splunk-sdk-ruby 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (81) hide show
  1. data/CHANGELOG.md +160 -0
  2. data/Gemfile +8 -0
  3. data/LICENSE +177 -0
  4. data/README.md +310 -0
  5. data/Rakefile +40 -0
  6. data/examples/1_connect.rb +51 -0
  7. data/examples/2_manage.rb +103 -0
  8. data/examples/3_blocking_searches.rb +82 -0
  9. data/examples/4_asynchronous_searches.rb +79 -0
  10. data/examples/5_stream_data_to_splunk.rb +79 -0
  11. data/lib/splunk-sdk-ruby.rb +47 -0
  12. data/lib/splunk-sdk-ruby/ambiguous_entity_reference.rb +28 -0
  13. data/lib/splunk-sdk-ruby/atomfeed.rb +323 -0
  14. data/lib/splunk-sdk-ruby/collection.rb +417 -0
  15. data/lib/splunk-sdk-ruby/collection/apps.rb +35 -0
  16. data/lib/splunk-sdk-ruby/collection/case_insensitive_collection.rb +58 -0
  17. data/lib/splunk-sdk-ruby/collection/configuration_file.rb +50 -0
  18. data/lib/splunk-sdk-ruby/collection/configurations.rb +80 -0
  19. data/lib/splunk-sdk-ruby/collection/jobs.rb +136 -0
  20. data/lib/splunk-sdk-ruby/collection/messages.rb +51 -0
  21. data/lib/splunk-sdk-ruby/context.rb +522 -0
  22. data/lib/splunk-sdk-ruby/entity.rb +260 -0
  23. data/lib/splunk-sdk-ruby/entity/index.rb +191 -0
  24. data/lib/splunk-sdk-ruby/entity/job.rb +339 -0
  25. data/lib/splunk-sdk-ruby/entity/message.rb +36 -0
  26. data/lib/splunk-sdk-ruby/entity/saved_search.rb +71 -0
  27. data/lib/splunk-sdk-ruby/entity/stanza.rb +45 -0
  28. data/lib/splunk-sdk-ruby/entity_not_ready.rb +26 -0
  29. data/lib/splunk-sdk-ruby/illegal_operation.rb +27 -0
  30. data/lib/splunk-sdk-ruby/namespace.rb +239 -0
  31. data/lib/splunk-sdk-ruby/resultsreader.rb +716 -0
  32. data/lib/splunk-sdk-ruby/service.rb +339 -0
  33. data/lib/splunk-sdk-ruby/splunk_http_error.rb +49 -0
  34. data/lib/splunk-sdk-ruby/synonyms.rb +50 -0
  35. data/lib/splunk-sdk-ruby/version.rb +27 -0
  36. data/lib/splunk-sdk-ruby/xml_shim.rb +117 -0
  37. data/splunk-sdk-ruby.gemspec +27 -0
  38. data/test/atom_test_data.rb +472 -0
  39. data/test/data/atom/atom_feed_with_message.xml +19 -0
  40. data/test/data/atom/atom_with_feed.xml +99 -0
  41. data/test/data/atom/atom_with_several_entries.xml +101 -0
  42. data/test/data/atom/atom_with_simple_entries.xml +30 -0
  43. data/test/data/atom/atom_without_feed.xml +248 -0
  44. data/test/data/export/4.2.5/export_results.xml +88 -0
  45. data/test/data/export/4.3.5/export_results.xml +87 -0
  46. data/test/data/export/5.0.1/export_results.xml +78 -0
  47. data/test/data/export/5.0.1/nonreporting.xml +232 -0
  48. data/test/data/results/4.2.5/results-empty.xml +0 -0
  49. data/test/data/results/4.2.5/results-preview.xml +255 -0
  50. data/test/data/results/4.2.5/results.xml +336 -0
  51. data/test/data/results/4.3.5/results-empty.xml +0 -0
  52. data/test/data/results/4.3.5/results-preview.xml +1057 -0
  53. data/test/data/results/4.3.5/results.xml +626 -0
  54. data/test/data/results/5.0.2/results-empty.xml +1 -0
  55. data/test/data/results/5.0.2/results-empty_preview.xml +1 -0
  56. data/test/data/results/5.0.2/results-preview.xml +448 -0
  57. data/test/data/results/5.0.2/results.xml +501 -0
  58. data/test/export_test_data.json +360 -0
  59. data/test/resultsreader_test_data.json +1119 -0
  60. data/test/services.server.info.xml +43 -0
  61. data/test/services.xml +111 -0
  62. data/test/test_atomfeed.rb +71 -0
  63. data/test/test_collection.rb +278 -0
  64. data/test/test_configuration_file.rb +124 -0
  65. data/test/test_context.rb +119 -0
  66. data/test/test_entity.rb +95 -0
  67. data/test/test_helper.rb +250 -0
  68. data/test/test_http_error.rb +52 -0
  69. data/test/test_index.rb +91 -0
  70. data/test/test_jobs.rb +319 -0
  71. data/test/test_messages.rb +17 -0
  72. data/test/test_namespace.rb +188 -0
  73. data/test/test_restarts.rb +49 -0
  74. data/test/test_resultsreader.rb +106 -0
  75. data/test/test_roles.rb +41 -0
