ruby-splunk 0.0.1

data/lib/splunk.rb

@@ -0,0 +1,69 @@
+# Splunk API for Ruby
+require 'net/http'
+require 'nokogiri'
+require 'nori'
+require 'uri'
+
+Nori.parser = :nokogiri
+
+module Splunk
+
+class Splunk
+  def initialize(splunk_uri,user,password)
+    @uri = splunk_uri 
+    res = Nokogiri::XML(api_request("#{@uri}/auth/login", 'username' => user, 'password' => password).body)
+    @session_key = res.xpath('/response/sessionKey')[0].content
+  end
+  
+  def search(search, *data)
+    search = "search #{search}"
+    data[0]["search"] = search
+    xml = Nori.parse api_request("#{@uri}/search/jobs/export", *data).body
+    raise "Search failed: #{xml["response"]["messages"]["msg"]}" if xml.has_key? "response"
+    ret = Array.new
+    xml["results"]["result"].each do |result|
+      rres = Hash.new
+      result["field"].each do |field|
+        if field.has_key? "@k"
+          case field["@k"]
+          when '_raw'
+            rres[:"#{field["@k"]}"] = field["v"].to_s
+          when '_si'
+            # FIXME do nothing - we don't handle this yet
+          else
+            case field["@k"]
+            when '_time'
+              rres[:"#{field["@k"]}"] = Time.parse field["value"]["text"].to_s 
+            else
+              rres[:"#{field["@k"]}"] = field["value"]["text"].to_s
+            end
+          end
+        end
+      end
+      ret << rres
+    end
+    ret
+  end
+
+  private 
+  
+  def api_request(uri, *data)
+    endpoint = URI.parse(uri)
+    http = Net::HTTP.new endpoint.host, endpoint.port
+    if endpoint.scheme == 'https'
+      http.use_ssl = true
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    end
+    
+    req = Net::HTTP::Post.new(endpoint.path)
+    
+    if @session_key
+      req['Authorization'] = "Splunk #{@session_key}"
+    end
+
+    req.set_form_data(*data)
+    http.request req
+  end
+end
+
+end

metadata

@@ -0,0 +1,47 @@
+--- !ruby/object:Gem::Specification
+name: ruby-splunk
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+  prerelease: 
+platform: ruby
+authors:
+- Andrew Beresford
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-04-23 00:00:00.000000000 +01:00
+default_executable: 
+dependencies: []
+description: Splunk API Library for Ruby
+email: beezly@beez.ly
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/splunk.rb
+has_rdoc: true
+homepage: http://github.com/beezly/ruby-splunk
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.6.2
+signing_key: 
+specification_version: 3
+summary: Splunk API Library
+test_files: []