185"}} +{"preview":false,"offset":3,"result":{"host":"andy-pc","count":"135"}} +{"preview":false,"offset":4,"lastrow":true,"result":{"host":"three.four.com","count":"35994"}} diff --git a/splunk/src/test/resources/resultsExport.xml b/splunk/src/test/resources/resultsExport.xml new file mode 100644 index 00000000..1e388611 --- /dev/null +++ b/splunk/src/test/resources/resultsExport.xml @@ -0,0 +1,907 @@ + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + Andy-PC + + + 62 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + Andy-PC + + + 1682 + + + + + andy-pc + + + 3 + + + + + three.four.com + + + 1495 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 232 + + + + + Andy-PC + + + 2766 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 2579 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 1786 + + + + + Andy-PC + + + 3543 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 3356 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 3184 + + + + + Andy-PC + + + 4242 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 4055 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 4446 + + + + + Andy-PC + + + 4873 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 4686 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 9222 + + + + + Andy-PC + + + 7261 + + + + + andy-pc + + + 133 + + + + + three.four.com + + + 7074 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 11722 + + + + + Andy-PC + + + 10039 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 9377 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 12668 + + + + + Andy-PC + + + 11176 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 10323 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 13996 + + + + + Andy-PC + + + 28317 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 11651 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 16034 + + + + + Andy-PC + + + 29336 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 13689 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 19382 + + + + + Andy-PC + + + 31010 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 17037 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 20432 + + + + + Andy-PC + + + 31535 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 18087 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 23862 + + + + + Andy-PC + + + 33250 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 21517 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 27080 + + + + + Andy-PC + + + 34859 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 24735 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 28092 + + + + + Andy-PC + + + 35365 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 25747 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 29732 + + + + + Andy-PC + + + 36185 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 30641 + + + + + + +host +count + + + + base lispy: [ AND ] + search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc" + + + + + 172.16.35.130 + + + 16 + + + + + ANDY-PC + + + 29732 + + + + + Andy-PC + + + 36185 + + + + + andy-pc + + + 135 + + + + + three.four.com + + + 35994 + + + \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMV.csv b/splunk/src/test/resources/resultsMV.csv new file mode 100644 index 00000000..b78d26a4 --- /dev/null +++ b/splunk/src/test/resources/resultsMV.csv @@ -0,0 +1,3 @@ +"_bkt","_cd","_indextime","_raw","_serial","_si","_sourcetype","_subsecond","_time",host,index,linecount,source,sourcetype,"splunk_server" +"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","115:4933",1354063445,"11-27-2012 16:44:05.208 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00",0,"dfoster-mbp17.local +_internal",splunkd,".208","2012-11-27T16:44:05.208-08:00","dfoster-mbp17.local","_internal",1,"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log",splunkd,"dfoster-mbp17.local" diff --git a/splunk/src/test/resources/resultsMV.xml b/splunk/src/test/resources/resultsMV.xml new file mode 100644 index 00000000..4ef5d7e3 --- /dev/null +++ b/splunk/src/test/resources/resultsMV.xml @@ -0,0 +1,68 @@ + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + + _internal~115~BC509B13-C34D-4A69-B216-488806E9EA63 + + + 115:4502 + + + 1354063414 + + 11-27-2012 16:43:34.271 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00 + + 0 + + + dfoster-mbp17.local + _internal + + + splunkd + + + .271 + + + 2012-11-27T16:43:34.271-08:00 + + + dfoster-mbp17.local + + + _internal + + + 1 + + + /Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log + + + splunkd + + + dfoster-mbp17.local + + + \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMV4.json b/splunk/src/test/resources/resultsMV4.json new file mode 100644 index 00000000..a32aa549 --- /dev/null +++ b/splunk/src/test/resources/resultsMV4.json @@ -0,0 +1,18 @@ +[ + { + "_cd": "187:18991", + "_indextime": "1354063535", + "_raw": "11-27-2012 16:45:34.924 -0800 INFO WatchedFile - Will begin reading at offset=22899111 for file='/Applications/splunk_434/var/log/splunk/metrics.log'.", + "_serial": "0", + "_si": "dfoster-mbp17.local\n_internal", + "_sourcetype": "splunkd", + "_subsecond": ".924", + "_time": "2012-11-27T16:45:34.924-08:00", + "host": "dfoster-mbp17.local", + "index": "_internal", + "linecount": "1", + "source": "/Applications/splunk_434/var/log/splunk/splunkd.log", + "sourcetype": "splunkd", + "splunk_server": "dfoster-mbp17.local" + } +] \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMV5.json b/splunk/src/test/resources/resultsMV5.json new file mode 100644 index 00000000..da98dee3 --- /dev/null +++ b/splunk/src/test/resources/resultsMV5.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"115:5186","_indextime":"1354063462","_raw":"127.0.0.1 - admin [27/Nov/2012:16:44:22.581 -0800] \"GET /services/messages?count=-1 HTTP/1.1\" 200 1998 - - - 1ms","_serial":"0","_si":"dfoster-mbp17.local\n_internal","_sourcetype":"splunkd_access","_subsecond":".581","_time":"2012-11-27T16:44:22.581-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","sourcetype":"splunkd_access","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMVFuture.json b/splunk/src/test/resources/resultsMVFuture.json new file mode 100644 index 00000000..643b1c8e --- /dev/null +++ b/splunk/src/test/resources/resultsMVFuture.json @@ -0,0 +1 @@ +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~115~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"115:5186","_indextime":"1354063462","_raw":"127.0.0.1 - admin [27/Nov/2012:16:44:22.581 -0800] \"GET /services/messages?count=-1 HTTP/1.1\" 200 1998 - - - 1ms","_serial":"0","_si":["dfoster-mbp17.local","_internal"],"_sourcetype":"splunkd_access","_subsecond":".581","_time":"2012-11-27T16:44:22.581-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","sourcetype":"splunkd_access","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMVOneshot.csv b/splunk/src/test/resources/resultsMVOneshot.csv new file mode 100644 index 00000000..9118b992 --- /dev/null +++ b/splunk/src/test/resources/resultsMVOneshot.csv @@ -0,0 +1,4 @@ + +"_bkt","_cd","_indextime","_raw","_serial","_si","_sourcetype","_subsecond","_time",host,index,linecount,source,sourcetype,"splunk_server" +"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","114:33623",1354062581,"127.0.0.1 - admin [27/Nov/2012:16:29:39.149 -0800] ""GET /services/messages?count=-1 HTTP/1.1"" 200 1998 - - - 1ms",0,"dfoster-mbp17.local +_internal","splunkd_access",".149","2012-11-27T16:29:39.149-08:00","dfoster-mbp17.local","_internal",1,"/Applications/splunkbeta_140868_rc7/var/log/splunk/splunkd_access.log","splunkd_access","dfoster-mbp17.local" diff --git a/splunk/src/test/resources/resultsMVOneshot.xml b/splunk/src/test/resources/resultsMVOneshot.xml new file mode 100644 index 00000000..a03c5746 --- /dev/null +++ b/splunk/src/test/resources/resultsMVOneshot.xml @@ -0,0 +1,69 @@ + + + + + +_bkt +_cd +_indextime +_raw +_serial +_si +_sourcetype +_subsecond +_time +host +index +linecount +source +sourcetype +splunk_server + + + + + _internal~114~BC509B13-C34D-4A69-B216-488806E9EA63 + + + 114:33595 + + + 1354062575 + + 11-27-2012 16:29:35.217 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00 + + 0 + + + dfoster-mbp17.local + _internal + + + splunkd + + + .217 + + + 2012-11-27T16:29:35.217-08:00 + + + dfoster-mbp17.local + + + _internal + + + 1 + + + /Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log + + + splunkd + + + dfoster-mbp17.local + + + \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMVOneshot4.json b/splunk/src/test/resources/resultsMVOneshot4.json new file mode 100644 index 00000000..0dc668c7 --- /dev/null +++ b/splunk/src/test/resources/resultsMVOneshot4.json @@ -0,0 +1,19 @@ + +[ + { + "_cd": "184:21387", + "_indextime": "1353099184", + "_raw": "2012-11-16 12:53:04.502 -0800 Interrupt signal received", + "_serial": "0", + "_si": "dfoster-mbp17.local\n_internal", + "_sourcetype": "splunkd_stderr", + "_subsecond": ".502", + "_time": "2012-11-16T12:53:04.502-08:00", + "host": "dfoster-mbp17.local", + "index": "_internal", + "linecount": "1", + "source": "/Applications/splunk_434/var/log/splunk/splunkd_stderr.log", + "sourcetype": "splunkd_stderr", + "splunk_server": "dfoster-mbp17.local" + } +] \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMVOneshot5.json b/splunk/src/test/resources/resultsMVOneshot5.json new file mode 100644 index 00000000..50846818 --- /dev/null +++ b/splunk/src/test/resources/resultsMVOneshot5.json @@ -0,0 +1,2 @@ + +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"114:34048","_indextime":"1354062607","_raw":"11-27-2012 16:30:06.140 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00","_serial":"0","_si":"dfoster-mbp17.local\n_internal","_sourcetype":"splunkd","_subsecond":".140","_time":"2012-11-27T16:30:06.140-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log","sourcetype":"splunkd","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/resultsMVOneshotFuture.json b/splunk/src/test/resources/resultsMVOneshotFuture.json new file mode 100644 index 00000000..0d200b61 --- /dev/null +++ b/splunk/src/test/resources/resultsMVOneshotFuture.json @@ -0,0 +1,2 @@ + +{"preview":false,"init_offset":0,"messages":[{"type":"DEBUG","text":"base lispy: [ AND index::_internal ]"},{"type":"DEBUG","text":"search context: user=\"admin\", app=\"search\", bs-pathname=\"/Applications/splunkbeta_140868_rc7/etc\""}],"results":[{"_bkt":"_internal~114~BC509B13-C34D-4A69-B216-488806E9EA63","_cd":"114:34048","_indextime":"1354062607","_raw":"11-27-2012 16:30:06.140 -0800 INFO Metrics - group=udpin_connections, *:9999, sourcePort=9999, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00","_serial":"0","_si":["dfoster-mbp17.local","_internal"],"_sourcetype":"splunkd","_subsecond":".140","_time":"2012-11-27T16:30:06.140-08:00","host":"dfoster-mbp17.local","index":"_internal","linecount":"1","source":"/Applications/splunkbeta_140868_rc7/var/log/splunk/metrics.log","sourcetype":"splunkd","splunk_server":"dfoster-mbp17.local"}]} \ No newline at end of file diff --git a/splunk/src/test/resources/resultsPreview.xml b/splunk/src/test/resources/resultsPreview.xml new file mode 100644 index 00000000..54939576 --- /dev/null +++ b/splunk/src/test/resources/resultsPreview.xml @@ -0,0 +1,1057 @@ + + + + +_cd +_indextime +_kv +_raw +_serial +_si +_sourcetype +_subsecond +_time +active_hist_searches +active_realtime_searches +app +appCodeName +appName +browser +bytes +class +client_app +clientip +component +count +date_hour +date_mday +date_minute +date_month +date_second +date_wday +date_year +date_zone +delimiter +display_row_numbers +drop_count +earliest +enable_event_actions +enable_field_actions +entity_name +eventtype +field_list +fields +file +fillcontents +group +host +ident +index +jobStatus +latest +line +linecount +log_level +max_lines +max_lines_constraint +max_time +mean_preview_period +message +message_level +method +min_freq +min_lines +name +namespace +offset +other +output_mode +output_time_format +platform +prefix +punct +q +referer +referer_domain +req_time +requestid +reverse_order +root +s +search +segmentation +show_empty_fields +sid +sortDir +sortKey +sort_dir +sort_key +source +sourcetype +spent +splunk_server +staticFields +status +time_format +timeendpos +timestartpos +truncation_mode +uri +uri_path +uri_query +user +userAgent +useragent +version + + + + + 54:8568 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + 731 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle + + + --_::,_t[]_:_-_:__():_////-../// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8562 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + 732 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .424 + + + 2012-12-19T11:48:55.424-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8674 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + 728 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8662 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + 729 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_////-..//// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:8651 + + + 1355946537 + + + 1 + + 2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + 730 + + + fross-mbp15.local + _internal + + + splunk_web_service + + + .425 + + + 2012-12-19T11:48:55.425-08:00 + + + root + + + 11 + + + 19 + + + 48 + + + december + + + 55 + + + wednesday + + + 2012 + + + local + + + fross-mbp15.local + + + _internal + + + 535 + + + 1 + + + INFO + + + CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed + + + --_::,_t[]_:_-_:__():_/// + + + 50d21a262616082d0 + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log + + + splunk_web_service + + + fross-mbp15.local + + + 24 + + + 0 + + + + + 54:9267 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 726 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9262 + + + 1355946552 + + + 1 + + 12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 727 + + + fross-mbp15.local + _internal + + + splunkd + + + .313 + + + 2012-12-19T11:49:12.313-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 12 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9769 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 724 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:9764 + + + 1355946583 + + + 1 + + 12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_search_data, system total, drop_count=0 + + 725 + + + fross-mbp15.local + _internal + + + splunkd + + + .322 + + + 2012-12-19T11:49:43.322-08:00 + + + Metrics + + + 11 + + + 19 + + + 49 + + + december + + + 43 + + + wednesday + + + 2012 + + + -480 + + + 0 + + + realtime_search_data + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=realtime_search_data, system total, drop_count=0 + + + --_::._-____-_=,__,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + + + 54:10097 + + + 1355946614 + + + 1 + + 12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + 722 + + + fross-mbp15.local + _internal + + + splunkd + + + .351 + + + 2012-12-19T11:50:14.351-08:00 + + + 0 + + + 0 + + + Metrics + + + 11 + + + 19 + + + 50 + + + december + + + 14 + + + wednesday + + + 2012 + + + -480 + + + search_concurrency + + + fross-mbp15.local + + + _internal + + + 1 + + + INFO + + + group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0 + + + --_::._-____-_=,__,_=,_= + + + /Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log + + + splunkd + + + fross-mbp15.local + + + 29 + + + 0 + + + \ No newline at end of file diff --git a/splunk/staticdocs.css b/splunk/staticdocs.css new file mode 100644 index 00000000..5d73181d --- /dev/null +++ b/splunk/staticdocs.css @@ -0,0 +1,64 @@ +/* Page background color */ +body { background: transparent } + +/* Headings */ +h1 { font-size: 145% } + +body { +font-family: Arial, sans-serif; +color: #555; +font-size: 13px; +line-height: 18px; +margin:0 auto; +padding-left:5px; +padding-right:5px; +} + +table { +border-width: 0px; +border-spacing: 0px; +border-style: outset; +border-color: gray; +border-collapse: collapse; +background-color: white; +/*margin-top:15px; */ +margin-bottom: 15px; +} + +th { +border-width: 0px; +padding: 2px 6px 1px 6px; +border-style: inset; +border-color: #e2e2e2; +background-color: #eeeeee; +text-align: left; +} + +td { +border-width: 0px; +padding: 2px 6px 1px 6px; +border-style: inset; +border-color: #e2e2e2; +background-color: white; +} + +a { +color: rgb(8, 89, 130); +text-decoration: none; +} + +/* Font used in left-hand frame lists */ +.FrameTitleFont { font-size: 100%; font-family: Arial, sans-serif; color:#000000 } +.FrameHeadingFont { font-size: 100%; font-family: Arial, sans-serif; color:#000000 } +.FrameItemFont { font-size: 100%; font-family: Arial, sans-serif; color:#000000 } + + +/* Navigation bar fonts and colors */ +.NavBarCell1 { background-color:#EEEEFF; color:#000000} /* Light mauve */ +.NavBarCell1Rev { background-color:#00008B; color:#FFFFFF} /* Dark Blue */ +.NavBarFont1 { font-family: Arial, Helvetica, sans-serif; color:#000000;color:#000000;} +.NavBarFont1Rev { font-family: Arial, Helvetica, sans-serif; color:#FFFFFF;color:#FFFFFF;} + +.NavBarCell2 { font-family: Arial, Helvetica, sans-serif; background-color:#FFFFFF; color:#000000} +.NavBarCell3 { font-family: Arial, Helvetica, sans-serif; background-color:#FFFFFF; color:#000000} + diff --git a/splunkrc.spec b/splunkrc.spec index 01c53945..76a61053 100644 --- a/splunkrc.spec +++ b/splunkrc.spec @@ -1,20 +1,12 @@ -# Host at which Splunk is reachable (default: localhost) -host=127.0.0.1 - -# Port at which Splunk is reachable (default: 8089) +# Splunk Enterprise host (default: localhost) +host=localhost +# Splunk Enterprise admin port (default: 8089) port=8089 - -# Username to use when logging in +# Splunk Enterprise username username=admin - -# Password to use when logging in +# Splunk Enterprise password password=changeme - # Access scheme (default: https) scheme=https - -# The app namespace to use (optional) -app=MyApp - -# The user namespace to use (optional) -owner=admin +# Your version of Splunk Enterprise +version=7.0 \ No newline at end of file diff --git a/tests/com/splunk/ApplicationTest.java b/tests/com/splunk/ApplicationTest.java deleted file mode 100644 index eb5a5121..00000000 --- a/tests/com/splunk/ApplicationTest.java +++ /dev/null @@ -1,133 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class ApplicationTest extends SplunkTestCase { - private Service waitForSplunk() throws Exception { - // there is still a race condition here: if the restart takes more - // than 5 seconds to percolate through splunk, apps will not be - // reset - int retry = 10; - while (retry > 0) { - Thread.sleep(5000); // 5 seconds - retry = retry-1; - try { - return connect(); - } - catch (Exception e) { - // server not back yet - } - } - fail("Splunk service did not restart"); - return null; - } - - private Service cleanApp(String appName, Service service) throws Exception { - service.restart(); - service = waitForSplunk(); - EntityCollection apps = service.getApplications(); - apps.remove(appName); - service.restart(); - return waitForSplunk(); - } - - // Nota Bene: Splunk needs to be restarted whenever an app is deleted - // (more precisely, needs to be restarted after an app is deleted, AND - // you want to manipulate, or create a new one in its place). - // This test assumes the worst case, and will restart splunk - // before and after an application deletion -- to correct for invalid - // splunk application state. - @Test public void testApps() throws Exception { - Service service = connect(); - - EntityCollection apps = service.getApplications(); - for (Application app: apps.values()) { - try { - ApplicationSetup applicationSetup = app.setup(); - applicationSetup.getSetupXml(); - } catch (Exception e) { - // silent exception, if setup doesn't exist, exception occurs - } - app.archive(); - app.getAuthor(); - app.getCheckForUpdates(); - app.getDescription(); - app.getLabel(); - app.getVersion(); - app.isConfigured(); - app.isManageable(); - app.isVisible(); - app.stateChangeRequiresRestart(); - ApplicationUpdate applicationUpdate = app.update(); - applicationUpdate.getChecksum(); - applicationUpdate.getChecksumType(); - applicationUpdate.getHomepage(); - applicationUpdate.getSize(); - applicationUpdate.getUpdateName(); - applicationUpdate.getAppUrl(); - applicationUpdate.getVersion(); - applicationUpdate.isImplicitIdRequired(); - } - - if (apps.containsKey("sdk-tests")) { - service = cleanApp("sdk-tests", service); - } - - apps = service.getApplications(); - assertEquals(false, apps.containsKey("sdk-tests")); - - Args createArgs = new Args(); - createArgs.put("author", "me"); - // 4.2.4+ only - //createArgs.put("configured", false); - createArgs.put("description", "this is a description"); - createArgs.put("label", "SDKTEST"); - createArgs.put("manageable", false); - createArgs.put("template", "barebones"); - createArgs.put("visible", false); - apps.create("sdk-tests", createArgs); - assertEquals(true, apps.containsKey("sdk-tests")); - Application app = apps.get("sdk-tests"); - - app.getCheckForUpdates(); - assertEquals(app.getLabel(), "SDKTEST"); - assertEquals(app.getAuthor(), "me"); - assertFalse(app.isConfigured()); - assertFalse(app.isManageable()); - assertFalse(app.isVisible()); - - Args updateArgs = new Args(); - updateArgs.put("version", "5.0.0"); - app.update(updateArgs); - assertEquals(app.getVersion(), "5.0.0"); - - // archive (package) the application - ApplicationArchive appArchive = app.archive(); - assertTrue(appArchive.getAppName().length() > 0); - assertTrue(appArchive.getFilePath().length() > 0); - assertTrue(appArchive.getUrl().length() > 0); - - ApplicationUpdate appUpdate = app.update(); - assertTrue(appUpdate.containsKey("eai:acl")); - - service = cleanApp("sdk-tests", service); - apps = service.getApplications(); - assertEquals(false, apps.containsKey("sdk-tests")); - } -} diff --git a/tests/com/splunk/ConfTest.java b/tests/com/splunk/ConfTest.java deleted file mode 100644 index 76794ea2..00000000 --- a/tests/com/splunk/ConfTest.java +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class ConfTest extends SplunkTestCase { - final static String APP = "sdk-tests"; - final static String