  76. data/test/test_saved_searches.rb +119 -0
  77. data/test/test_service.rb +65 -0
  78. data/test/test_users.rb +33 -0
  79. data/test/test_xml_shim.rb +28 -0
  80. data/test/testfile.txt +1 -0
  81. metadata +200 -0
data/test/data/results/4.3.5/results-empty.xml ADDED
File without changes
data/test/data/results/4.3.5/results-preview.xml ADDED
@@ -0,0 +1,1057 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <results preview='1'>
3
+ <meta>
4
+ <fieldOrder>
5
+ <field>_cd</field>
6
+ <field>_indextime</field>
7
+ <field>_kv</field>
8
+ <field>_raw</field>
9
+ <field>_serial</field>
10
+ <field>_si</field>
11
+ <field>_sourcetype</field>
12
+ <field>_subsecond</field>
13
+ <field>_time</field>
14
+ <field>active_hist_searches</field>
15
+ <field>active_realtime_searches</field>
16
+ <field>app</field>
17
+ <field>appCodeName</field>
18
+ <field>appName</field>
19
+ <field>browser</field>
20
+ <field>bytes</field>
21
+ <field>class</field>
22
+ <field>client_app</field>
23
+ <field>clientip</field>
24
+ <field>component</field>
25
+ <field>count</field>
26
+ <field>date_hour</field>
27
+ <field>date_mday</field>
28
+ <field>date_minute</field>
29
+ <field>date_month</field>
30
+ <field>date_second</field>
31
+ <field>date_wday</field>
32
+ <field>date_year</field>
33
+ <field>date_zone</field>
34
+ <field>delimiter</field>
35
+ <field>display_row_numbers</field>
36
+ <field>drop_count</field>
37
+ <field>earliest</field>
38
+ <field>enable_event_actions</field>
39
+ <field>enable_field_actions</field>
40
+ <field>entity_name</field>
41
+ <field>eventtype</field>
42
+ <field>field_list</field>
43
+ <field>fields</field>
44
+ <field>file</field>
45
+ <field>fillcontents</field>
46
+ <field>group</field>
47
+ <field>host</field>
48
+ <field>ident</field>
49
+ <field>index</field>
50
+ <field>jobStatus</field>
51
+ <field>latest</field>
52
+ <field>line</field>
53
+ <field>linecount</field>
54
+ <field>log_level</field>
55
+ <field>max_lines</field>
56
+ <field>max_lines_constraint</field>
57
+ <field>max_time</field>
58
+ <field>mean_preview_period</field>
59
+ <field>message</field>
60
+ <field>message_level</field>
61
+ <field>method</field>
62
+ <field>min_freq</field>
63
+ <field>min_lines</field>
64
+ <field>name</field>
65
+ <field>namespace</field>
66
+ <field>offset</field>
67
+ <field>other</field>
68
+ <field>output_mode</field>
69
+ <field>output_time_format</field>
70
+ <field>platform</field>
71
+ <field>prefix</field>
72
+ <field>punct</field>
73
+ <field>q</field>
74
+ <field>referer</field>
75
+ <field>referer_domain</field>
76
+ <field>req_time</field>
77
+ <field>requestid</field>
78
+ <field>reverse_order</field>
79
+ <field>root</field>
80
+ <field>s</field>
81
+ <field>search</field>
82
+ <field>segmentation</field>
83
+ <field>show_empty_fields</field>
84
+ <field>sid</field>
85
+ <field>sortDir</field>
86
+ <field>sortKey</field>
87
+ <field>sort_dir</field>
88
+ <field>sort_key</field>
89
+ <field>source</field>
90
+ <field>sourcetype</field>
91
+ <field>spent</field>
92
+ <field>splunk_server</field>
93
+ <field>staticFields</field>
94
+ <field>status</field>
95
+ <field>time_format</field>
96
+ <field>timeendpos</field>
97
+ <field>timestartpos</field>
98
+ <field>truncation_mode</field>
99
+ <field>uri</field>
100
+ <field>uri_path</field>
101
+ <field>uri_query</field>
102
+ <field>user</field>
103
+ <field>userAgent</field>
104
+ <field>useragent</field>
105
+ <field>version</field>
106
+ </fieldOrder>
107
+ </meta>
108
+ <result offset='0'>
109
+ <field k='_cd'>
110
+ <value><text>54:8568</text></value>
111
+ </field>
112
+ <field k='_indextime'>
113
+ <value><text>1355946537</text></value>
114
+ </field>
115
+ <field k='_kv'>
116
+ <value><text>1</text></value>
117
+ </field>
118
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/<sg h='1'>search</sg>/mrsparkle</v></field>
