grunk 0.0.4 → 0.0.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (2) hide show
  1. data/bin/grunk +36 -22
  2. metadata +1 -1
data/bin/grunk CHANGED
@@ -3,22 +3,22 @@ require 'rubygems'
3
3
  require 'splunk-sdk-ruby'
4
4
  require 'json'
5
5
  require 'getopt/std'
6
+ require 'pp'
6
7
 
7
8
  options = Hash.new
8
9
  options[:time] = false
9
10
  options[:show_source] = false
10
- options[:max_results] = 30
11
11
  options[:earliest_time] = '-1d'
12
12
  options[:latest_time] = 'now'
13
13
 
14
- opt = Getopt::Std.getopts "sdom:f:t:"
14
+ opt = Getopt::Std.getopts "sdom:e:l:"
15
15
 
16
- if opt["t"]
17
- options[:latest_time] = opt["t"]
16
+ if opt["l"]
17
+ options[:latest_time] = opt["l"]
18
18
  end
19
19
 
20
- if opt["f"]
21
- options[:earliest_time] = opt["f"]
20
+ if opt["e"]
21
+ options[:earliest_time] = opt["e"]
22
22
  end
23
23
 
24
24
  if opt["s"]
@@ -33,27 +33,41 @@ if opt["o"]
33
33
  options[:show_host] = true
34
34
  end
35
35
 
36
- if opt["m"]
37
- options[:max_results] = opt["m"].to_i
38
- end
39
-
40
36
  rc_file = File.new(File.expand_path('~/.splunkrc'), "r")
41
37
  $config = eval(rc_file.read)
42
38
 
43
39
  service = Splunk::Service.new $config
44
40
  service.login
45
- stream = service.create_oneshot "search #{ARGV[0]}", max_results: options[:max_results], earliest_time: options[:earliest_time], latest_time: options['latest_time']
46
- results = Splunk::ResultsReader.new stream
47
-
48
- results.each do |result|
49
- print "#{result["_time"]}: " if options[:time]
50
- if options[:show_host] || options[:show_source]
51
- print "("
52
- print result["host"] if options[:show_host]
53
- print ":" if options[:show_host] && options[:show_source]
54
- print result["source"] if options[:show_source]
55
- print ") "
41
+ job = service.create_search "search #{ARGV[0]}", :earliest_time => options[:earliest_time], :latest_time => options[:latest_time]
42
+
43
+ while !job.is_ready?
44
+ sleep 0.1
45
+ end
46
+
47
+ results_offset = 0
48
+ finished = false
49
+
50
+ until finished
51
+ if job.is_done?
52
+ finished=true
53
+ stream = job.results(:offset => results_offset, :count => 0)
54
+ else
55
+ stream = job.preview(:offset => results_offset, :count => 0)
56
56
  end
57
+
58
+ results = Splunk::ResultsReader.new stream
59
+ results.each do |result|
60
+ results_offset = results_offset + 1
61
+ print "#{result["_time"]}: " if options[:time]
62
+ if options[:show_host] || options[:show_source]
63
+ print "("
64
+ print result["host"] if options[:show_host]
65
+ print ":" if options[:show_host] && options[:show_source]
66
+ print result["source"] if options[:show_source]
67
+ print ") "
68
+ end
57
69
 
58
- puts result["_raw"]
70
+ puts result["_raw"]
71
+ end
72
+ sleep 1
59
73
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: grunk
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.4
4
+ version: 0.0.5
5
5
  prerelease:
6
6
  platform: ruby
7
7
  authors: