rsplunk 0.3.1 → 0.4.0
Sign up to get free protection for your applications and to get access to all the features.
- data/Manifest.txt +1 -2
- data/README.txt +14 -7
- data/Rakefile +2 -4
- data/lib/rsplunk/api_error.rb +3 -1
- data/lib/rsplunk/client.rb +3 -3
- data/lib/rsplunk/search.rb +27 -9
- data/lib/rsplunk.rb +1 -1
- metadata +28 -18
- data/bin/rsplunk +0 -1
- data/test/test_rsplunk.rb +0 -2
data/Manifest.txt
CHANGED
data/README.txt
CHANGED
@@ -2,11 +2,8 @@
|
|
2
2
|
|
3
3
|
== DESCRIPTION:
|
4
4
|
|
5
|
-
|
6
|
-
|
7
|
-
== SYNOPSIS:
|
8
|
-
|
9
|
-
require 'rsplunk'
|
5
|
+
rSplunk is a Splunk (http://www.splunk.com) API wrapper. To use this gem, you will need access
|
6
|
+
to a Splunk server.
|
10
7
|
|
11
8
|
=== To create a Splunk instance
|
12
9
|
Rsplunk.set('HOST', PORT)
|
@@ -20,11 +17,19 @@ splunk = Rsplunk::Client.new(:username => 'USERNAME', :password => 'PASSWORD')
|
|
20
17
|
splunk.list_jobs
|
21
18
|
|
22
19
|
=== To create a job:
|
23
|
-
splunk.create_job('SEARCH TERM', options)
|
20
|
+
splunk.create_job('search SEARCH TERM', options)
|
24
21
|
=> "1334848433.7828"
|
25
22
|
|
26
23
|
Where, "1334848433.7828" is the Search ID returned from the job.
|
27
24
|
|
25
|
+
I elected not to append 'search' automagically to the beginning of a job because you may need to create
|
26
|
+
different jobs other than a direct 'search'. Splunk UI does this automatically when using its interface.
|
27
|
+
So a valid 'search' job would look like 'search 404:error host="www.benwoodall.com"'
|
28
|
+
|
29
|
+
By default, a search with no 'earliest_time' option is set to '-15m' to only search the last 15 minutes.
|
30
|
+
To change this:
|
31
|
+
splunk.create_job('search SEARCH TERM', ":earlist_time => '-60m'")
|
32
|
+
|
28
33
|
Available options can be found at:
|
29
34
|
http://docs.splunk.com/Documentation/Splunk/4.2.2/RESTAPI/RESTsearch#POST_search.2Fjobs
|
30
35
|
|
@@ -35,13 +40,15 @@ splunk.job_results(res)
|
|
35
40
|
== REQUIREMENTS:
|
36
41
|
|
37
42
|
Access to a working Splunk environment.
|
43
|
+
* faraday
|
44
|
+
* faraday_middleware
|
38
45
|
|
39
46
|
== INSTALL:
|
40
47
|
|
41
48
|
gem install rsplunk
|
42
49
|
|
43
50
|
== Upcoming Features:
|
44
|
-
|
51
|
+
* include ALL THE ENDPOINTS!
|
45
52
|
|
46
53
|
== Contributing to rSplunk
|
47
54
|
|
data/Rakefile
CHANGED
data/lib/rsplunk/api_error.rb
CHANGED
data/lib/rsplunk/client.rb
CHANGED
@@ -32,7 +32,9 @@ module Rsplunk
|
|
32
32
|
end
|
33
33
|
end
|
34
34
|
|
35
|
-
|
35
|
+
private
|
36
|
+
|
37
|
+
# This is created in Rsplunk.set
|
36
38
|
def api_url
|
37
39
|
"https://#{$host}:#{$port}/services/"
|
38
40
|
end
|
@@ -46,8 +48,6 @@ module Rsplunk
|
|
46
48
|
end
|
47
49
|
end
|
48
50
|
|
49
|
-
private
|
50
|
-
|
51
51
|
def default_headers
|
52
52
|
headers = {
|
53
53
|
:user_agent => "rSplunk"
|
data/lib/rsplunk/search.rb
CHANGED
@@ -1,33 +1,51 @@
|
|
1
1
|
module Rsplunk
|
2
2
|
module Search
|
3
3
|
|
4
|
+
# RETURN ALL THE JOBS!
|
5
|
+
#
|
4
6
|
# Returns an XML with all of the current running jobs
|
5
|
-
|
6
|
-
|
7
|
-
|
7
|
+
# Valid options for this are for output format:
|
8
|
+
# :output_mode => 'csv | raw | xml | json'
|
9
|
+
def list_jobs(options = {})
|
10
|
+
response = connection.get do |req|
|
11
|
+
req.url ('search/jobs')
|
12
|
+
req.body = options
|
13
|
+
end
|
14
|
+
return_error_or_body(response, response)
|
8
15
|
end
|
9
16
|
|
10
17
|
# Create a job
|
11
18
|
#
|
12
19
|
# 'query' is the search string you are passing to Splunk
|
13
20
|
# 'options' can be found at http://docs.splunk.com/Documentation/Splunk/4.2.2/RESTAPI/RESTsearch#POST_search.2Fjobs
|
14
|
-
#
|
15
21
|
def create_job(query, options={})
|
22
|
+
search = "#{query}"
|
16
23
|
options[:earliest_time] ||= '-15m'
|
17
24
|
[:earliest_time, :latest_time, :time].each { |t| options[t] = format_time(options[t]) if options[t] }
|
18
25
|
response = connection.post do |req|
|
19
26
|
req.url 'search/jobs'
|
20
|
-
req.body = { :search => "
|
27
|
+
req.body = { :search => "#{search}" }.merge(options)
|
21
28
|
end
|
22
|
-
return_error_or_body(response, response.body)
|
29
|
+
return_error_or_body(response, response.body["response"]["sid"])