OWNER = "nobody"; - - @Test public void testConfs() { - Service service = connect(); - - ConfCollection confs = service.getConfs(); - - // Make sure the collection contains some of the expected entries. - assertTrue(confs.containsKey("eventtypes")); - assertTrue(confs.containsKey("searchbnf")); - assertTrue(confs.containsKey("indexes")); - assertTrue(confs.containsKey("inputs")); - assertTrue(confs.containsKey("props")); - assertTrue(confs.containsKey("transforms")); - assertTrue(confs.containsKey("savedsearches")); - - // Iterate over the confs just to make sure we can read them - for (EntityCollection conf : confs.values()) { - conf.getName(); - conf.getTitle(); - conf.getPath(); - for (Entity stanza : conf.values()) { - stanza.getName(); - stanza.getTitle(); - stanza.getPath(); - } - } - } - - // Test creating, reading, updating and deleting (where possible) confs, - // stanzas and properties. - @Test public void testConfCrud() { - Service service; - - // Create a fresh app to use as the container for confs that we will - // create in this test. There is no way to delete a conf once it's - // created so we make sure to create in the context of this test app - // and then we delete the app when we are done to make everything go - // away. - createApp(APP); - service = connect(); - assertTrue(service.getApplications().containsKey(APP)); - - // Create an app specific service instance - Args args = new Args(command.opts); - args.put("app", APP); - args.put("owner", OWNER); - service = Service.connect(args); - - ConfCollection confs = service.getConfs(); - assertFalse(confs.containsKey("testconf")); - confs.create("testconf"); - assertTrue(confs.containsKey("testconf")); - - EntityCollection stanzas = confs.get("testconf"); - assertEquals(stanzas.size(), 0); - - stanzas.create("stanza1"); - stanzas.create("stanza2"); - stanzas.create("stanza3"); - assertEquals(stanzas.size(), 3); - assertTrue(stanzas.containsKey("stanza1")); - assertTrue(stanzas.containsKey("stanza2")); - assertTrue(stanzas.containsKey("stanza3")); - - // Grab the new stanza and check its content - Entity stanza1 = stanzas.get("stanza1"); - assertEquals(stanza1.get("eai:userName"), "nobody"); - assertEquals(stanza1.get("eai:appName"), APP); - assertFalse(stanza1.containsKey("key1")); - assertFalse(stanza1.containsKey("key2")); - assertFalse(stanza1.containsKey("key3")); - - // Add a couple of properties - args = new Args(); - args.put("key1", "value1"); - args.put("key2", 42); - stanza1.update(args); - - // Make sure the properties showed up - assertEquals(stanza1.get("key1"), "value1"); - assertEquals(stanza1.get("key2"), "42"); - assertFalse(stanza1.containsKey("key3")); - - // Update an existing property - args = new Args(); - args.put("key1", "value2"); - stanza1.update(args); - - // Make sure the updated property shows up (and no other changes). - assertEquals(stanza1.get("key1"), "value2"); - assertEquals(stanza1.get("key2"), "42"); - assertFalse(stanza1.containsKey("key3")); - - // Delete the stanzas - stanzas.remove("stanza3"); - assertEquals(stanzas.size(), 2); - assertTrue(stanzas.containsKey("stanza1")); - assertTrue(stanzas.containsKey("stanza2")); - assertFalse(stanzas.containsKey("stanza3")); - - stanzas.remove("stanza2"); - assertEquals(stanzas.size(), 1); - assertTrue(stanzas.containsKey("stanza1")); - assertFalse(stanzas.containsKey("stanza2")); - assertFalse(stanzas.containsKey("stanza3")); - - stanzas.remove("stanza1"); - assertEquals(stanzas.size(), 0); - assertFalse(stanzas.containsKey("stanza1")); - assertFalse(stanzas.containsKey("stanza2")); - assertFalse(stanzas.containsKey("stanza3")); - - // Cleanup after ourselves - removeApp(APP); - } -} diff --git a/tests/com/splunk/DeploymentClientTest.java b/tests/com/splunk/DeploymentClientTest.java deleted file mode 100644 index ddf80fc4..00000000 --- a/tests/com/splunk/DeploymentClientTest.java +++ /dev/null @@ -1,51 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class DeploymentClientTest extends SplunkTestCase { - @Test public void testDeploymentClient() throws Exception { - Service service = connect(); - - DeploymentClient deploymentClient = service.getDeploymentClient(); - String uri = deploymentClient.getTargetUri(); - if (uri != null) { - deploymentClient.refresh(); - if (deploymentClient.isDisabled()) { - deploymentClient.enable(); - } - assertFalse(deploymentClient.isDisabled()); - deploymentClient.disable(); - assertTrue(deploymentClient.isDisabled()); - deploymentClient.enable(); - assertFalse(deploymentClient.isDisabled()); - Args args = new Args(); - args.put("targetUri", "1.2.3.4:8080"); - deploymentClient.update(args); - assertEquals(deploymentClient.getTargetUri(), "1.2.3.4:8080"); - args.put("targetUri", uri); - deploymentClient.update(args); - assertEquals(deploymentClient.getTargetUri(), uri); - deploymentClient.getServerClasses(); - deploymentClient.reload(); - } - else { - System.out.println("WARNING: deploymenClient not configured"); - } - } -} diff --git a/tests/com/splunk/DeploymentServerClassTest.java b/tests/com/splunk/DeploymentServerClassTest.java deleted file mode 100644 index 58138b1f..00000000 --- a/tests/com/splunk/DeploymentServerClassTest.java +++ /dev/null @@ -1,119 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class DeploymentServerClassTest extends SplunkTestCase { - @Test public void testDeploymentServerClass() throws Exception { - Service service = connect(); - - EntityCollection deploymentServerClasses = - service.getDeploymentServerClasses(); - DeploymentServerClass deploymentServerClass; - - Args args = new Args(); - args.put("blacklist.0", "bad0.splunk.com"); - args.put("blacklist.1", "bad1.splunk.com"); - args.put("blacklist.2", "bad2.splunk.com"); - args.put("blacklist.3", "bad3.splunk.com"); - args.put("blacklist.4", "bad4.splunk.com"); - args.put("blacklist.5", "bad5.splunk.com"); - args.put("blacklist.6", "bad6.splunk.com"); - args.put("blacklist.7", "bad7.splunk.com"); - args.put("blacklist.8", "bad8.splunk.com"); - args.put("blacklist.9", "bad9.splunk.com"); - args.put("continueMatching", false); - args.put("filterType","whitelist"); - args.put("whitelist.0", "good0.splunk.com"); - args.put("whitelist.1", "good1.splunk.com"); - args.put("whitelist.2", "good2.splunk.com"); - args.put("whitelist.3", "good3.splunk.com"); - args.put("whitelist.4", "good4.splunk.com"); - args.put("whitelist.5", "good5.splunk.com"); - args.put("whitelist.6", "good6.splunk.com"); - args.put("whitelist.7", "good7.splunk.com"); - args.put("whitelist.8", "good8.splunk.com"); - args.put("whitelist.9", "good9.splunk.com"); - - if (!deploymentServerClasses.containsKey("sdk-tests")) { - deploymentServerClass = - deploymentServerClasses.create("sdk-tests", args); - } else { - deploymentServerClass = deploymentServerClasses.get("sdk-tests"); - deploymentServerClass.update(args); - } - - assertEquals(deploymentServerClass.getBlackListByIndex(0), - args.get("blacklist.0")); - assertEquals(deploymentServerClass.getBlackListByIndex(1), - args.get("blacklist.1")); - assertEquals(deploymentServerClass.getBlackListByIndex(2), - args.get("blacklist.2")); - assertEquals(deploymentServerClass.getBlackListByIndex(3), - args.get("blacklist.3")); - assertEquals(deploymentServerClass.getBlackListByIndex(4), - args.get("blacklist.4")); - assertEquals(deploymentServerClass.getBlackListByIndex(5), - args.get("blacklist.5")); - assertEquals(deploymentServerClass.getBlackListByIndex(6), - args.get("blacklist.6")); - assertEquals(deploymentServerClass.getBlackListByIndex(7), - args.get("blacklist.7")); - assertEquals(deploymentServerClass.getBlackListByIndex(8), - args.get("blacklist.8")); - assertEquals(deploymentServerClass.getBlackListByIndex(9), - args.get("blacklist.9")); - assertEquals(deploymentServerClass.getContinueMatching(), - args.get("continueMatching")); - assertEquals(deploymentServerClass.getFilterType(), - args.get("filterType")); - assertEquals(deploymentServerClass.getWhiteListByIndex(0), - args.get("whitelist.0")); - assertEquals(deploymentServerClass.getWhiteListByIndex(1), - args.get("whitelist.1")); - assertEquals(deploymentServerClass.getWhiteListByIndex(2), - args.get("whitelist.2")); - assertEquals(deploymentServerClass.getWhiteListByIndex(3), - args.get("whitelist.3")); - assertEquals(deploymentServerClass.getWhiteListByIndex(4), - args.get("whitelist.4")); - assertEquals(deploymentServerClass.getWhiteListByIndex(5), - args.get("whitelist.5")); - assertEquals(deploymentServerClass.getWhiteListByIndex(6), - args.get("whitelist.6")); - assertEquals(deploymentServerClass.getWhiteListByIndex(7), - args.get("whitelist.7")); - assertEquals(deploymentServerClass.getWhiteListByIndex(8), - args.get("whitelist.8")); - assertEquals(deploymentServerClass.getWhiteListByIndex(9), - args.get("whitelist.9")); - - for (DeploymentServerClass deploymentServerClass1: - deploymentServerClasses.values()) { - assertTrue( - deploymentServerClass1.getRepositoryLocation().length() > 0); - deploymentServerClass1.getBlackList(); - deploymentServerClass1.getEndpoint(); - deploymentServerClass1.getTargetRepositoryLocation(); - deploymentServerClass1.getTmpFolder(); - deploymentServerClass1.getWhiteList(); - } - - // N.B. No REST endpoint to delete a deployment server class. - } -} diff --git a/tests/com/splunk/DistributedConfigurationTest.java b/tests/com/splunk/DistributedConfigurationTest.java deleted file mode 100644 index 53094da1..00000000 --- a/tests/com/splunk/DistributedConfigurationTest.java +++ /dev/null @@ -1,183 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class DistributedConfigurationTest extends SplunkTestCase { - @Test public void testDistributedConfiguration() throws Exception { - Service service = connect(); - - DistributedConfiguration distributedConfiguration = - service.getDistributedConfiguration(); - - Args savedSetup = new Args(); - savedSetup.put("autoAddServers", - distributedConfiguration.getAutoAddServers()); - savedSetup.put("blacklistNames", - distributedConfiguration.getBlacklistNames()); - savedSetup.put("blacklistURLs", - distributedConfiguration.getBlacklistUrls()); - savedSetup.put("checkTimedOutServersFrequency", - distributedConfiguration.getCheckTimedOutServersFrequency()); - savedSetup.put("disabled", distributedConfiguration.isDisabled()); - savedSetup.put("heartbeatFrequency", - distributedConfiguration.getHeartbeatFrequency()); - savedSetup.put("heartbeatMcastAddr", - distributedConfiguration.getHeartbeatMcastAddress()); - savedSetup.put("heartbeatPort", - distributedConfiguration.getHeartbeatPort()); - savedSetup.put("removedTimedOutServers", - distributedConfiguration.getRemovedTimedOutServers()); - savedSetup.put("serverTimeout", - distributedConfiguration.getServerTimeout()); - savedSetup.put("servers", distributedConfiguration.getServers()); - savedSetup.put("shareBundles", - distributedConfiguration.getShareBundles()); - savedSetup.put("skipOurselves", - distributedConfiguration.getSkipOurselves()); - savedSetup.put("statusTimeout", - distributedConfiguration.getStatusTimeout()); - savedSetup.put("ttl", distributedConfiguration.getTtl()); - for (String key: savedSetup.keySet()) { - if (savedSetup.get(key) == null) - savedSetup.put(key, ""); - } - - Args updateArgs = new Args(); - - updateArgs.put("autoAddServers", false); - updateArgs.put("blacklistNames", "black1,black2,black3"); - updateArgs.put("blacklistURLs", "black1.splunk.com:8089"); - updateArgs.put("checkTimedOutServersFrequency", 120); - updateArgs.put("disabled", true); - updateArgs.put("heartbeatFrequency", 120); - updateArgs.put("heartbeatMcastAddr", "224.0.1.37"); - updateArgs.put("heartbeatPort", 8889); - updateArgs.put("removedTimedOutServers", false); - updateArgs.put("serverTimeout", 180); - updateArgs.put("servers", "good1.splunk.com,good2.splunk.com"); - updateArgs.put("shareBundles", false); - updateArgs.put("skipOurselves", true); - updateArgs.put("statusTimeout", 100); - updateArgs.put("ttl", 5); - - distributedConfiguration.update(updateArgs); - assertEquals( - distributedConfiguration.getAutoAddServers(), - updateArgs.get("autoAddServers")); - assertEquals( - distributedConfiguration.getBlacklistNames(), - updateArgs.get("blacklistNames")); - assertEquals( - distributedConfiguration.getBlacklistUrls(), - updateArgs.get("blacklistURLs")); - assertEquals( - distributedConfiguration.getCheckTimedOutServersFrequency(), - updateArgs.get("checkTimedOutServersFrequency")); - assertEquals(distributedConfiguration.isDisabled(), - updateArgs.get("disabled")); - assertEquals( - distributedConfiguration.getHeartbeatFrequency(), - updateArgs.get("heartbeatFrequency")); - assertEquals( - distributedConfiguration.getHeartbeatMcastAddress(), - updateArgs.get("heartbeatMcastAddr")); - assertEquals( - distributedConfiguration.getHeartbeatPort(), - updateArgs.get("heartbeatPort")); - assertEquals( - distributedConfiguration.getRemovedTimedOutServers(), - updateArgs.get("removedTimedOutServers")); - assertEquals( - distributedConfiguration.getServerTimeout(), - updateArgs.get("serverTimeout")); - assertEquals(distributedConfiguration.getServers(), - updateArgs.get("servers")); - assertEquals( - distributedConfiguration.getShareBundles(), - updateArgs.get("shareBundles")); - assertEquals( - distributedConfiguration.getSkipOurselves(), - updateArgs.get("skipOurselves")); - assertEquals( - distributedConfiguration.getStatusTimeout(), - updateArgs.get("statusTimeout")); - assertEquals(distributedConfiguration.getTtl(), updateArgs.get("ttl")); - - // handle nulls specially - if (savedSetup.get("blacklistNames") == null) - savedSetup.put("blacklistNames", ""); - if (savedSetup.get("blacklistURLs") == null) - savedSetup.put("blacklistURLs", ""); - - distributedConfiguration.update(savedSetup); - - assertEquals( - distributedConfiguration.getAutoAddServers(), - savedSetup.get("autoAddServers")); - assertEquals( - distributedConfiguration.getBlacklistNames() == null ? "" : - distributedConfiguration.getBlacklistNames(), - savedSetup.get("blacklistNames") ); - assertEquals( - distributedConfiguration.getBlacklistUrls() == null ? "" : - distributedConfiguration.getBlacklistUrls(), - savedSetup.get("blacklistURLs")); - assertEquals( - distributedConfiguration.getCheckTimedOutServersFrequency(), - savedSetup.get("checkTimedOutServersFrequency")); - assertEquals(distributedConfiguration.isDisabled(), - savedSetup.get("disabled")); - assertEquals( - distributedConfiguration.getHeartbeatFrequency(), - savedSetup.get("heartbeatFrequency")); - assertEquals( - distributedConfiguration.getHeartbeatMcastAddress(), - savedSetup.get("heartbeatMcastAddr")); - assertEquals( - distributedConfiguration.getHeartbeatPort(), - savedSetup.get("heartbeatPort")); - assertEquals( - distributedConfiguration.getRemovedTimedOutServers(), - savedSetup.get("removedTimedOutServers")); - assertEquals( - distributedConfiguration.getServerTimeout(), - savedSetup.get("serverTimeout")); - assertEquals( - distributedConfiguration.getServers() == null ? "" : - distributedConfiguration.getServers(), - savedSetup.get("servers")); - assertEquals( - distributedConfiguration.getShareBundles(), - savedSetup.get("shareBundles")); - assertEquals( - distributedConfiguration.getSkipOurselves(), - savedSetup.get("skipOurselves")); - assertEquals( - distributedConfiguration.getStatusTimeout(), - savedSetup.get("statusTimeout")); - assertEquals(distributedConfiguration.getTtl(), - savedSetup.get("ttl")); - - distributedConfiguration.getConnectionTimeout(); - distributedConfiguration.getReceiveTimeout(); - distributedConfiguration.getSendTimeout(); - - distributedConfiguration.isDistSearchEnabled(); - } -} diff --git a/tests/com/splunk/DistributedPeerTest.java b/tests/com/splunk/DistributedPeerTest.java deleted file mode 100644 index d56ee77f..00000000 --- a/tests/com/splunk/DistributedPeerTest.java +++ /dev/null @@ -1,71 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class DistributedPeerTest extends SplunkTestCase { - @Test public void testDistributedPeer() throws Exception { - Service service = connect(); - - EntityCollection distributedPeers = - service.getDistributedPeers(); - - String name = command.host + ":" + command.port; - - if (distributedPeers.containsKey(name)) { - distributedPeers.remove(name); - } - - assertFalse(distributedPeers.containsKey(name)); - Args args = new Args(); - args.put("remotePassword", command.password); - args.put("remoteUsername", command.username); - DistributedPeer newDistributedPeer = - distributedPeers.create(name, args); - assertTrue(distributedPeers.containsKey(name)); - - // created as enabled - newDistributedPeer.disable(); - assertTrue(newDistributedPeer.isDisabled()); - newDistributedPeer.enable(); - assertFalse(newDistributedPeer.isDisabled()); - // N.B. these are write only... so can't check if they take - args.put("remotePassword", command.password + "xx"); - args.put("remoteUsername", command.username + "xx"); - newDistributedPeer.update(args); - - for (DistributedPeer distributedPeer: distributedPeers.values()) { - distributedPeer.getTitle(); - distributedPeer.getBuild(); - distributedPeer.getBundleVersions(); - distributedPeer.getGuid(); - distributedPeer.getLicenseSignature(); - distributedPeer.getPeerName(); - distributedPeer.getPeerType(); - distributedPeer.getReplicationStatus(); - distributedPeer.getStatus(); - distributedPeer.getVersion(); - distributedPeer.isDisabled(); - distributedPeer.isHttps(); - } - - newDistributedPeer.remove(); - distributedPeers.refresh(); - assertFalse(distributedPeers.containsKey(name)); - } -} diff --git a/tests/com/splunk/EventTypeTest.java b/tests/com/splunk/EventTypeTest.java deleted file mode 100644 index 1c850894..00000000 --- a/tests/com/splunk/EventTypeTest.java +++ /dev/null @@ -1,78 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class EventTypeTest extends SplunkTestCase { - - void checkEventType(EventType eventType) { - eventType.getDescription(); - eventType.getPriority(); - eventType.getSearch(); - } - - void checkEventTypes(EventTypeCollection collection) { - for (EventType eventType : collection.values()) - checkEventType(eventType); - } - - @Test public void testEventType() throws Exception { - Service service = connect(); - - EventTypeCollection eventTypeCollection = service.getEventTypes(); - - if (eventTypeCollection.containsKey("sdk-test")) - eventTypeCollection.remove("sdk-test"); - assertFalse(eventTypeCollection.containsKey("sdk-test")); - - checkEventTypes(eventTypeCollection); - - String search = "index=_internal *"; - - Args args = new Args(); - args.put("description", "Dummy description"); - args.put("disabled", true); - args.put("priority", 2); - EventType eventType = - eventTypeCollection.create("sdk-test", search, args); - - assertTrue(eventTypeCollection.containsKey("sdk-test")); - - assertEquals(eventType.getName(), "sdk-test"); - assertEquals(eventType.getDescription(), args.get("description")); - assertEquals(eventType.getPriority(), args.get("priority")); - assertEquals(eventType.getSearch(), search); - assertTrue(eventType.isDisabled()); - - args = new Args(); - args.put("search", "index=_audit *"); - args.put("description", "Dummy description a second time"); - args.put("priority", 3); - eventType.update(args); - eventType.enable(); - - assertEquals(eventType.getName(), "sdk-test"); - assertEquals(eventType.getDescription(), args.get("description")); - assertEquals(eventType.getPriority(), args.get("priority")); - assertEquals(eventType.getSearch(), args.get("search")); - assertFalse(eventType.isDisabled()); - - eventTypeCollection.remove("sdk-test"); - assertFalse(eventTypeCollection.containsKey("sdk-test")); - } -} diff --git a/tests/com/splunk/FiredAlertTest.java b/tests/com/splunk/FiredAlertTest.java deleted file mode 100644 index 7c29deac..00000000 --- a/tests/com/splunk/FiredAlertTest.java +++ /dev/null @@ -1,45 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class FiredAlertTest extends SplunkTestCase { - @Test public void testFiredAlerts() throws Exception { - Service service = connect(); - EntityCollection firedAlerts = service.getFiredAlerts(); - - if (firedAlerts.values().size() == 0) { - System.out.println("WARNING: no fired alerts detected"); - return; - } - - // N.B. cant create or modify, only read & delete. skipping delete. - for (FiredAlert firedAlert: firedAlerts.values()) { - firedAlert.getAction(); - firedAlert.getAlertType(); - firedAlert.getExpirationTime(); - firedAlert.getSavedSearchName(); - firedAlert.getSeverity(); - firedAlert.getSid(); - firedAlert.getTriggeredAlertCount(); - firedAlert.getTriggerTime(); - firedAlert.getTriggerTimeRendered(); - firedAlert.isDigestMode(); - } - } -} diff --git a/tests/com/splunk/HttpServiceTest.java b/tests/com/splunk/HttpServiceTest.java deleted file mode 100644 index bb3179a7..00000000 --- a/tests/com/splunk/HttpServiceTest.java +++ /dev/null @@ -1,53 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.HashMap; -import org.junit.Test; - -public class HttpServiceTest extends SplunkTestCase { - @Test public void testGet() { - HttpService service = new HttpService( - command.host, command.port, command.scheme); - ResponseMessage response = service.get("/"); - assertEquals(200, response.getStatus()); - } - - @Test public void testPost() { - HttpService service = new HttpService( - command.host, command.port, command.scheme); - HashMap args = new HashMap(); - args.put("foo", "bar"); - ResponseMessage response = service.post("/", args); - // We are taking advantage of the fact that a post to the root of - // the REST API hierarchy ignores POST args and returns the same - // results as a GET. It could be argued this is not a very good - // test because we can't distinguish between a GET & POST result .. - // But I dont have a better idea for how to excercise this code path - // at this layer (without authenticating against Splunk). - assertEquals(200, response.getStatus()); - } - - @Test public void testSend() { - HttpService service = new HttpService( - command.host, command.port, command.scheme); - RequestMessage request = new RequestMessage("GET"); - ResponseMessage response = service.send("/", request); - assertEquals(200, response.getStatus()); - } -} - diff --git a/tests/com/splunk/IndexTest.java b/tests/com/splunk/IndexTest.java deleted file mode 100644 index a9969002..00000000 --- a/tests/com/splunk/IndexTest.java +++ /dev/null @@ -1,214 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.