splunk-sdk-ruby 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (81) hide show
  1. data/CHANGELOG.md +160 -0
  2. data/Gemfile +8 -0
  3. data/LICENSE +177 -0
  4. data/README.md +310 -0
  5. data/Rakefile +40 -0
  6. data/examples/1_connect.rb +51 -0
  7. data/examples/2_manage.rb +103 -0
  8. data/examples/3_blocking_searches.rb +82 -0
  9. data/examples/4_asynchronous_searches.rb +79 -0
  10. data/examples/5_stream_data_to_splunk.rb +79 -0
  11. data/lib/splunk-sdk-ruby.rb +47 -0
  12. data/lib/splunk-sdk-ruby/ambiguous_entity_reference.rb +28 -0
  13. data/lib/splunk-sdk-ruby/atomfeed.rb +323 -0
  14. data/lib/splunk-sdk-ruby/collection.rb +417 -0
  15. data/lib/splunk-sdk-ruby/collection/apps.rb +35 -0
  16. data/lib/splunk-sdk-ruby/collection/case_insensitive_collection.rb +58 -0
  17. data/lib/splunk-sdk-ruby/collection/configuration_file.rb +50 -0
  18. data/lib/splunk-sdk-ruby/collection/configurations.rb +80 -0
  19. data/lib/splunk-sdk-ruby/collection/jobs.rb +136 -0
  20. data/lib/splunk-sdk-ruby/collection/messages.rb +51 -0
  21. data/lib/splunk-sdk-ruby/context.rb +522 -0
  22. data/lib/splunk-sdk-ruby/entity.rb +260 -0
  23. data/lib/splunk-sdk-ruby/entity/index.rb +191 -0
  24. data/lib/splunk-sdk-ruby/entity/job.rb +339 -0
  25. data/lib/splunk-sdk-ruby/entity/message.rb +36 -0
  26. data/lib/splunk-sdk-ruby/entity/saved_search.rb +71 -0
  27. data/lib/splunk-sdk-ruby/entity/stanza.rb +45 -0
  28. data/lib/splunk-sdk-ruby/entity_not_ready.rb +26 -0
  29. data/lib/splunk-sdk-ruby/illegal_operation.rb +27 -0
  30. data/lib/splunk-sdk-ruby/namespace.rb +239 -0
  31. data/lib/splunk-sdk-ruby/resultsreader.rb +716 -0
  32. data/lib/splunk-sdk-ruby/service.rb +339 -0
  33. data/lib/splunk-sdk-ruby/splunk_http_error.rb +49 -0
  34. data/lib/splunk-sdk-ruby/synonyms.rb +50 -0
  35. data/lib/splunk-sdk-ruby/version.rb +27 -0
  36. data/lib/splunk-sdk-ruby/xml_shim.rb +117 -0
  37. data/splunk-sdk-ruby.gemspec +27 -0
  38. data/test/atom_test_data.rb +472 -0
  39. data/test/data/atom/atom_feed_with_message.xml +19 -0
  40. data/test/data/atom/atom_with_feed.xml +99 -0
  41. data/test/data/atom/atom_with_several_entries.xml +101 -0
  42. data/test/data/atom/atom_with_simple_entries.xml +30 -0
  43. data/test/data/atom/atom_without_feed.xml +248 -0
  44. data/test/data/export/4.2.5/export_results.xml +88 -0
  45. data/test/data/export/4.3.5/export_results.xml +87 -0
  46. data/test/data/export/5.0.1/export_results.xml +78 -0
  47. data/test/data/export/5.0.1/nonreporting.xml +232 -0
  48. data/test/data/results/4.2.5/results-empty.xml +0 -0
  49. data/test/data/results/4.2.5/results-preview.xml +255 -0
  50. data/test/data/results/4.2.5/results.xml +336 -0
  51. data/test/data/results/4.3.5/results-empty.xml +0 -0
  52. data/test/data/results/4.3.5/results-preview.xml +1057 -0
  53. data/test/data/results/4.3.5/results.xml +626 -0
  54. data/test/data/results/5.0.2/results-empty.xml +1 -0
  55. data/test/data/results/5.0.2/results-empty_preview.xml +1 -0
  56. data/test/data/results/5.0.2/results-preview.xml +448 -0
  57. data/test/data/results/5.0.2/results.xml +501 -0
  58. data/test/export_test_data.json +360 -0
  59. data/test/resultsreader_test_data.json +1119 -0
  60. data/test/services.server.info.xml +43 -0
  61. data/test/services.xml +111 -0
  62. data/test/test_atomfeed.rb +71 -0
  63. data/test/test_collection.rb +278 -0
  64. data/test/test_configuration_file.rb +124 -0
  65. data/test/test_context.rb +119 -0
  66. data/test/test_entity.rb +95 -0
  67. data/test/test_helper.rb +250 -0
  68. data/test/test_http_error.rb +52 -0
  69. data/test/test_index.rb +91 -0
  70. data/test/test_jobs.rb +319 -0
  71. data/test/test_messages.rb +17 -0
  72. data/test/test_namespace.rb +188 -0
  73. data/test/test_restarts.rb +49 -0
  74. data/test/test_resultsreader.rb +106 -0
  75. data/test/test_roles.rb +41 -0
  76. data/test/test_saved_searches.rb +119 -0
  77. data/test/test_service.rb +65 -0
  78. data/test/test_users.rb +33 -0
  79. data/test/test_xml_shim.rb +28 -0
  80. data/test/testfile.txt +1 -0
  81. metadata +200 -0
data/test/data/results/4.2.5/results-empty.xml ADDED
File without changes
data/test/data/results/4.2.5/results-preview.xml ADDED
@@ -0,0 +1,255 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <results preview='1'>
3
+ <meta>
4
+ <fieldOrder>
5
+ <field>_indextime</field>
6
+ <field>_kv</field>
7
+ <field>_raw</field>
8
+ <field>_serial</field>
9
+ <field>_sourcetype</field>
10
+ <field>_subsecond</field>
11
+ <field>_time</field>
12
+ <field>active_streams</field>
13
+ <field>blocking</field>
14
+ <field>bytes</field>
15
+ <field>client_app</field>
16
+ <field>clientip</field>
17
+ <field>component</field>
18
+ <field>count</field>
19
+ <field>date_hour</field>
20
+ <field>date_mday</field>
21
+ <field>date_minute</field>
22
+ <field>date_month</field>
23
+ <field>date_second</field>
24
+ <field>date_wday</field>
25
+ <field>date_year</field>
26
+ <field>date_zone</field>
27
+ <field>display_row_numbers</field>
28
+ <field>earliest</field>
29
+ <field>enable_event_actions</field>
30
+ <field>enable_field_actions</field>
31
+ <field>entity_name</field>
32
+ <field>eventtype</field>
33
+ <field>field_list</field>
34
+ <field>file</field>
35
+ <field>fillcontents</field>
36
+ <field>filter</field>
37
+ <field>host</field>
38
+ <field>ident</field>
39
+ <field>index</field>
40
+ <field>length</field>
41
+ <field>linecount</field>
42
+ <field>log_level</field>
43
+ <field>max_block_secs</field>
44
+ <field>max_lines</field>
45
+ <field>max_lines_constraint</field>
46
+ <field>max_pages</field>
47
+ <field>message</field>
48
+ <field>method</field>
49
+ <field>min_freq</field>
50
+ <field>min_lines</field>
51
+ <field>offset</field>
52
+ <field>other</field>
53
+ <field>output_mode</field>
54
+ <field>output_time_format</field>
55
+ <field>punct</field>
56
+ <field>q</field>
57
+ <field>queue_size</field>
58
+ <field>referer</field>
59
+ <field>referer_domain</field>
60
+ <field>req_time</field>
61
+ <field>reverse_order</field>
62
+ <field>root</field>
63
+ <field>s</field>
64
+ <field>segmentation</field>
65
+ <field>show_empty_fields</field>
66
+ <field>sid</field>
67
+ <field>source</field>
68
+ <field>sourcetype</field>
69
+ <field>spent</field>
70
+ <field>splunk_server</field>
71
+ <field>status</field>
72
+ <field>time_format</field>
73
+ <field>timeendpos</field>
74
+ <field>timestartpos</field>
75
+ <field>truncation_mode</field>
76
+ <field>uri</field>
77
+ <field>uri_path</field>
78
+ <field>uri_query</field>
79
+ <field>user</field>
80
+ <field>useragent</field>
81
+ <field>version</field>
82
+ </fieldOrder>
83
+ </meta>
84
+ <result offset='0'>
85
+ <field k='_indextime'>
86
+ <value><text>1355947338</text></value>
87
+ </field>
88
+ <field k='_kv'>
89
+ <value><text>1</text></value>
90
+ </field>
91
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 12:02:18.172 -0800 INFO IndexProcessor - rtsearch connection established, filter = &apos;[ AND <sg h='1'>index::_internal</sg> <sg h='1'>search</sg> ]&apos;, active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0</v></field>
92
+ <field k='_serial'>
93
+ <value><text>0</text></value>
94
+ </field>
95
+ <field k='_sourcetype'>
96
+ <value><text>splunkd</text></value>
97
+ </field>
98
+ <field k='_subsecond'>
99
+ <value><text>.172</text></value>
100
+ </field>
101
+ <field k='_time'>
102
+ <value><text>2012-12-19T12:02:18.172-08:00</text></value>
103
+ </field>
104
+ <field k='active_streams'>
105
+ <value><text>1</text></value>
106
+ </field>
107
+ <field k='blocking'>
108
+ <value><text>FALSE</text></value>
109
+ </field>
110
+ <field k='component'>
111
+ <value><text>IndexProcessor</text></value>
112
+ </field>
113
+ <field k='date_hour'>
114
+ <value><text>12</text></value>
115
+ </field>
116
+ <field k='date_mday'>
117
+ <value><text>19</text></value>
118
+ </field>
119
+ <field k='date_minute'>
120
+ <value><text>2</text></value>
121
+ </field>
122
+ <field k='date_month'>
123
+ <value><text>december</text></value>
124
+ </field>
125
+ <field k='date_second'>
126
+ <value><text>18</text></value>
127
+ </field>
128
+ <field k='date_wday'>
129
+ <value><text>wednesday</text></value>
130
+ </field>
131
+ <field k='date_year'>
132
+ <value><text>2012</text></value>
133
+ </field>
134
+ <field k='date_zone'>
135
+ <value><text>-480</text></value>
136
+ </field>
137
+ <field k='eventtype'>
138
+ <value><text>splunkd-log</text></value>
139
+ </field>
140
+ <field k='filter'>
141
+ <value><text>&apos;[ AND index::_internal search ]&apos;</text></value>
142
+ </field>
143
+ <field k='host'>
144
+ <value><text>fross-mbp15.local</text></value>
145
+ </field>
146
+ <field k='index'>
147
+ <value h='1'><text>_internal</text></value>
148
+ </field>
149
+ <field k='linecount'>
150
+ <value><text>1</text></value>
151
+ </field>
152
+ <field k='log_level'>
153
+ <value><text>INFO</text></value>
154
+ </field>
155
+ <field k='max_block_secs'>
156
+ <value><text>0</text></value>
157
+ </field>
158
+ <field k='message'>
159
+ <value><text>rtsearch connection established, filter = &apos;[ AND index::_internal search ]&apos;, active_streams = 1, queue_size = 10000, blocking = FALSE, max_block_secs = 0</text></value>
160
+ </field>
161
+ <field k='punct'>
162
+ <value><text>--_::._-____-___,__=_&apos;[__::__]&apos;,__=_,__=_,__=_,__=</text></value>
163
+ </field>
164
+ <field k='queue_size'>
165
+ <value><text>10000</text></value>
166
+ </field>
167
+ <field k='source'>
168
+ <value><text>/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd.log</text></value>
169
+ </field>
170
+ <field k='sourcetype'>
171
+ <value><text>splunkd</text></value>
172
+ </field>
173
+ <field k='splunk_server'>
174
+ <value><text>fross-mbp15.local</text></value>
175
+ </field>
176
+ <field k='timeendpos'>
177
+ <value><text>29</text></value>
178
+ </field>
179
+ <field k='timestartpos'>
180
+ <value><text>11</text></value>
181
+ </field>
182
+ </result>
183
+ <result offset='1'>
184
+ <field k='_indextime'>
185
+ <value><text>1355947338</text></value>
186
+ </field>
187
+ <field k='_kv'>
188
+ <value><text>1</text></value>
189
+ </field>
190
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 12:02:18,066 - admin <sg h='1'>search</sg> <sg h='1'>search</sg> index=_internal | head 10</v></field>
191
+ <field k='_serial'>
192
+ <value><text>1</text></value>
193
+ </field>
194
+ <field k='_sourcetype'>
195
+ <value><text>searches</text></value>
196
+ </field>
197
+ <field k='_subsecond'>
198
+ <value><text>.066</text></value>
199
+ </field>
200
+ <field k='_time'>
201
+ <value><text>2012-12-19T12:02:18.066-08:00</text></value>
202
+ </field>
203
+ <field k='date_hour'>
204
+ <value><text>12</text></value>
205
+ </field>
206
+ <field k='date_mday'>
207
+ <value><text>19</text></value>
208
+ </field>
209
+ <field k='date_minute'>
210
+ <value><text>2</text></value>
211
+ </field>
212
+ <field k='date_month'>
213
+ <value><text>december</text></value>
214
+ </field>
215
+ <field k='date_second'>
216
+ <value><text>18</text></value>
217
+ </field>
218
+ <field k='date_wday'>
219
+ <value><text>wednesday</text></value>
220
+ </field>
221
+ <field k='date_year'>
222
+ <value><text>2012</text></value>
223
+ </field>
224
+ <field k='date_zone'>
225
+ <value><text>local</text></value>
226
+ </field>
227
+ <field k='host'>
228
+ <value><text>fross-mbp15.local</text></value>
229
+ </field>
230
+ <field k='index'>
231
+ <value h='1'><text>_internal</text></value>
232
+ </field>
233
+ <field k='linecount'>
234
+ <value><text>1</text></value>
235
+ </field>
236
+ <field k='punct'>
237
+ <value><text>--_::,_-_t__=_|__</text></value>
238
+ </field>
239
+ <field k='source'>
240
+ <value><text>/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/searches.log</text></value>
241
+ </field>
242
+ <field k='sourcetype'>
243
+ <value><text>searches</text></value>
244
+ </field>
245
+ <field k='splunk_server'>
246
+ <value><text>fross-mbp15.local</text></value>
247
+ </field>
248
+ <field k='timeendpos'>
249
+ <value><text>24</text></value>
250
+ </field>
251
+ <field k='timestartpos'>
252
+ <value><text>11</text></value>
253
+ </field>
254
+ </result>
255
+ </results>
data/test/data/results/4.2.5/results.xml ADDED
@@ -0,0 +1,336 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <results preview='0'>
3
+ <meta>
4
+ <fieldOrder>
5
+ <field>_cd</field>
6
+ <field>_indextime</field>
7
+ <field>_kv</field>
8
+ <field>_raw</field>
9
+ <field>_serial</field>
10
+ <field>_si</field>
11
+ <field>_sourcetype</field>
12
+ <field>_subsecond</field>
13
+ <field>_time</field>
14
+ <field>active_hist_searches</field>
15
+ <field>active_realtime_searches</field>
16
+ <field>alert_actions</field>
17
+ <field>app</field>
18
+ <field>autoload</field>
19
+ <field>bytes</field>
20
+ <field>clientip</field>
21
+ <field>component</field>
22
+ <field>cookie</field>
23
+ <field>date_hour</field>
24
+ <field>date_mday</field>
25
+ <field>date_minute</field>
26
+ <field>date_month</field>
27
+ <field>date_second</field>
28
+ <field>date_wday</field>
29
+ <field>date_year</field>
30
+ <field>date_zone</field>
31
+ <field>dispatch_time</field>
32
+ <field>drop_count</field>
33
+ <field>earliest</field>
34
+ <field>eventtype</field>
35
+ <field>file</field>
36
+ <field>group</field>
37
+ <field>host</field>
38
+ <field>ident</field>
39
+ <field>index</field>
40
+ <field>line</field>
41
+ <field>linecount</field>
42
+ <field>log_level</field>
43
+ <field>message</field>
44
+ <field>method</field>
45
+ <field>other</field>
46
+ <field>punct</field>
47
+ <field>q</field>
48
+ <field>referer</field>
49
+ <field>referer_domain</field>
50
+ <field>req_time</field>
51
+ <field>requestid</field>
52
+ <field>result_count</field>
53
+ <field>return_to</field>
54
+ <field>root</field>
55
+ <field>run_time</field>
56
+ <field>savedsearch_id</field>
57
+ <field>savedsearch_name</field>
58
+ <field>scheduled_time</field>
59
+ <field>sid</field>
60
+ <field>source</field>
61
+ <field>sourcetype</field>
62
+ <field>spent</field>
63
+ <field>splunk_server</field>
64
+ <field>status</field>
65
+ <field>suppressed</field>
66
+ <field>thread_id</field>
67
+ <field>timeendpos</field>
68
+ <field>timestartpos</field>
69
+ <field>trigger_condition_state</field>
70
+ <field>uri</field>
71
+ <field>uri_domain</field>
72
+ <field>uri_path</field>
73
+ <field>uri_query</field>
74
+ <field>user</field>
75
+ <field>useragent</field>
76
+ <field>version</field>
77
+ </fieldOrder>
78
+ </meta>
79
+ <result offset='0'>
80
+ <field k='_cd'>
81
+ <value><text>1:5282</text></value>
82
+ </field>
83
+ <field k='_indextime'>
84
+ <value><text>1355947283</text></value>
85
+ </field>
86
+ <field k='_kv'>
87
+ <value><text>1</text></value>
88
+ </field>
89
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:12:01:22.845 -0800] &quot;GET /services/<sg h='1'>search</sg>/timeparser/tz HTTP/1.1&quot; 200 2891 - - - 1ms</v></field>
90
+ <field k='_serial'>
91
+ <value><text>0</text></value>
92
+ </field>
93
+ <field k='_si'>
94
+ <value><text>fross-mbp15.local</text></value>
95
+ <value><text>_internal</text></value>
96
+ </field>
97
+ <field k='_sourcetype'>
98
+ <value><text>splunkd_access</text></value>
99
+ </field>
100
+ <field k='_subsecond'>
101
+ <value><text>.845</text></value>
102
+ </field>
103
+ <field k='_time'>
104
+ <value><text>2012-12-19T12:01:22.845-08:00</text></value>
105
+ </field>
106
+ <field k='bytes'>
107
+ <value><text>2891</text></value>
108
+ </field>
109
+ <field k='clientip'>
110
+ <value><text>127.0.0.1</text></value>
111
+ </field>
112
+ <field k='date_hour'>
113
+ <value><text>12</text></value>
114
+ </field>
115
+ <field k='date_mday'>
116
+ <value><text>19</text></value>
117
+ </field>
118
+ <field k='date_minute'>
119
+ <value><text>1</text></value>
120
+ </field>
121
+ <field k='date_month'>
122
+ <value><text>december</text></value>
123
+ </field>
124
+ <field k='date_second'>
125
+ <value><text>22</text></value>
126
+ </field>
127
+ <field k='date_wday'>
128
+ <value><text>wednesday</text></value>
129
+ </field>
130
+ <field k='date_year'>
131
+ <value><text>2012</text></value>
132
+ </field>
133
+ <field k='date_zone'>
134
+ <value><text>-480</text></value>
135
+ </field>
136
+ <field k='eventtype'>
137
+ <value><text>splunkd-access</text></value>
138
+ </field>
139
+ <field k='file'>
140
+ <value><text>tz</text></value>
141
+ </field>
142
+ <field k='host'>
143
+ <value><text>fross-mbp15.local</text></value>
144
+ </field>
145
+ <field k='ident'>
146
+ <value><text>-</text></value>
147
+ </field>
148
+ <field k='index'>
149
+ <value h='1'><text>_internal</text></value>
150
+ </field>
151
+ <field k='linecount'>
152
+ <value><text>1</text></value>
153
+ </field>
154
+ <field k='method'>
155
+ <value><text>GET</text></value>
156
+ </field>
157
+ <field k='other'>
158
+ <value><text>- - - 1ms</text></value>
159
+ </field>
160
+ <field k='punct'>
161
+ <value><text>..._-__[//:::._-]_&quot;_////_/.&quot;___-_-_-_</text></value>
162
+ </field>
163
+ <field k='req_time'>
164
+ <value><text>19/Dec/2012:12:01:22.845 -0800</text></value>
165
+ </field>
166
+ <field k='root'>
167
+ <value><text>services</text></value>
168
+ </field>
169
+ <field k='source'>
170
+ <value><text>/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/splunkd_access.log</text></value>
171
+ </field>
172
+ <field k='sourcetype'>
173
+ <value><text>splunkd_access</text></value>
174
+ </field>
175
+ <field k='spent'>
176
+ <value><text>1</text></value>
177
+ </field>
178
+ <field k='splunk_server'>
179
+ <value><text>fross-mbp15.local</text></value>
180
+ </field>
181
+ <field k='status'>
182
+ <value><text>200</text></value>
183
+ </field>
184
+ <field k='timeendpos'>
185
+ <value><text>49</text></value>
186
+ </field>
187
+ <field k='timestartpos'>
188
+ <value><text>31</text></value>
189
+ </field>
190
+ <field k='uri'>
191
+ <value><text>/services/search/timeparser/tz</text></value>
192
+ </field>
193
+ <field k='uri_path'>
194
+ <value><text>/services/search/timeparser/tz</text></value>
195
+ </field>
196
+ <field k='user'>
197
+ <value><text>admin</text></value>
198
+ </field>
199
+ <field k='version'>
200
+ <value><text>HTTP/1.1</text></value>
201
+ </field>
202
+ </result>
203
+ <result offset='1'>
204
+ <field k='_cd'>
205
+ <value><text>1:5211</text></value>
206
+ </field>
207
+ <field k='_indextime'>
208
+ <value><text>1355947283</text></value>
209
+ </field>
210
+ <field k='_kv'>
211
+ <value><text>1</text></value>
212
+ </field>
213
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:12:01:22.762 -0800] &quot;POST /en-US/account/login HTTP/1.1&quot; 200 1897 &quot;http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3D<sg h='1'>search</sg>%2520<sg h='1'>search</sg>%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0&quot; &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0&quot; - 50d21d12c31e60610 35ms</v></field>
214
+ <field k='_serial'>
215
+ <value><text>1</text></value>
216
+ </field>
217
+ <field k='_si'>
218
+ <value><text>fross-mbp15.local</text></value>
219
+ <value><text>_internal</text></value>
220
+ </field>
221
+ <field k='_sourcetype'>
222
+ <value><text>splunk_web_access</text></value>
223
+ </field>
224
+ <field k='_subsecond'>
225
+ <value><text>.762</text></value>
226
+ </field>
227
+ <field k='_time'>
228
+ <value><text>2012-12-19T12:01:22.762-08:00</text></value>
229
+ </field>
230
+ <field k='bytes'>
231
+ <value><text>1897</text></value>
232
+ </field>
233
+ <field k='clientip'>
234
+ <value><text>127.0.0.1</text></value>
235
+ </field>
236
+ <field k='date_hour'>
237
+ <value><text>12</text></value>
238
+ </field>
239
+ <field k='date_mday'>
240
+ <value><text>19</text></value>
241
+ </field>
242
+ <field k='date_minute'>
243
+ <value><text>1</text></value>
244
+ </field>
245
+ <field k='date_month'>
246
+ <value><text>december</text></value>
247
+ </field>
248
+ <field k='date_second'>
249
+ <value><text>22</text></value>
250
+ </field>
251
+ <field k='date_wday'>
252
+ <value><text>wednesday</text></value>
253
+ </field>
254
+ <field k='date_year'>
255
+ <value><text>2012</text></value>
256
+ </field>
257
+ <field k='date_zone'>
258
+ <value><text>-480</text></value>
259
+ </field>
260
+ <field k='file'>
261
+ <value><text>login</text></value>
262
+ </field>
263
+ <field k='host'>
264
+ <value><text>fross-mbp15.local</text></value>
265
+ </field>
266
+ <field k='ident'>
267
+ <value><text>-</text></value>
268
+ </field>
269
+ <field k='index'>
270
+ <value h='1'><text>_internal</text></value>
271
+ </field>
272
+ <field k='linecount'>
273
+ <value><text>1</text></value>
274
+ </field>
275
+ <field k='method'>
276
+ <value><text>POST</text></value>
277
+ </field>
278
+ <field k='other'>
279
+ <value><text>- 50d21d12c31e60610 35ms</text></value>
280
+ </field>
281
+ <field k='punct'>
282
+ <value><text>..._-__[//:::._-]_&quot;_/-//_/.&quot;___&quot;://:/-//?=%-%%%%%%</text></value>
283
+ </field>
284
+ <field k='referer'>
285
+ <value><text>http://localhost:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0</text></value>
286
+ </field>
287
+ <field k='referer_domain'>
288
+ <value><text>http://localhost:8000</text></value>
289
+ </field>
290
+ <field k='req_time'>
291
+ <value><text>19/Dec/2012:12:01:22.762 -0800</text></value>
292
+ </field>
293
+ <field k='return_to'>
294
+ <value><text>%2Fen-US%2Fapp%2Fsearch%2Fflashtimeline%3Fq%3Dsearch%2520search%2520index%253D_internal%2520%257C%2520head%252010%26earliest%3D0</text></value>
295
+ </field>
296
+ <field k='root'>
297
+ <value><text>en-US</text></value>
298
+ </field>
299
+ <field k='source'>
300
+ <value><text>/Users/fross/splunks/splunk-4.2.5.6/var/log/splunk/web_access.log</text></value>
301
+ </field>
302
+ <field k='sourcetype'>
303
+ <value><text>splunk_web_access</text></value>
304
+ </field>
305
+ <field k='spent'>
306
+ <value><text>35</text></value>
307
+ </field>
308
+ <field k='splunk_server'>
309
+ <value><text>fross-mbp15.local</text></value>
310
+ </field>
311
+ <field k='status'>
312
+ <value><text>200</text></value>
313
+ </field>
314
+ <field k='timeendpos'>
315
+ <value><text>49</text></value>
316
+ </field>
317
+ <field k='timestartpos'>
318
+ <value><text>31</text></value>
319
+ </field>
320
+ <field k='uri'>
321
+ <value><text>/en-US/account/login</text></value>
322
+ </field>
323
+ <field k='uri_path'>
324
+ <value><text>/en-US/account/login</text></value>
325
+ </field>
326
+ <field k='user'>
327
+ <value><text>admin</text></value>
328
+ </field>
329
+ <field k='useragent'>
330
+ <value><text>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0</text></value>
331
+ </field>
332
+ <field k='version'>
333
+ <value><text>HTTP/1.1</text></value>
334
+ </field>
335
+ </result>
336
+ </results>