119
+ <field k='_serial'>
120
+ <value><text>731</text></value>
121
+ </field>
122
+ <field k='_si'>
123
+ <value><text>fross-mbp15.local</text></value>
124
+ <value><text>_internal</text></value>
125
+ </field>
126
+ <field k='_sourcetype'>
127
+ <value><text>splunk_web_service</text></value>
128
+ </field>
129
+ <field k='_subsecond'>
130
+ <value><text>.424</text></value>
131
+ </field>
132
+ <field k='_time'>
133
+ <value><text>2012-12-19T11:48:55.424-08:00</text></value>
134
+ </field>
135
+ <field k='component'>
136
+ <value><text>root</text></value>
137
+ </field>
138
+ <field k='date_hour'>
139
+ <value><text>11</text></value>
140
+ </field>
141
+ <field k='date_mday'>
142
+ <value><text>19</text></value>
143
+ </field>
144
+ <field k='date_minute'>
145
+ <value><text>48</text></value>
146
+ </field>
147
+ <field k='date_month'>
148
+ <value><text>december</text></value>
149
+ </field>
150
+ <field k='date_second'>
151
+ <value><text>55</text></value>
152
+ </field>
153
+ <field k='date_wday'>
154
+ <value><text>wednesday</text></value>
155
+ </field>
156
+ <field k='date_year'>
157
+ <value><text>2012</text></value>
158
+ </field>
159
+ <field k='date_zone'>
160
+ <value><text>local</text></value>
161
+ </field>
162
+ <field k='host'>
163
+ <value><text>fross-mbp15.local</text></value>
164
+ </field>
165
+ <field k='index'>
166
+ <value h='1'><text>_internal</text></value>
167
+ </field>
168
+ <field k='line'>
169
+ <value><text>535</text></value>
170
+ </field>
171
+ <field k='linecount'>
172
+ <value><text>1</text></value>
173
+ </field>
174
+ <field k='log_level'>
175
+ <value><text>INFO</text></value>
176
+ </field>
177
+ <field k='message'>
178
+ <value><text>CONFIG: mrsparkle_path (str): /Users/fross/splunks/splunk-4.3.5/share/search/mrsparkle</text></value>
179
+ </field>
180
+ <field k='punct'>
181
+ <value><text>--_::,_t[]_:_-_:__():_////-..///</text></value>
182
+ </field>
183
+ <field k='requestid'>
184
+ <value><text>50d21a262616082d0</text></value>
185
+ </field>
186
+ <field k='source'>
187
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log</text></value>
188
+ </field>
189
+ <field k='sourcetype'>
190
+ <value><text>splunk_web_service</text></value>
191
+ </field>
192
+ <field k='splunk_server'>
193
+ <value><text>fross-mbp15.local</text></value>
194
+ </field>
195
+ <field k='timeendpos'>
196
+ <value><text>24</text></value>
197
+ </field>
198
+ <field k='timestartpos'>
199
+ <value><text>0</text></value>
200
+ </field>
201
+ </result>
202
+ <result offset='1'>
203
+ <field k='_cd'>
204
+ <value><text>54:8562</text></value>
205
+ </field>
206
+ <field k='_indextime'>
207
+ <value><text>1355946537</text></value>
208
+ </field>
209
+ <field k='_kv'>
210
+ <value><text>1</text></value>
211
+ </field>
212
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 11:48:55,424 INFO [50d21a262616082d0] root:535 - CONFIG: module_dir (str): share/splunk/<sg h='1'>search</sg>_mrsparkle/modules</v></field>
213
+ <field k='_serial'>
214
+ <value><text>732</text></value>
215
+ </field>
216
+ <field k='_si'>
217
+ <value><text>fross-mbp15.local</text></value>
218
+ <value><text>_internal</text></value>
219
+ </field>
220
+ <field k='_sourcetype'>
221
+ <value><text>splunk_web_service</text></value>
222
+ </field>
223
+ <field k='_subsecond'>
224
+ <value><text>.424</text></value>
225
+ </field>
226
+ <field k='_time'>
227
+ <value><text>2012-12-19T11:48:55.424-08:00</text></value>
228
+ </field>
229
+ <field k='component'>
230
+ <value><text>root</text></value>
231
+ </field>
232
+ <field k='date_hour'>
233
+ <value><text>11</text></value>
234
+ </field>
235
+ <field k='date_mday'>
236
+ <value><text>19</text></value>
237
+ </field>
238
+ <field k='date_minute'>
239
+ <value><text>48</text></value>
240
+ </field>
241
+ <field k='date_month'>
242
+ <value><text>december</text></value>
243