*; -import java.net.Socket; -import java.text.SimpleDateFormat; -import java.util.Date; -import org.junit.Test; - -public class IndexTest extends SplunkTestCase { - private void wait_event_count(Index index, int value, int seconds) { - while (seconds > 0) { - try { - Thread.sleep(1000); // 1000ms (1 second sleep) - seconds = seconds -1; - if (index.getTotalEventCount() == value) { - return; - } - index.refresh(); - } - catch (InterruptedException e) { - return; - } - catch (Exception e) { - return; - } - } - } - - @Test public void testIndex() throws Exception { - Service service = connect(); - SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ"); - String date = sdf.format(new Date()); - - EntityCollection indexes = service.getIndexes(); - for (Index index: indexes.values()) { - index.getAssureUTF8(); - index.getBlockSignatureDatabase(); - index.getBlockSignSize(); - index.getColdPath(); - index.getColdPathExpanded(); - index.getColdToFrozenDir(); - index.getColdToFrozenScript(); - index.getCompressRawdata(); - index.getCurrentDBSizeMB(); - index.getDefaultDatabase(); - index.getEnableRealtimeSearch(); - index.getFrozenTimePeriodInSecs(); - index.getHomePath(); - index.getHomePathExpanded(); - index.getIndexThreads(); - index.getLastInitTime(); - index.getMaxConcurrentOptimizes(); - index.getMaxDataSize(); - index.getMaxHotBuckets(); - index.getMaxHotIdleSecs(); - index.getMaxHotSpanSecs(); - index.getMaxMemMB(); - index.getMaxMetaEntries(); - index.getMaxRunningProcessGroups(); - index.getMaxTime(); - index.getMaxTotalDataSizeMB(); - index.getMaxWarmDBCount(); - index.getMemPoolMB(); - index.getMinRawFileSyncSecs(); - index.getMinTime(); - index.getPartialServiceMetaPeriod(); - index.getQuarantineFutureSecs(); - index.getQuarantinePastSecs(); - index.getRawChunkSizeBytes(); - index.getRotatePeriodInSecs(); - index.getServiceMetaPeriod(); - index.getSuppressBannerList(); - index.getSync(); - index.getSyncMeta(); - index.getThawedPath(); - index.getThawedPathExpanded(); - index.getThrottleCheckPeriod(); - index.getTotalEventCount(); - index.isDisabled(); - index.isInternal(); - } - - if (!indexes.containsKey("sdk-tests")) { - indexes.create("sdk-tests"); - indexes.refresh(); - } - - assertTrue(indexes.containsKey("sdk-tests")); - - Index index = indexes.get("sdk-tests"); - - index.getAssureUTF8(); - index.getBlockSignatureDatabase(); - index.getBlockSignSize(); - index.getColdPath(); - index.getColdPathExpanded(); - index.getColdToFrozenDir(); - index.getColdToFrozenScript(); - index.getCompressRawdata(); - index.getCurrentDBSizeMB(); - index.getDefaultDatabase(); - index.getEnableRealtimeSearch(); - index.getFrozenTimePeriodInSecs(); - index.getHomePath(); - index.getHomePathExpanded(); - index.getIndexThreads(); - index.getLastInitTime(); - index.getMaxConcurrentOptimizes(); - index.getMaxDataSize(); - index.getMaxHotBuckets(); - index.getMaxHotIdleSecs(); - index.getMaxHotSpanSecs(); - index.getMaxMemMB(); - index.getMaxMetaEntries(); - index.getMaxRunningProcessGroups(); - index.getMaxTime(); - index.getMaxTotalDataSizeMB(); - index.getMaxWarmDBCount(); - index.getMemPoolMB(); - index.getMinRawFileSyncSecs(); - index.getMinTime(); - index.getPartialServiceMetaPeriod(); - index.getQuarantineFutureSecs(); - index.getQuarantinePastSecs(); - index.getRawChunkSizeBytes(); - index.getRotatePeriodInSecs(); - index.getServiceMetaPeriod(); - index.getSuppressBannerList(); - index.getSync(); - index.getSyncMeta(); - index.getThawedPath(); - index.getThawedPathExpanded(); - index.getThrottleCheckPeriod(); - index.getTotalEventCount(); - index.isDisabled(); - index.isInternal(); - - index.clean(); - assertEquals(index.getTotalEventCount(), 0); - - index.disable(); - assertTrue(index.isDisabled()); - - index.enable(); - assertFalse(index.isDisabled()); - - // submit events to index - index.submit(date + "Hello World. \u0150"); - index.submit(date + "Goodbye world. \u0150"); - wait_event_count(index, 2, 30); - assertEquals(index.getTotalEventCount(), 2); - - // clean - index.clean(); - assertEquals(index.getTotalEventCount(), 0); - - // stream events to index - Socket socket = index.attach(); - OutputStream ostream = socket.getOutputStream(); - Writer out = new OutputStreamWriter(ostream, "UTF8"); - - out.write(date + "Hello World again. \u0150\r\n"); - out.write(date + "Goodbye World again.\u0150\r\n"); - out.flush(); - socket.close(); - - wait_event_count(index, 2, 30); - assertEquals(index.getTotalEventCount(), 2); - - // clean - index.clean(); - assertEquals(index.getTotalEventCount(), 0); - - // test must run on machine where splunkd runs, - // otherwise an failure is expected and printed as a WARNING - - File file; - FileReader fileReader; - String path; - try { - file = new File( - "tests" + File.separator + "com" + File.separator + - "splunk" + File.separator + "testfile.txt"); - path = file.getAbsolutePath(); - fileReader = new FileReader(path); - } - catch (FileNotFoundException e) { return; } - try { - index.upload(path); - } - catch (HttpException e) { - if (e.getStatus() == 400) { - System.out.println("WARNING: index upload failed (is splunkd " - + "running on this machine?)"); - } - } - } -} diff --git a/tests/com/splunk/InputTest.java b/tests/com/splunk/InputTest.java deleted file mode 100644 index 97583d05..00000000 --- a/tests/com/splunk/InputTest.java +++ /dev/null @@ -1,170 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.*; - -public class InputTest extends SplunkTestCase { - - private void touchSpecificInput(Input input) { - InputKind inputKind = input.getKind(); - - switch (inputKind) { - case Monitor: - MonitorInput monitorInput = (MonitorInput) input; - monitorInput.getFileCount(); - monitorInput.getHost(); - monitorInput.getIndex(); - monitorInput.getRcvBuf(); - break; - case Script: - ScriptInput scriptInput = (ScriptInput) input; - scriptInput.getGroup(); - scriptInput.getHost(); - scriptInput.getIndex(); - scriptInput.getInterval(); - scriptInput.getRcvBuf(); - break; - case Tcp: - TcpInput tcpInput = (TcpInput) input; - tcpInput.getConnectionHost(); - tcpInput.getGroup(); - tcpInput.getHost(); - tcpInput.getIndex(); - tcpInput.getQueue(); - tcpInput.getRcvBuf(); - tcpInput.getRestrictToHost(); - tcpInput.getSource(); - tcpInput.getSourceType(); - tcpInput.getSSL(); - break; - case TcpSplunk: - TcpSplunkInput tcpSplunkInput = (TcpSplunkInput) input; - tcpSplunkInput.getConnectionHost(); - tcpSplunkInput.getGroup(); - tcpSplunkInput.getHost(); - tcpSplunkInput.getIndex(); - tcpSplunkInput.getQueue(); - tcpSplunkInput.getRcvBuf(); - tcpSplunkInput.getSource(); - tcpSplunkInput.getSourceType(); - tcpSplunkInput.getSSL(); - case Udp: - UdpInput udpInput = (UdpInput) input; - udpInput.getConnectionHost(); - udpInput.getGroup(); - udpInput.getHost(); - udpInput.getIndex(); - udpInput.getQueue(); - udpInput.getRcvBuf(); - udpInput.getSource(); - udpInput.getSourceType(); - udpInput.noAppendingTimeStamp(); - udpInput.noPriorityStripping(); - case WindowsActiveDirectory: - WindowsActiveDirectoryInput windowsActiveDirectoryInput = - (WindowsActiveDirectoryInput) input; - windowsActiveDirectoryInput.getIndex(); - windowsActiveDirectoryInput.getMonitorSubtree(); - windowsActiveDirectoryInput.getStartingNode(); - windowsActiveDirectoryInput.getTargetDc(); - break; - case WindowsEventLog: - WindowsEventLogInput windowsEventLogInput = - (WindowsEventLogInput) input; - windowsEventLogInput.getHosts(); - windowsEventLogInput.getIndex(); - windowsEventLogInput.getLocalName(); - windowsEventLogInput.getLogs(); - windowsEventLogInput.getLookupHost(); - break; - case WindowsPerfmon: - WindowsPerfmonInput windowsPerfmonInput = - (WindowsPerfmonInput) input; - windowsPerfmonInput.getCounters(); - windowsPerfmonInput.getIndex(); - windowsPerfmonInput.getInstances(); - windowsPerfmonInput.getInterval(); - windowsPerfmonInput.getObject(); - break; - case WindowsRegistry: - WindowsRegistryInput windowsRegistryInput = - (WindowsRegistryInput) input; - windowsRegistryInput.getBaseline(); - windowsRegistryInput.getHive(); - windowsRegistryInput.getIndex(); - windowsRegistryInput.getMonitorSubnodes(); - windowsRegistryInput.getProc(); - windowsRegistryInput.getType(); - break; - case WindowsWmi: - WindowsWmiInput windowsWmiInput = (WindowsWmiInput) input; - windowsWmiInput.getClasses(); - windowsWmiInput.getFields(); - windowsWmiInput.getIndex(); - windowsWmiInput.getInstances(); - windowsWmiInput.getInterval(); - windowsWmiInput.getLocalName(); - windowsWmiInput.getLookupHost(); - windowsWmiInput.getServer(); - windowsWmiInput.getWql(); - } - } - - @Test public void testInputs() { - Service service = connect(); - - InputCollection inputs = service.getInputs(); - - // Iterate inputs and make sure we can read them. - for (Input input : inputs.values()) { - input.getName(); - input.getTitle(); - input.getPath(); - input.getKind(); - touchSpecificInput(input); - } - } - - @Test public void testInputCrud() { - Service service = connect(); - - InputCollection inputCollection = service.getInputs(); - - // Tcp inputs require the name to be the input's port number. - String name = "9999"; // test port - - if (inputCollection.containsKey(name)) - fail("Input test port already exists: " + name); - - assertFalse(inputCollection.containsKey(name)); - - inputCollection.create(name, InputKind.Tcp); - assertTrue(inputCollection.containsKey(name)); - - TcpInput tcpInput = (TcpInput)inputCollection.get(name); - - Args args = new Args(); - args.put("sourcetype", "sdk-tests"); - tcpInput.update(args); - assertEquals(tcpInput.get("sourcetype"), "sdk-tests"); - - tcpInput.remove(); - inputCollection.refresh(); - assertFalse(inputCollection.containsKey(name)); - } -} diff --git a/tests/com/splunk/LicenseTest.java b/tests/com/splunk/LicenseTest.java deleted file mode 100644 index 72ac2495..00000000 --- a/tests/com/splunk/LicenseTest.java +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.BufferedReader; -import java.io.File; -import java.io.FileNotFoundException; -import java.io.FileReader; -import java.util.Arrays; -import java.util.Date; -import java.util.List; -import org.junit.Test; - -public class LicenseTest extends SplunkTestCase { - @Test public void testLicense() throws Exception { - Service service = connect(); - - EntityCollection licenses = - service.getLicenses(); - - // list of features, empirically created - List features = Arrays.asList( - "Auth", "FwdData", "RcvData", "DeployClient", "SplunkWeb", - "SyslogOutputProcessor", "SigningProcessor", "LocalSearch", - "DistSearch", "RcvSearch", "ScheduledSearch", "Alerting", - "DeployServer", "SigningProcessor", "SyslogOutputProcessor", - "AllowDuplicateKeys", "CanBeRemoteMaster"); - - // list of groupids, empirically created - List groups = Arrays.asList( - "Forwarder", "Enterprise", "Free", "Trial"); - - // list of statuses, empirically created - List stati = Arrays.asList("VALID", "EXPIRED"); - - // list of types, empirically created - List types = Arrays.asList( - "forwarder", "enterprise", "free", "download-trial"); - - // test for sane data in licenses - for (License license: licenses.values()) { - assertTrue(license.getCreationTime().after(new Date(0))); - assertTrue(license.getExpirationTime().after(new Date(0))); - assertTrue(license.getQuota() > 0); - assertTrue(license.getLicenseHash().length() == 64); - for (String feature: license.getFeatures()) { - assertTrue(features.contains(feature)); - } - assertTrue(groups.contains(license.getGroupId())); - assertTrue(license.getLabel().length() > 0); - assertTrue(license.getMaxViolations() != 0); - assertTrue(stati.contains(license.getStatus())); - assertTrue(types.contains(license.getType())); - } - - // create - FileReader fileReader; - char [] buffer = new char[2048]; - try { - File file = new File( - "tests" + File.separator + "com" + File.separator + - "splunk" + File.separator + "splunk.license"); - fileReader = new FileReader(file.getAbsolutePath()); - } - catch (FileNotFoundException e) { - System.out.println("WARNING: can't find test splunk.license file"); - return; - } - - BufferedReader reader = new BufferedReader(fileReader); - reader.read(buffer); - Args args = new Args("payload", new String(buffer)); - licenses.create("sdk-test", args); - assertTrue(licenses.containsKey( - "6B7AD703356A487BDC513EE92B96A9B403C070EFAA30029C9784B0E240FA3101")); - licenses.remove( - "6B7AD703356A487BDC513EE92B96A9B403C070EFAA30029C9784B0E240FA3101"); - assertFalse(licenses.containsKey( - "6B7AD703356A487BDC513EE92B96A9B403C070EFAA30029C9784B0E240FA3101")); - } -} diff --git a/tests/com/splunk/LoggerTest.java b/tests/com/splunk/LoggerTest.java deleted file mode 100644 index cf22d337..00000000 --- a/tests/com/splunk/LoggerTest.java +++ /dev/null @@ -1,51 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Arrays; -import java.util.List; -import org.junit.Test; - -public class LoggerTest extends SplunkTestCase { - @Test public void testLogger() throws Exception { - Service service = connect(); - - List expected = Arrays.asList( - "INFO", "WARN", "ERROR", "DEBUG", "CRIT"); - - EntityCollection serviceLoggers = service.getLoggers(); - for (Logger ent: serviceLoggers.values()) { - assertTrue(expected.contains(ent.getLevel())); - } - - Logger logger = serviceLoggers.get("AuditLogger"); - String saved = logger.getLevel(); - Args update = new Args(); - - for (String level: expected) { - update.clear(); - update.put("level", level); - logger.update(update); - assertEquals(level, logger.getLevel()); - } - - update.clear(); - update.put("level", saved); - logger.update(update); - assertEquals(saved, logger.getLevel()); - } -} diff --git a/tests/com/splunk/MessageTest.java b/tests/com/splunk/MessageTest.java deleted file mode 100644 index 574d71e5..00000000 --- a/tests/com/splunk/MessageTest.java +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class MessageTest extends SplunkTestCase { - @Test public void testMessage() throws Exception { - Service service = connect(); - - MessageCollection messageCollection = service.getMessages(); - - if (messageCollection.containsKey("sdk-test-message1")) - messageCollection.remove("sdk-test-message1"); - assertFalse(messageCollection.containsKey("sdk-test-message1")); - - if (messageCollection.containsKey("sdk-test-message2")) - messageCollection.remove("sdk-test-message2"); - assertFalse(messageCollection.containsKey("sdk-test-message2")); - - messageCollection.create("sdk-test-message1", "hello."); - assertTrue(messageCollection.containsKey("sdk-test-message1")); - Message message = messageCollection.get("sdk-test-message1"); - assertTrue(message.getKey().equals("sdk-test-message1")); - assertTrue(message.getValue().equals("hello.")); - - Args args2 = new Args(); - args2.put("value", "world."); - messageCollection.create("sdk-test-message2", args2); - - assertTrue(messageCollection.containsKey("sdk-test-message2")); - message = messageCollection.get("sdk-test-message2"); - assertTrue(message.getKey().equals("sdk-test-message2")); - assertTrue(message.getValue().equals("world.")); - - messageCollection.remove("sdk-test-message1"); - assertFalse(messageCollection.containsKey("sdk-test-message1")); - - messageCollection.remove("sdk-test-message2"); - assertFalse(messageCollection.containsKey("sdk-test-message2")); - } -} diff --git a/tests/com/splunk/MetadataTest.java b/tests/com/splunk/MetadataTest.java deleted file mode 100644 index d7789915..00000000 --- a/tests/com/splunk/MetadataTest.java +++ /dev/null @@ -1,75 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class MetadataTest extends SplunkTestCase { - - void checkMetadata(Entity entity) { - EntityMetadata metadata = entity.getMetadata(); - if (metadata == null) return; - metadata.canChangePermissions(); - metadata.canShareApp(); - metadata.canShareGlobal(); - metadata.canShareUser(); - metadata.canWrite(); - metadata.getApp(); - metadata.getOwner(); - metadata.getPermissions(); - metadata.getSharing(); - metadata.isModifiable(); - } - - void checkMetadata(EntityCollection entityCollection) { - for (Object entity : entityCollection.values()) - checkMetadata((Entity)entity); - } - - @Test public void testMetadata() { - Service service = connect(); - - checkMetadata(service.getApplications()); - checkMetadata(service.getDeploymentClient()); - checkMetadata(service.getDeploymentServerClasses()); - checkMetadata(service.getDeploymentTenants()); - checkMetadata(service.getDistributedConfiguration()); - checkMetadata(service.getDistributedPeers()); - checkMetadata(service.getEventTypes()); - checkMetadata(service.getFiredAlerts()); - checkMetadata(service.getIndexes()); - checkMetadata(service.getInfo()); - checkMetadata(service.getInputs()); - checkMetadata(service.getJobs()); - checkMetadata(service.getLicenseGroups()); - checkMetadata(service.getLicensePools()); - checkMetadata(service.getLicenseSlaves()); - checkMetadata(service.getLicenseStacks()); - checkMetadata(service.getLicenses()); - checkMetadata(service.getLoggers()); - checkMetadata(service.getMessages()); - checkMetadata(service.getOutputDefault()); - checkMetadata(service.getOutputGroups()); - checkMetadata(service.getOutputServers()); - checkMetadata(service.getOutputSyslogs()); - checkMetadata(service.getPasswords()); - checkMetadata(service.getRoles()); - checkMetadata(service.getSavedSearches()); - checkMetadata(service.getSettings()); - checkMetadata(service.getUsers()); - } -} diff --git a/tests/com/splunk/OutputDefaultTest.java b/tests/com/splunk/OutputDefaultTest.java deleted file mode 100644 index f5659007..00000000 --- a/tests/com/splunk/OutputDefaultTest.java +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class OutputDefaultTest extends SplunkTestCase { - @Test public void testOutputDefault() throws Exception { - Service service = connect(); - - OutputDefault outputDefault = service.getOutputDefault(); - - outputDefault.autoLb(); - outputDefault.blockOnQueueFull(); - outputDefault.getAutoLbFrequency(); - outputDefault.getDefaultGroup(); - outputDefault.getDropEventsOnQueueFull(); - outputDefault.getForwardedIndex0Whitelist(); - outputDefault.getForwardedIndex1Blacklist(); - outputDefault.getForwardedIndex2Whitelist(); - outputDefault.getHeartbeatFrequency(); - outputDefault.getMaxQueueSize(); - outputDefault.indexAndForward(); - outputDefault.isCompressed(); - outputDefault.isDisabled(); - outputDefault.isForwardedIndexFilterDisable(); - outputDefault.sendCookedData(); - } -} diff --git a/tests/com/splunk/PasswordTest.java b/tests/com/splunk/PasswordTest.java deleted file mode 100644 index 6c189369..00000000 --- a/tests/com/splunk/PasswordTest.java +++ /dev/null @@ -1,90 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class PasswordTest extends SplunkTestCase { - void checkPassword(Password password) { - password.getClearPassword(); - password.getEncryptedPassword(); - password.getPassword(); - password.getRealm(); - password.getUsername(); - } - - @Test public void testPasswords() { - Service service = connect(); - for (Password password : service.getPasswords().values()) - checkPassword(password); - } - - @Test public void testPasswordCrud() { - Service service = connect(); - - PasswordCollection passwords = service.getPasswords(); - - String name = "sdk-test"; - String value = "sdk-test-password"; - String realm = "sdk-test-realm"; - - if (passwords.containsKey(name)) - passwords.remove(name); - assertFalse(passwords.containsKey(name)); - - Password password; - - // Create a password without realm - password = passwords.create(name, value); - assertTrue(passwords.containsKey(name)); - assertEquals(password.getUsername(), name); - assertEquals(password.getClearPassword(), value); - assertEquals(password.getRealm(), null); - - Args args; - - // Update the password - args = new Args("password", "foobar"); - password.update(args); - assertTrue(passwords.containsKey(name)); - assertEquals(password.getUsername(), name); - assertEquals(password.getClearPassword(), "foobar"); - assertEquals(password.getRealm(), null); - - passwords.remove(name); - assertFalse(passwords.containsKey(name)); - - // Create a password with a realm - password = passwords.create(name, value, realm); - assertTrue(passwords.containsKey(name)); - assertEquals(password.getUsername(), name); - assertEquals(password.getClearPassword(), value); - assertEquals(password.getRealm(), realm); - - // Update the password - args = new Args("password", "bizbaz"); - password.update(args); - assertTrue(passwords.containsKey(name)); - assertEquals(password.getUsername(), name); - assertEquals(password.getClearPassword(), "bizbaz"); - assertEquals(password.getRealm(), realm); - - passwords.remove(name); - assertFalse(passwords.containsKey(name)); - } -} - diff --git a/tests/com/splunk/SavedSearchTest.java b/tests/com/splunk/SavedSearchTest.java deleted file mode 100644 index 34efa8d6..00000000 --- a/tests/com/splunk/SavedSearchTest.java +++ /dev/null @@ -1,212 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.IOException; -import org.junit.Test; - -public class SavedSearchTest extends SplunkTestCase { - @Test public void testSavedSearches() { - Service service = connect(); - - SavedSearchCollection savedSearches = service.getSavedSearches(); - - // Iterate saved searches and make sure we can read them. - for (SavedSearch savedSearch : savedSearches.values()) { - // Resource properties - savedSearch.getName(); - savedSearch.getTitle(); - savedSearch.getPath(); - - // SavedSearch properties - savedSearch.getActionEmailSendResults(); - savedSearch.getActionEmailTo(); - savedSearch.getAlertExpires(); - savedSearch.getAlertSeverity(); - savedSearch.getAlertSuppress(); - savedSearch.getAlertSuppressPeriod(); - savedSearch.getAlertTrack(); - savedSearch.getAlertComparator(); - savedSearch.getAlertCondition(); - savedSearch.getAlertThreshold(); - savedSearch.getAlertType(); - savedSearch.getCronSchedule(); - savedSearch.getDescription(); - savedSearch.getDispatchBuckets(); - savedSearch.getDispatchEarliestTime(); - savedSearch.getDispatchLatestTime(); - savedSearch.getDispatchLookups(); - savedSearch.getDispatchMaxCount(); - savedSearch.getDispatchMaxTime(); - savedSearch.getDispatchReduceFreq(); - savedSearch.getDispatchSpawnProcess(); - savedSearch.getDispatchTimeFormat(); - savedSearch.getDispatchTtl(); - savedSearch.getDisplayView(); - savedSearch.getMaxConcurrent(); - savedSearch.getRealtimeSchedule(); - savedSearch.getRequestUiDispatchApp(); - savedSearch.getRequestUiDispatchView(); - savedSearch.getRestartOnSearchPeerAdd(); - savedSearch.getRunOnStartup(); - savedSearch.getSearch(); - savedSearch.getVsid(); - savedSearch.isActionEmail(); - savedSearch.isActionPopulateLookup(); - savedSearch.isActionRss(); - savedSearch.isActioncScript(); - savedSearch.isActionSummaryIndex(); - savedSearch.isDigestMode(); - savedSearch.isDisabled(); - savedSearch.isScheduled(); - savedSearch.isVisible(); - } - } - - @Test public void testSavedSearchCrud() { - Service service = connect(); - - SavedSearchCollection savedSearches = service.getSavedSearches(); - - // Ensure test starts in a known good state - if (savedSearches.containsKey("sdk-test1")) - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - - SavedSearch savedSearch; - String search = "search index=sdk-tests * earliest=-1m"; - - // Create a saved search - savedSearch = savedSearches.create("sdk-test1", search); - assertTrue(savedSearches.containsKey("sdk-test1")); - - // Read the saved search - savedSearch = savedSearches.get("sdk-test1"); - assertEquals(savedSearch.isVisible(), true); - // CONSIDER: Test some additinal default property values. - - // Update search properties - savedSearch.update(new Args("is_visible", false)); - savedSearch.refresh(); - assertEquals(savedSearch.isVisible(), false); - - // Delete the saved search - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - - // Create a saved search with some additional arguments - savedSearch = savedSearches.create( - "sdk-test1", search, new Args("is_visible", false)); - assertEquals(savedSearch.isVisible(), false); - - // Delete the saved search - using alternative method - savedSearch.remove(); - savedSearches.refresh(); - assertFalse(savedSearches.containsKey("sdk-test1")); - } - - @Test public void testDispatch() throws IOException { - Service service = connect(); - - SavedSearchCollection savedSearches = service.getSavedSearches(); - - // Ensure test starts in a known good state - if (savedSearches.containsKey("sdk-test1")) - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - - String search = "search index=sdk-tests * earliest=-1m"; - - // Create a saved search - SavedSearch savedSearch = savedSearches.create("sdk-test1", search); - - Job job; - - // Dispatch the saved search and wait for results. - job = savedSearch.dispatch(); - wait(job); - job.getResults().close(); - job.cancel(); - - // Dispatch with some additional search options - job = savedSearch.dispatch(new Args("dispatch.buckets", 100)); - wait(job); - job.getTimeline().close(); - job.cancel(); - - // Delete the saved search - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - } - - boolean contains(Job[] history, String sid) { - for (int i = 0; i < history.length; ++i) - if (history[i].getSid().equals(sid)) - return true; - return false; - } - - @Test public void testHistory() { - Service service = connect(); - - SavedSearchCollection savedSearches = service.getSavedSearches(); - - // Ensure test starts in a known good state - if (savedSearches.containsKey("sdk-test1")) - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - - String search = "search index=sdk-tests * earliest=-1m"; - - // Create a saved search - SavedSearch savedSearch = savedSearches.create("sdk-test1", search); - - // Clear the history - even though we have a newly create saved search - // its possible there was a previous saved search with the same name - // that had a matching history. - Job[] history = savedSearch.history(); - for (Job job : history) job.cancel(); - - history = savedSearch.history(); - assertEquals(history.length, 0); - - Job job1 = savedSearch.dispatch(); - history = savedSearch.history(); - assertEquals(history.length, 1); - assertTrue(contains(history, job1.getSid())); - - Job job2 = savedSearch.dispatch(); - history = savedSearch.history(); - assertEquals(history.length, 2); - assertTrue(contains(history, job1.getSid())); - assertTrue(contains(history, job2.getSid())); - - job1.cancel(); - history = savedSearch.history(); - assertEquals(history.length, 1); - assertTrue(contains(history, job2.getSid())); - - job2.cancel(); - history = savedSearch.history(); - assertEquals(history.length, 0); - - // Delete the saved search - savedSearches.remove("sdk-test1"); - assertFalse(savedSearches.containsKey("sdk-test1")); - } -} - diff --git a/tests/com/splunk/SearchTest.java b/tests/com/splunk/SearchTest.java deleted file mode 100644 index a1cbd7fa..00000000 --- a/tests/com/splunk/SearchTest.java +++ /dev/null @@ -1,230 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.io.InputStream; -import java.io.IOException; -import org.junit.Test; - -public class SearchTest extends SplunkTestCase { - // Run the given query. - Job run(Service service, String query) { - return run(service, query, null); - } - - // Run the given query with the given query args. - Job run(Service service, String query, Args args) { - return service.getJobs().create(query, args); - } - - // Run the given query and wait for the job to complete. - Job runWait(Service service, String query) { - return runWait(service, query, null); - } - - // Run the given query with the given query args and wait for the job to - // complete. - Job runWait(Service service, String query, Args args) { - Job job = service.getJobs().create(query, args); - return wait(job); - } - - // Check retrieval of search job events. - @Test public void testEvents() throws IOException { - Service service = connect(); - - String query = "search index=sdk-tests * earliest=-1m"; - - Job job; - - job = runWait(service, query); - job.getEvents().close(); - job.cancel(); - - job = runWait(service, query); - job.getEvents(new Args("output_mode", "csv")).close(); - job.cancel(); - - job = runWait(service, query); - job.getEvents(new Args("output_mode", "json")).close(); - job.cancel(); - } - - @Test public void testExport() throws IOException { - Service service = connect(); - - String query = "search index=sdk-tests * | head 1"; - - InputStream stream; - - stream = service.export(query); - stream.close(); - - Args args; - - args = new Args("output_mode", "csv"); - stream = service.export(query, args); - stream.close(); - - args = new Args("output_mode", "json"); - stream = service.export(query, args); - stream.close(); - } - - @Test public void testParse() { - Service service = connect(); - - String query = "search index=sdk-tests * | head 1"; - - // Check simple parse. - ResponseMessage response = service.parse(query); - assertEquals(response.getStatus(), 200); - - Args parseArgs; - - // Check parse with parse_only argument. - parseArgs = new Args("parse_only", true); - service.parse(query, parseArgs); - assertEquals(response.getStatus(), 200); - - // Check parse with multiple arguments. - parseArgs = new Args(); - parseArgs.put("parse_only", false); - parseArgs.put("output_mode", "json"); - parseArgs.put("enable_lookups", true); - parseArgs.put("reload_macros", true); - service.parse(query, parseArgs); - assertEquals(response.getStatus(), 200); - } - - @Test public void testParseFail() { - String query = "syntax-error"; - - Service service = connect(); - - // Check for parse error. - try { - service.parse(query); - fail("Expected a parse error"); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 400); - } - - // Check for parse error with args. - try { - Args parseArgs = new Args(); - parseArgs.put("parse_only", false); - parseArgs.put("output_mode", "json"); - parseArgs.put("enable_lookups", true); - parseArgs.put("reload_macros", true); - service.parse(query, parseArgs); - fail("Expected a parse error"); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 400); - } - - // Check for argument error. - try { - Args parseArgs = new Args("babble", 42); - service.parse(query, parseArgs); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 400); - } - } - - // Check retrieval of search job results. - @Test public void testPreview() throws IOException { - Service service = connect(); - - String query = "search index=_internal * earliest=-1m"; - - Args args = new Args(); - args.put("field_list", "source,host,sourcetype"); - args.put("status_buckets", 100); - - Job job; - - job = run(service, query, args); - job.getResultsPreview().close(); - job.cancel(); - - job = run(service, query, args); - job.getResultsPreview(new Args("output_mode", "csv")).close(); - job.cancel(); - - job = run(service, query, args); - job.getResultsPreview(new Args("output_mode", "json")).close(); - job.cancel(); - } - - // Check retrieval of search job results. - @Test public void testResults() throws IOException { - Service service = connect(); - - String query = "search index=_internal * earliest=-1m | stats count"; - - Job job; - - job = runWait(service, query); - job.getResults().close(); - job.cancel(); - - job = runWait(service, query); - job.getResults(new Args("output_mode", "csv")).close(); - job.cancel(); - - job = runWait(service, query); - job.getResults(new Args("output_mode", "json")).close(); - job.cancel(); - } - - // Check retrieval of search log. - @Test public void testSearchLog() throws IOException { - Service service = connect(); - - String query = "search index=sdk-tests * | head 100"; - - Job job = runWait(service, query); - job.getSearchLog().close(); - job.cancel(); - } - - // Check retrieval of search job summary. - @Test public void testSummary() throws IOException { - Service service = connect(); - - String query = "search index=sdk-tests * earliest=-1m"; - - Job job = runWait(service, query, new Args("status_buckets", 100)); - job.getSummary().close(); - job.cancel(); - } - - // Check retrieval of search job timeline. - @Test public void testTimeline() throws IOException { - Service service = connect(); - - String query = "search index=sdk-tests * earliest=-1m"; - - Job job = runWait(service, query, new Args("status_buckets", 100)); - job.getTimeline().close(); - job.cancel(); - } -} diff --git a/tests/com/splunk/ServiceTest.java b/tests/com/splunk/ServiceTest.java deleted file mode 100644 index 7d86f34d..00000000 --- a/tests/com/splunk/ServiceTest.java +++ /dev/null @@ -1,308 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import java.util.Arrays; -import java.util.List; -import org.junit.Test; - -public class ServiceTest extends SplunkTestCase { - // Perform some non-intrusive inspection of the given Job object. - void checkJob(Job