Search in sources :

Example 1 with SavedSearch

use of com.splunk.SavedSearch in project camel by apache.

the class SplunkDataReader method savedSearch.

private List<SplunkEvent> savedSearch(SplunkResultProcessor callback) throws Exception {
    LOG.trace("saved search start");
    ServiceArgs queryArgs = new ServiceArgs();
    queryArgs.setApp("search");
    if (ObjectHelper.isNotEmpty(endpoint.getConfiguration().getOwner())) {
        queryArgs.setOwner(endpoint.getConfiguration().getOwner());
    }
    if (ObjectHelper.isNotEmpty(endpoint.getConfiguration().getApp())) {
        queryArgs.setApp(endpoint.getConfiguration().getApp());
    }
    Calendar startTime = Calendar.getInstance();
    SavedSearch search = null;
    Job job = null;
    String latestTime = getLatestTime(startTime, false);
    String earliestTime = getEarliestTime(startTime, false);
    Service service = endpoint.getService();
    SavedSearchCollection savedSearches = service.getSavedSearches(queryArgs);
    for (SavedSearch s : savedSearches.values()) {
        if (s.getName().equals(getSavedSearch())) {
            search = s;
            break;
        }
    }
    if (search != null) {
        SavedSearchDispatchArgs args = new SavedSearchDispatchArgs();
        args.setForceDispatch(true);
        args.setDispatchEarliestTime(earliestTime);
        args.setDispatchLatestTime(latestTime);
        job = search.dispatch(args);
    } else {
        throw new RuntimeException("Unable to find saved search '" + getSavedSearch() + "'.");
    }
    while (!job.isDone()) {
        Thread.sleep(2000);
    }
    List<SplunkEvent> data = extractData(job, false, callback);
    this.lastSuccessfulReadTime = startTime;
    return data;
}
Also used : SavedSearchCollection(com.splunk.SavedSearchCollection) SplunkEvent(org.apache.camel.component.splunk.event.SplunkEvent) ServiceArgs(com.splunk.ServiceArgs) SavedSearch(com.splunk.SavedSearch) Calendar(java.util.Calendar) Service(com.splunk.Service) SavedSearchDispatchArgs(com.splunk.SavedSearchDispatchArgs) Job(com.splunk.Job)

Aggregations

Job (com.splunk.Job)1 SavedSearch (com.splunk.SavedSearch)1 SavedSearchCollection (com.splunk.SavedSearchCollection)1 SavedSearchDispatchArgs (com.splunk.SavedSearchDispatchArgs)1 Service (com.splunk.Service)1 ServiceArgs (com.splunk.ServiceArgs)1 Calendar (java.util.Calendar)1 SplunkEvent (org.apache.camel.component.splunk.event.SplunkEvent)1