+ </field>
244
+ <field k='date_second'>
245
+ <value><text>55</text></value>
246
+ </field>
247
+ <field k='date_wday'>
248
+ <value><text>wednesday</text></value>
249
+ </field>
250
+ <field k='date_year'>
251
+ <value><text>2012</text></value>
252
+ </field>
253
+ <field k='date_zone'>
254
+ <value><text>local</text></value>
255
+ </field>
256
+ <field k='host'>
257
+ <value><text>fross-mbp15.local</text></value>
258
+ </field>
259
+ <field k='index'>
260
+ <value h='1'><text>_internal</text></value>
261
+ </field>
262
+ <field k='line'>
263
+ <value><text>535</text></value>
264
+ </field>
265
+ <field k='linecount'>
266
+ <value><text>1</text></value>
267
+ </field>
268
+ <field k='log_level'>
269
+ <value><text>INFO</text></value>
270
+ </field>
271
+ <field k='message'>
272
+ <value><text>CONFIG: module_dir (str): share/splunk/search_mrsparkle/modules</text></value>
273
+ </field>
274
+ <field k='punct'>
275
+ <value><text>--_::,_t[]_:_-_:__():_///</text></value>
276
+ </field>
277
+ <field k='requestid'>
278
+ <value><text>50d21a262616082d0</text></value>
279
+ </field>
280
+ <field k='source'>
281
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log</text></value>
282
+ </field>
283
+ <field k='sourcetype'>
284
+ <value><text>splunk_web_service</text></value>
285
+ </field>
286
+ <field k='splunk_server'>
287
+ <value><text>fross-mbp15.local</text></value>
288
+ </field>
289
+ <field k='timeendpos'>
290
+ <value><text>24</text></value>
291
+ </field>
292
+ <field k='timestartpos'>
293
+ <value><text>0</text></value>
294
+ </field>
295
+ </result>
296
+ <result offset='2'>
297
+ <field k='_cd'>
298
+ <value><text>54:8674</text></value>
299
+ </field>
300
+ <field k='_indextime'>
301
+ <value><text>1355946537</text></value>
302
+ </field>
303
+ <field k='_kv'>
304
+ <value><text>1</text></value>
305
+ </field>
306
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: template_dir (str): share/splunk/<sg h='1'>search</sg>_mrsparkle/templates</v></field>
307
+ <field k='_serial'>
308
+ <value><text>728</text></value>
309
+ </field>
310
+ <field k='_si'>
311
+ <value><text>fross-mbp15.local</text></value>
312
+ <value><text>_internal</text></value>
313
+ </field>
314
+ <field k='_sourcetype'>
315
+ <value><text>splunk_web_service</text></value>
316
+ </field>
317
+ <field k='_subsecond'>
318
+ <value><text>.425</text></value>
319
+ </field>
320
+ <field k='_time'>
321
+ <value><text>2012-12-19T11:48:55.425-08:00</text></value>
322
+ </field>
323
+ <field k='component'>
324
+ <value><text>root</text></value>
325
+ </field>
326
+ <field k='date_hour'>
327
+ <value><text>11</text></value>
328
+ </field>
329
+ <field k='date_mday'>
330
+ <value><text>19</text></value>
331
+ </field>
332
+ <field k='date_minute'>
333
+ <value><text>48</text></value>
334
+ </field>
335
+ <field k='date_month'>
336
+ <value><text>december</text></value>
337
+ </field>
338
+ <field k='date_second'>
339
+ <value><text>55</text></value>
340
+ </field>
341
+ <field k='date_wday'>
342
+ <value><text>wednesday</text></value>
343
+ </field>
344
+ <field k='date_year'>
345
+ <value><text>2012</text></value>
346
+ </field>
347
+ <field k='date_zone'>
348
+ <value><text>local</text></value>
349
+ </field>
350
+ <field k='host'>
351
+ <value><text>fross-mbp15.local</text></value>
352
+ </field>
353
+ <field k='index'>
354
+ <value h='1'><text>_internal</text></value>
355
+ </field>
356
+ <field k='line'>
357
+ <value><text>535</text></value>
358
+ </field>
359
+ <field k='linecount'>
360
+ <value><text>1</text></value>
361
+ </field>
362
+ <field k='log_level'>
363
+ <value><text>INFO</text></value>
364
+ </field>
365
+ <field k='message'>
366
+ <value><text>CONFIG: template_dir (str): share/splunk/search_mrsparkle/templates</text></value>
367
+ </field>
368
+ <field k='punct'>
369
+ <value><text>--_::,_t[]_:_-_:__():_///</text></value>
370