job) { - job.getCursorTime(); - job.getDelegate(); - job.getDiskUsage(); - job.getDispatchState(); - job.getDoneProgress(); - job.getDropCount(); - job.getEarliestTime(); - job.getEventAvailableCount(); - job.getEventCount(); - job.getEventFieldCount(); - job.getEventIsStreaming(); - job.getEventIsTruncated(); - job.getEventSearch(); - job.getEventSorting(); - job.getKeywords(); - job.getLabel(); - job.getLatestTime(); - job.getNumPreviews(); - job.getPriority(); - job.getRemoteSearch(); - job.getReportSearch(); - job.getResultCount(); - job.getResultIsStreaming(); - job.getResultPreviewCount(); - job.getRunDuration(); - job.getScanCount(); - job.getSearch(); - job.getSearchEarliestTime(); - job.getSearchLatestTime(); - job.getSid(); - job.getStatusBuckets(); - job.getTtl(); - job.isDone(); - job.isFailed(); - job.isFinalized(); - job.isPaused(); - job.isPreviewEnabled(); - job.isRealTimeSearch(); - job.isSaved(); - job.isSavedSearch(); - job.isZombie(); - assertEquals(job.getName(), job.getSid()); - } - - void checkResponse(ResponseMessage response) { - assertEquals(200, response.getStatus()); - try { - // Make sure we can at least load the Atom response - AtomFeed feed = AtomFeed.parse(response.getContent()); - } - catch (Exception e) { - fail(e.getMessage()); - } - } - - boolean contains(String[] array, String value) { - for (int i = 0; i < array.length; ++i) - if (array[i].equals(value)) return true; - return false; - } - - @Test public void testCapabilities() throws Exception { - Service service = connect(); - - List expected = Arrays.asList( - "admin_all_objects", "change_authentication", - "change_own_password", "delete_by_keyword", - "edit_deployment_client", "edit_deployment_server", - "edit_dist_peer", "edit_forwarders", "edit_httpauths", - "edit_input_defaults", "edit_monitor", "edit_roles", - "edit_scripted", "edit_search_server", "edit_server", - "edit_splunktcp", "edit_splunktcp_ssl", "edit_tcp", "edit_udp", - "edit_user", "edit_web_settings", "get_metadata", - "get_typeahead", "indexes_edit", "license_edit", "license_tab", - "list_deployment_client", "list_forwarders", "list_httpauths", - "list_inputs", "request_remote_tok", "rest_apps_management", - "rest_apps_view", "rest_properties_get", "rest_properties_set", - "restart_splunkd", "rtsearch", "schedule_search", "search", - "use_file_operator"); - - String[] caps = service.getCapabilities(); - for (String name : expected) - assertTrue(contains(caps, name)); - } - - // Make a few simple requests and make sure the results look ok. - @Test public void testGet() { - Service service = connect(); - - // Check a few paths that we know exist - String[] paths = { - "/", - "/services", - "/services/search/jobs", - "search/jobs", - "authentication/users" - }; - - for (String path : paths) - checkResponse(service.get(path)); - - // And make sure we get the expected 404 - try { - ResponseMessage response = service.get("/zippy"); - fail("Expected HttpException"); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 404); - } - } - - @Test public void testInfo() throws Exception { - Service service = connect(); - - List expected = Arrays.asList( - "build", "cpu_arch", "guid", "isFree", "isTrial", "licenseKeys", - "licenseSignature", "licenseState", "master_guid", "mode", - "os_build", "os_name", "os_version", "serverName", "version"); - - ServiceInfo info = service.getInfo(); - for (String name : expected) - assertTrue(info.containsKey(name)); - - info.getBuild(); - info.getCpuArch(); - info.getGuid(); - info.getLicenseKeys(); - info.getLicenseSignature(); - info.getLicenseState(); - info.getMasterGuid(); - info.getMode(); - info.getOsBuild(); - info.getOsVersion(); - info.getServerName(); - info.getVersion(); - info.isFree(); - info.isTrial(); - } - - @Test public void testLogin() { - ResponseMessage response; - - Service service = new Service( - command.host, - command.port, - command.scheme); - - // Not logged in, should fail with 401 - try { - response = service.get("/services/authentication/users"); - fail("Expected HttpException"); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 401); - } - - // Logged in, request should succeed - service.login(command.username, command.password); - response = service.get("/services/authentication/users"); - checkResponse(response); - - // Logout, the request should fail with a 401 - service.logout(); - try { - response = service.get("/services/authentication/users"); - fail("Expected HttpException"); - } - catch (HttpException e) { - assertEquals(e.getStatus(), 401); - } - } - - @Test public void testRestart() throws Exception { - - int retry = 10; - boolean restarted = false; - - Service service = connect(); - - ResponseMessage response = service.restart(); - assertEquals(200, response.getStatus()); - - while (retry > 0) { - Thread.sleep(5000); // 5 seconds - retry = retry-1; - try { - service = connect(); - restarted = true; - break; - } - catch (Exception e) { - // server not back yet - } - } - assertTrue(restarted); - } - - @Test public void testJobs() { - Job job; - - Service service = connect(); - - JobCollection jobs = service.getJobs(); - for (Entity entity : jobs.values()) - checkJob((Job)entity); - - job = jobs.create("search *"); - checkJob(job); - job.cancel(); - } - - @Test public void testUsers() { - Args args; - User user; - - Service service = connect(); - - String username = "sdk-user"; - String password = "changeme"; - - UserCollection users = service.getUsers(); - - // Cleanup potential prior failed test run. - users.remove(username); - assertFalse(users.containsKey(username)); - - // Create user using base create method - args = new Args(); - args.put("password", password); - args.put("roles", "power"); - user = users.create(username, args); - assertTrue(users.containsKey(username)); - assertEquals(user.getName(), username); - assertTrue(user.getRoles().length == 1); - assertTrue(contains(user.getRoles(), "power")); - - users.remove(username); - assertFalse(users.containsKey(username)); - - // Create user using derived create method - user = users.create(username, password, "power"); - assertTrue(users.containsKey(username)); - assertEquals(user.getName(), username); - assertTrue(user.getRoles().length == 1); - assertTrue(contains(user.getRoles(), "power")); - - users.remove(username); - assertFalse(users.containsKey(username)); - - // Create using derived method with multiple roles - user = users.create( - username, password, new String[] { "power", "user" }); - assertTrue(users.containsKey(username)); - assertEquals(user.getName(), username); - assertTrue(user.getRoles().length == 2); - assertTrue(contains(user.getRoles(), "power")); - assertTrue(contains(user.getRoles(), "user")); - - users.remove(username); - assertFalse(users.containsKey(username)); - - // Create using drived method with multiple roles and extra properties - args = new Args(); - args.put("realname", "Renzo"); - args.put("email", "email.me@now.com"); - args.put("defaultApp", "search"); - user = users.create( - username, password, new String[] { "power", "user" }, args); - assertTrue(users.containsKey(username)); - assertEquals(user.getName(), username); - assertTrue(user.getRoles().length == 2); - assertTrue(contains(user.getRoles(), "power")); - assertTrue(contains(user.getRoles(), "user")); - assertEquals(user.getRealName(), "Renzo"); - assertEquals(user.getEmail(), "email.me@now.com"); - assertEquals(user.getDefaultApp(), "search"); - user.getTz(); - - users.remove(username); - assertFalse(users.containsKey(username)); - } -} - diff --git a/tests/com/splunk/SettingsTest.java b/tests/com/splunk/SettingsTest.java deleted file mode 100644 index c90a16a5..00000000 --- a/tests/com/splunk/SettingsTest.java +++ /dev/null @@ -1,38 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import org.junit.Test; - -public class SettingsTest extends SplunkTestCase { - @Test public void testSettings() { - Service service = connect(); - Settings settings = service.getSettings(); - settings.getSplunkDB(); - settings.getSplunkHome(); - settings.getEnableSplunkWebSSL(); - settings.getHost(); - settings.getHttpPort(); - settings.getMgmtPort(); - settings.getMinFreeSpace(); - settings.getPass4SymmKey(); - settings.getServerName(); - settings.getSessionTimeout(); - settings.getStartWebServer(); - settings.getTrustedIP(); - } -} diff --git a/tests/com/splunk/SplunkTestCase.java b/tests/com/splunk/SplunkTestCase.java deleted file mode 100644 index 2be8e652..00000000 --- a/tests/com/splunk/SplunkTestCase.java +++ /dev/null @@ -1,112 +0,0 @@ -/* - * Copyright 2011 Splunk, Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"): you may - * not use this file except in compliance with the License. You may obtain - * a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ - -package com.splunk; - -import com.splunk.sdk.Command; - -import junit.framework.TestCase; -import org.junit.Before; - -// Shared base class for Splunk SDK unit tests, contains common unit setup -// and a collection of helper functions. -public class SplunkTestCase extends TestCase { - Command command; - - public SplunkTestCase() {} - - Service connect() { - return Service.connect(command.opts); - } - - // Create a fresh test app with the given name, delete the existing - // test app and reboot Splunk if needed. - void createApp(String name) { - EntityCollection apps; - - Service service = connect(); - - apps = service.getApplications(); - if (apps.containsKey(name)) { - apps.remove(name); - service = restart(); - } - - apps = service.getApplications(); - assertFalse(apps.containsKey(name)); - - apps.create(name); - service = restart(); - - apps = service.getApplications(); - assertTrue(apps.containsKey(name)); - } - - // Remove the given app and reboot Splunk if needed. - void removeApp(String name) { - EntityCollection apps; - - Service service = connect(); - - apps = service.getApplications(); - if (apps.containsKey(name)) { - apps.remove(name); - service = restart(); - } - - apps = service.getApplications(); - assertFalse(apps.containsKey(name)); - } - - // Restart Splunk and return an updated service instance. - Service restart() { - Service service = connect(); - service.restart(); - sleep(5000); - int retry = 15; - while (retry > 0) { - try { - return connect(); - } - catch (Exception e) { - sleep(2000); - } - } - fail("Splunk service failed to restart"); - return null; - } - - @Before public void setUp() { - command = Command.splunk(); // Pick up .splunkrc settings - } - - void sleep(int millis) { - try { - Thread.sleep(millis); - } - catch (InterruptedException e) {} - } - - // Wait for the given job to complete - Job wait(Job job) { - while (!job.isDone()) { - try { Thread.sleep(2000); } - catch (InterruptedException e) {} - job.refresh(); - } - return job; - } -} diff --git a/tests/com/splunk/testfile.txt b/tests/com/splunk/testfile.txt deleted file mode 100644 index cee7a927..00000000 --- a/tests/com/splunk/testfile.txt +++ /dev/null @@ -1 +0,0 @@ -Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/tests/tests.iml b/tests/tests.iml deleted file mode 100644 index 37a7c153..00000000 --- a/tests/tests.iml +++ /dev/null @@ -1,23 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - -