grunk 0.0.4 → 0.0.5
Sign up to get free protection for your applications and to get access to all the features.
- data/bin/grunk +36 -22
- metadata +1 -1
data/bin/grunk
CHANGED
@@ -3,22 +3,22 @@ require 'rubygems'
|
|
3
3
|
require 'splunk-sdk-ruby'
|
4
4
|
require 'json'
|
5
5
|
require 'getopt/std'
|
6
|
+
require 'pp'
|
6
7
|
|
7
8
|
options = Hash.new
|
8
9
|
options[:time] = false
|
9
10
|
options[:show_source] = false
|
10
|
-
options[:max_results] = 30
|
11
11
|
options[:earliest_time] = '-1d'
|
12
12
|
options[:latest_time] = 'now'
|
13
13
|
|
14
|
-
opt = Getopt::Std.getopts "sdom:
|
14
|
+
opt = Getopt::Std.getopts "sdom:e:l:"
|
15
15
|
|
16
|
-
if opt["
|
17
|
-
options[:latest_time] = opt["
|
16
|
+
if opt["l"]
|
17
|
+
options[:latest_time] = opt["l"]
|
18
18
|
end
|
19
19
|
|
20
|
-
if opt["
|
21
|
-
options[:earliest_time] = opt["
|
20
|
+
if opt["e"]
|
21
|
+
options[:earliest_time] = opt["e"]
|
22
22
|
end
|
23
23
|
|
24
24
|
if opt["s"]
|
@@ -33,27 +33,41 @@ if opt["o"]
|
|
33
33
|
options[:show_host] = true
|
34
34
|
end
|
35
35
|
|
36
|
-
if opt["m"]
|
37
|
-
options[:max_results] = opt["m"].to_i
|
38
|
-
end
|
39
|
-
|
40
36
|
rc_file = File.new(File.expand_path('~/.splunkrc'), "r")
|
41
37
|
$config = eval(rc_file.read)
|
42
38
|
|
43
39
|
service = Splunk::Service.new $config
|
44
40
|
service.login
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
41
|
+
job = service.create_search "search #{ARGV[0]}", :earliest_time => options[:earliest_time], :latest_time => options[:latest_time]
|
42
|
+
|
43
|
+
while !job.is_ready?
|
44
|
+
sleep 0.1
|
45
|
+
end
|
46
|
+
|
47
|
+
results_offset = 0
|
48
|
+
finished = false
|
49
|
+
|
50
|
+
until finished
|
51
|
+
if job.is_done?
|
52
|
+
finished=true
|
53
|
+
stream = job.results(:offset => results_offset, :count => 0)
|
54
|
+
else
|
55
|
+
stream = job.preview(:offset => results_offset, :count => 0)
|
56
56
|
end
|
57
|
+
|
58
|
+
results = Splunk::ResultsReader.new stream
|
59
|
+
results.each do |result|
|
60
|
+
results_offset = results_offset + 1
|
61
|
+
print "#{result["_time"]}: " if options[:time]
|
62
|
+
if options[:show_host] || options[:show_source]
|
63
|
+
print "("
|
64
|
+
print result["host"] if options[:show_host]
|
65
|
+
print ":" if options[:show_host] && options[:show_source]
|
66
|
+
print result["source"] if options[:show_source]
|
67
|
+
print ") "
|
68
|
+
end
|
57
69
|
|
58
|
-
|
70
|
+
puts result["_raw"]
|
71
|
+
end
|
72
|
+
sleep 1
|
59
73
|
end
|