+ </field>
371
+ <field k='requestid'>
372
+ <value><text>50d21a262616082d0</text></value>
373
+ </field>
374
+ <field k='source'>
375
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log</text></value>
376
+ </field>
377
+ <field k='sourcetype'>
378
+ <value><text>splunk_web_service</text></value>
379
+ </field>
380
+ <field k='splunk_server'>
381
+ <value><text>fross-mbp15.local</text></value>
382
+ </field>
383
+ <field k='timeendpos'>
384
+ <value><text>24</text></value>
385
+ </field>
386
+ <field k='timestartpos'>
387
+ <value><text>0</text></value>
388
+ </field>
389
+ </result>
390
+ <result offset='3'>
391
+ <field k='_cd'>
392
+ <value><text>54:8662</text></value>
393
+ </field>
394
+ <field k='_indextime'>
395
+ <value><text>1355946537</text></value>
396
+ </field>
397
+ <field k='_kv'>
398
+ <value><text>1</text></value>
399
+ </field>
400
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/<sg h='1'>search</sg>_mrsparkle/exposed</v></field>
401
+ <field k='_serial'>
402
+ <value><text>729</text></value>
403
+ </field>
404
+ <field k='_si'>
405
+ <value><text>fross-mbp15.local</text></value>
406
+ <value><text>_internal</text></value>
407
+ </field>
408
+ <field k='_sourcetype'>
409
+ <value><text>splunk_web_service</text></value>
410
+ </field>
411
+ <field k='_subsecond'>
412
+ <value><text>.425</text></value>
413
+ </field>
414
+ <field k='_time'>
415
+ <value><text>2012-12-19T11:48:55.425-08:00</text></value>
416
+ </field>
417
+ <field k='component'>
418
+ <value><text>root</text></value>
419
+ </field>
420
+ <field k='date_hour'>
421
+ <value><text>11</text></value>
422
+ </field>
423
+ <field k='date_mday'>
424
+ <value><text>19</text></value>
425
+ </field>
426
+ <field k='date_minute'>
427
+ <value><text>48</text></value>
428
+ </field>
429
+ <field k='date_month'>
430
+ <value><text>december</text></value>
431
+ </field>
432
+ <field k='date_second'>
433
+ <value><text>55</text></value>
434
+ </field>
435
+ <field k='date_wday'>
436
+ <value><text>wednesday</text></value>
437
+ </field>
438
+ <field k='date_year'>
439
+ <value><text>2012</text></value>
440
+ </field>
441
+ <field k='date_zone'>
442
+ <value><text>local</text></value>
443
+ </field>
444
+ <field k='host'>
445
+ <value><text>fross-mbp15.local</text></value>
446
+ </field>
447
+ <field k='index'>
448
+ <value h='1'><text>_internal</text></value>
449
+ </field>
450
+ <field k='line'>
451
+ <value><text>535</text></value>
452
+ </field>
453
+ <field k='linecount'>
454
+ <value><text>1</text></value>
455
+ </field>
456
+ <field k='log_level'>
457
+ <value><text>INFO</text></value>
458
+ </field>
459
+ <field k='message'>
460
+ <value><text>CONFIG: staticdir (str): /Users/fross/splunks/splunk-4.3.5/share/splunk/search_mrsparkle/exposed</text></value>
461
+ </field>
462
+ <field k='punct'>
463
+ <value><text>--_::,_t[]_:_-_:__():_////-..////</text></value>
464
+ </field>
465
+ <field k='requestid'>
466
+ <value><text>50d21a262616082d0</text></value>
467
+ </field>
468
+ <field k='source'>
469
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log</text></value>
470
+ </field>
471
+ <field k='sourcetype'>
472
+ <value><text>splunk_web_service</text></value>
473
+ </field>
474
+ <field k='splunk_server'>
475
+ <value><text>fross-mbp15.local</text></value>
476
+ </field>
477
+ <field k='timeendpos'>
478
+ <value><text>24</text></value>
479
+ </field>
480
+ <field k='timestartpos'>
481
+ <value><text>0</text></value>
482
+ </field>
483
+ </result>
484
+ <result offset='4'>
485
+ <field k='_cd'>
486
+ <value><text>54:8651</text></value>
487
+ </field>
488
+ <field k='_indextime'>
489
+ <value><text>1355946537</text></value>
490
+ </field>
491
+ <field k='_kv'>
492
+ <value><text>1</text></value>
493
+ </field>
494
+ <field k='_raw'><v xml:space='preserve' trunc='0'>2012-12-19 11:48:55,425 INFO [50d21a262616082d0] root:535 - CONFIG: static_dir (str): share/splunk/<sg h='1'>search</sg>_mrsparkle/exposed</v></field>
495
+ <field k='_serial'>
496
+ <value><text>730</text></value>
497
+ </field>
498
+ <field k='_si'>
499
+ <value><text>fross-mbp15.local</text></value>
500
+ <value><text>_internal</text></value>
501
+ </field>
502
+ <field k='_sourcetype'>
503
+ <value><text>splunk_web_service</text></value>
504
+ </field>
505
+ <field k='_subsecond'>
506
+ <value><text>.425</text></value>
507
+ </field>
508
+ <field k='_time'>
509
+ <value><text>2012-12-19T11:48:55.425-08:00</text></value>
510
+ </field>
511
+ <field k='component'>
512
+ <value><text>root</text></value>
513
+ </field>
514
+ <field k='date_hour'>
515
+ <value><text>11</text></value>
516
+ </field>
517
+ <field k='date_mday'>
518
+ <value><text>19</text></value>
519
+ </field>
520
+ <field k='date_minute'>
521
+ <value><text>48</text></value>
522
+ </field>
523
+ <field k='date_month'>
524
+ <value><text>december</text></value>
525
+ </field>
526
+ <field k='date_second'>
527
+ <value><text>55</text></value>
528
+ </field>
529
+ <field k='date_wday'>
530
+ <value><text>wednesday</text></value>
531
+ </field>
532
+ <field k='date_year'>
533
+ <value><text>2012</text></value>
534
+ </field>
535
+ <field k='date_zone'>
536
+ <value><text>local</text></value>
537
+ </field>
538
+ <field k='host'>
539
+ <value><text>fross-mbp15.local</text></value>
540
+ </field>
541
+ <field k='index'>
542
+ <value h='1'><text>_internal</text></value>
543
+ </field>
544
+ <field k='line'>
545
+ <value><text>535</text></value>
546
+ </field>
547
+ <field k='linecount'>
548
+ <value><text>1</text></value>
549
+ </field>
550
+ <field k='log_level'>
551
+ <value><text>INFO</text></value>
552
+ </field>
553
+ <field k='message'>
554
+ <value><text>CONFIG: static_dir (str): share/splunk/search_mrsparkle/exposed</text></value>
555
+ </field>
556
+ <field k='punct'>
557
+ <value><text>--_::,_t[]_:_-_:__():_///</text></value>
558
+ </field>
559
+ <field k='requestid'>
560
+ <value><text>50d21a262616082d0</text></value>
561
+ </field>
562
+ <field k='source'>
563
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_service.log</text></value>
564
+ </field>
565
+ <field k='sourcetype'>
566
+ <value><text>splunk_web_service</text></value>
567
+ </field>
568
+ <field k='splunk_server'>
569
+ <value><text>fross-mbp15.local</text></value>
570
+ </field>
571
+ <field k='timeendpos'>
572
+ <value><text>24</text></value>
573
+ </field>
574
+ <field k='timestartpos'>
575
+ <value><text>0</text></value>
576
+ </field>
577
+ </result>
578
+ <result offset='5'>
579
+ <field k='_cd'>
580
+ <value><text>54:9267</text></value>
581
+ </field>
582
+ <field k='_indextime'>
583
+ <value><text>1355946552</text></value>
584
+ </field>
585
+ <field k='_kv'>
586
+ <value><text>1</text></value>
587
+ </field>
588
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 11:49:12.313 -0800 INFO Metrics - group=<sg h='1'>search</sg>_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</v></field>
589
+ <field k='_serial'>
590
+ <value><text>726</text></value>
591
+ </field>
592
+ <field k='_si'>
593
+ <value><text>fross-mbp15.local</text></value>
594
+ <value><text>_internal</text></value>
595
+ </field>
596
+ <field k='_sourcetype'>
597
+ <value><text>splunkd</text></value>
598
+ </field>
599
+ <field k='_subsecond'>
600
+ <value><text>.313</text></value>
601
+ </field>
602
+ <field k='_time'>
603
+ <value><text>2012-12-19T11:49:12.313-08:00</text></value>
604
+ </field>
605
+ <field k='active_hist_searches'>
606
+ <value><text>0</text></value>
607
+ </field>
608
+ <field k='active_realtime_searches'>
609
+ <value><text>0</text></value>
610
+ </field>
611
+ <field k='component'>
612
+ <value><text>Metrics</text></value>
613
+ </field>
614
+ <field k='date_hour'>
615
+ <value><text>11</text></value>
616
+ </field>
617
+ <field k='date_mday'>