|
23
30
|
end
|
24
31
|
|
25
|
-
|
26
|
-
|
27
|
-
|
32
|
+
|
33
|
+
# Return results
|
34
|
+
#
|
35
|
+
# Gives the results from a job using the job SID.
|
36
|
+
# Valid options for this are for output format:
|
37
|
+
# :output_mode => 'csv | raw | xml | json'
|
38
|
+
def job_results(sid, options = {})
|
39
|
+
response = connection.get do |req|
|
40
|
+
req.url "search/jobs/#{sid}/results"
|
41
|
+
req.body = options
|
42
|
+
end
|
28
43
|
return_error_or_body(response, response.body)
|
29
44
|
end
|
30
45
|
|
46
|
+
# Delete job
|
47
|
+
#
|
48
|
+
# Delete a running or saved job using the job SID
|
31
49
|
def delete_job(sid)
|
32
50
|
response = connection.delete("search/jobs/#{sid}")
|
33
51
|
return_error_or_body(response, response.body)
|
data/lib/rsplunk.rb
CHANGED
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rsplunk
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.4.0
|
5
5
|
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
@@ -9,22 +9,33 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2012-
|
12
|
+
date: 2012-05-21 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
|
-
name:
|
16
|
-
requirement: &
|
15
|
+
name: faraday
|
16
|
+
requirement: &74273600 !ruby/object:Gem::Requirement
|
17
17
|
none: false
|
18
18
|
requirements:
|
19
19
|
- - ~>
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version: 0.8.
|
21
|
+
version: 0.8.0
|
22
22
|
type: :runtime
|
23
23
|
prerelease: false
|
24
|
-
version_requirements: *
|
24
|
+
version_requirements: *74273600
|
25
|
+
- !ruby/object:Gem::Dependency
|
26
|
+
name: faraday_middleware
|
27
|
+
requirement: &74273340 !ruby/object:Gem::Requirement
|
28
|
+
none: false
|
29
|
+
requirements:
|
30
|
+
- - ~>
|
31
|
+
- !ruby/object:Gem::Version
|
32
|
+
version: 0.8.7
|
33
|
+
type: :runtime
|
34
|
+
prerelease: false
|
35
|
+
version_requirements: *74273340
|
25
36
|
- !ruby/object:Gem::Dependency
|
26
37
|
name: rdoc
|
27
|
-
requirement: &
|
38
|
+
requirement: &74273040 !ruby/object:Gem::Requirement
|
28
39
|
none: false
|
29
40
|
requirements:
|
30
41
|
- - ~>
|
@@ -32,10 +43,10 @@ dependencies:
|
|
32
43
|
version: '3.10'
|
33
44
|
type: :development
|
34
45
|
prerelease: false
|
35
|
-
version_requirements: *
|
46
|
+
version_requirements: *74273040
|
36
47
|
- !ruby/object:Gem::Dependency
|
37
48
|
name: hoe
|
38
|
-
requirement: &
|
49
|
+
requirement: &74272750 !ruby/object:Gem::Requirement
|
39
50
|
none: false
|
40
51
|
requirements:
|
41
52
|
- - ~>
|
@@ -43,12 +54,14 @@ dependencies:
|
|
43
54
|
version: '3.0'
|
44
55
|
type: :development
|
45
56
|
prerelease: false
|
46
|
-
version_requirements: *
|
47
|
-
description:
|
57
|
+
version_requirements: *74272750
|
58
|
+
description: ! 'rSplunk is a Splunk (http://www.splunk.com) API wrapper. To use this
|
59
|
+
gem, you will need access
|
60
|
+
|
61
|
+
to a Splunk server.'
|
48
62
|
email:
|
49
63
|
- mail@benwoodall.com
|
50
|
-
executables:
|
51
|
-
- rsplunk
|
64
|
+
executables: []
|
52
65
|
extensions: []
|
53
66
|
extra_rdoc_files:
|
54
67
|
- History.txt
|
@@ -59,14 +72,12 @@ files:
|
|
59
72
|
- Manifest.txt
|
60
73
|
- README.txt
|
61
74
|
- Rakefile
|
62
|
-
- bin/rsplunk
|
63
75
|
- lib/rsplunk.rb
|
64
76
|
- lib/rsplunk/api_error.rb
|
65
77
|
- lib/rsplunk/client.rb
|
66
78
|
- lib/rsplunk/search.rb
|
67
79
|
- spec/spec_helper.rb
|
68
80
|
- spec/rsplunk_spec.rb
|
69
|
-
- test/test_rsplunk.rb
|
70
81
|
- .gemtest
|
71
82
|
homepage:
|
72
83
|
licenses: []
|
@@ -93,6 +104,5 @@ rubyforge_project: rsplunk
|
|
93
104
|
rubygems_version: 1.8.11
|
94
105
|
signing_key:
|
95
106
|
specification_version: 3
|
96
|
-
summary:
|
97
|
-
test_files:
|
98
|
-
- test/test_rsplunk.rb
|
107
|
+
summary: rSplunk is a Splunk (http://www.splunk.com) API wrapper
|
108
|
+
test_files: []
|
data/bin/rsplunk
DELETED
@@ -1 +0,0 @@
|
|
1
|
-
#!/usr/bin/env ruby
|
data/test/test_rsplunk.rb
DELETED