618
+ <value><text>19</text></value>
619
+ </field>
620
+ <field k='date_minute'>
621
+ <value><text>49</text></value>
622
+ </field>
623
+ <field k='date_month'>
624
+ <value><text>december</text></value>
625
+ </field>
626
+ <field k='date_second'>
627
+ <value><text>12</text></value>
628
+ </field>
629
+ <field k='date_wday'>
630
+ <value><text>wednesday</text></value>
631
+ </field>
632
+ <field k='date_year'>
633
+ <value><text>2012</text></value>
634
+ </field>
635
+ <field k='date_zone'>
636
+ <value><text>-480</text></value>
637
+ </field>
638
+ <field k='group'>
639
+ <value><text>search_concurrency</text></value>
640
+ </field>
641
+ <field k='host'>
642
+ <value><text>fross-mbp15.local</text></value>
643
+ </field>
644
+ <field k='index'>
645
+ <value h='1'><text>_internal</text></value>
646
+ </field>
647
+ <field k='linecount'>
648
+ <value><text>1</text></value>
649
+ </field>
650
+ <field k='log_level'>
651
+ <value><text>INFO</text></value>
652
+ </field>
653
+ <field k='message'>
654
+ <value><text>group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</text></value>
655
+ </field>
656
+ <field k='punct'>
657
+ <value><text>--_::._-____-_=,__,_=,_=</text></value>
658
+ </field>
659
+ <field k='source'>
660
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log</text></value>
661
+ </field>
662
+ <field k='sourcetype'>
663
+ <value><text>splunkd</text></value>
664
+ </field>
665
+ <field k='splunk_server'>
666
+ <value><text>fross-mbp15.local</text></value>
667
+ </field>
668
+ <field k='timeendpos'>
669
+ <value><text>29</text></value>
670
+ </field>
671
+ <field k='timestartpos'>
672
+ <value><text>0</text></value>
673
+ </field>
674
+ </result>
675
+ <result offset='6'>
676
+ <field k='_cd'>
677
+ <value><text>54:9262</text></value>
678
+ </field>
679
+ <field k='_indextime'>
680
+ <value><text>1355946552</text></value>
681
+ </field>
682
+ <field k='_kv'>
683
+ <value><text>1</text></value>
684
+ </field>
685
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 11:49:12.313 -0800 INFO Metrics - group=realtime_<sg h='1'>search</sg>_data, system total, drop_count=0</v></field>
686
+ <field k='_serial'>
687
+ <value><text>727</text></value>
688
+ </field>
689
+ <field k='_si'>
690
+ <value><text>fross-mbp15.local</text></value>
691
+ <value><text>_internal</text></value>
692
+ </field>
693
+ <field k='_sourcetype'>
694
+ <value><text>splunkd</text></value>
695
+ </field>
696
+ <field k='_subsecond'>
697
+ <value><text>.313</text></value>
698
+ </field>
699
+ <field k='_time'>
700
+ <value><text>2012-12-19T11:49:12.313-08:00</text></value>
701
+ </field>
702
+ <field k='component'>
703
+ <value><text>Metrics</text></value>
704
+ </field>
705
+ <field k='date_hour'>
706
+ <value><text>11</text></value>
707
+ </field>
708
+ <field k='date_mday'>
709
+ <value><text>19</text></value>
710
+ </field>
711
+ <field k='date_minute'>
712
+ <value><text>49</text></value>
713
+ </field>
714
+ <field k='date_month'>
715
+ <value><text>december</text></value>
716
+ </field>
717
+ <field k='date_second'>
718
+ <value><text>12</text></value>
719
+ </field>
720
+ <field k='date_wday'>
721
+ <value><text>wednesday</text></value>
722
+ </field>
723
+ <field k='date_year'>
724
+ <value><text>2012</text></value>
725
+ </field>
726
+ <field k='date_zone'>
727
+ <value><text>-480</text></value>
728
+ </field>
729
+ <field k='drop_count'>
730
+ <value><text>0</text></value>
731
+ </field>
732
+ <field k='group'>
733
+ <value><text>realtime_search_data</text></value>
734
+ </field>
735
+ <field k='host'>
736
+ <value><text>fross-mbp15.local</text></value>
737
+ </field>
738
+ <field k='index'>
739
+ <value h='1'><text>_internal</text></value>
740
+ </field>
741
+ <field k='linecount'>
742
+ <value><text>1</text></value>
743
+ </field>
744
+ <field k='log_level'>
745
+ <value><text>INFO</text></value>
746
+ </field>
747
+ <field k='message'>
748
+ <value><text>group=realtime_search_data, system total, drop_count=0</text></value>
749
+ </field>
750
+ <field k='punct'>
751
+ <value><text>--_::._-____-_=,__,_=</text></value>
752
+ </field>
753
+ <field k='source'>
754
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log</text></value>
755
+ </field>
756
+ <field k='sourcetype'>
757
+ <value><text>splunkd</text></value>
758
+ </field>
759
+ <field k='splunk_server'>
760
+ <value><text>fross-mbp15.local</text></value>
761
+ </field>
762
+ <field k='timeendpos'>
763
+ <value><text>29</text></value>
764
+ </field>
765
+ <field k='timestartpos'>
766
+ <value><text>0</text></value>
767
+ </field>
768
+ </result>
769
+ <result offset='7'>
770
+ <field k='_cd'>
771
+ <value><text>54:9769</text></value>
772
+ </field>
773
+ <field k='_indextime'>
774
+ <value><text>1355946583</text></value>
775
+ </field>
776
+ <field k='_kv'>
777
+ <value><text>1</text></value>
778
+ </field>
779
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 11:49:43.322 -0800 INFO Metrics - group=<sg h='1'>search</sg>_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</v></field>
780
+ <field k='_serial'>
781
+ <value><text>724</text></value>
782
+ </field>
783
+ <field k='_si'>
784
+ <value><text>fross-mbp15.local</text></value>
785
+ <value><text>_internal</text></value>
786
+ </field>
787
+ <field k='_sourcetype'>
788
+ <value><text>splunkd</text></value>
789
+ </field>
790
+ <field k='_subsecond'>
791
+ <value><text>.322</text></value>
792
+ </field>
793
+ <field k='_time'>
794
+ <value><text>2012-12-19T11:49:43.322-08:00</text></value>
795
+ </field>
796
+ <field k='active_hist_searches'>
797
+ <value><text>0</text></value>
798
+ </field>
799
+ <field k='active_realtime_searches'>
800
+ <value><text>0</text></value>
801
+ </field>
802
+ <field k='component'>
803
+ <value><text>Metrics</text></value>
804
+ </field>
805
+ <field k='date_hour'>
806
+ <value><text>11</text></value>
807
+ </field>
808
+ <field k='date_mday'>
809
+ <value><text>19</text></value>
810
+ </field>
811
+ <field k='date_minute'>
812
+ <value><text>49</text></value>
813
+ </field>
814
+ <field k='date_month'>
815
+ <value><text>december</text></value>
816
+ </field>
817
+ <field k='date_second'>
818
+ <value><text>43</text></value>
819
+ </field>
820
+ <field k='date_wday'>
821
+ <value><text>wednesday</text></value>
822
+ </field>
823
+ <field k='date_year'>
824
+ <value><text>2012</text></value>
825
+ </field>
826
+ <field k='date_zone'>
827
+ <value><text>-480</text></value>
828
+ </field>
829
+ <field k='group'>
830
+ <value><text>search_concurrency</text></value>
831
+ </field>
832
+ <field k='host'>
833
+ <value><text>fross-mbp15.local</text></value>
834
+ </field>
835
+ <field k='index'>
836
+ <value h='1'><text>_internal</text></value>
837
+ </field>
838
+ <field k='linecount'>
839
+ <value><text>1</text></value>
840
+ </field>
841
+ <field k='log_level'>
842
+ <value><text>INFO</text></value>
843
+ </field>
844
+ <field k='message'>
845
+ <value><text>group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</text></value>
846
+ </field>
847
+ <field k='punct'>
848
+ <value><text>--_::._-____-_=,__,_=,_=</text></value>
849
+ </field>
850
+ <field k='source'>
851
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log</text></value>
852
+ </field>
853
+ <field k='sourcetype'>
854
+ <value><text>splunkd</text></value>
855
+ </field>
856
+ <field k='splunk_server'>
857
+ <value><text>fross-mbp15.local</text></value>
858
+ </field>
859
+ <field k='timeendpos'>
860
+ <value><text>29</text></value>
861
+ </field>
862
+ <field k='timestartpos'>
863
+ <value><text>0</text></value>
864
+ </field>
865
+ </result>
866
+ <result offset='8'>
867
+ <field k='_cd'>
868
+ <value><text>54:9764</text></value>
869
+ </field>
870
+ <field k='_indextime'>
871
+ <value><text>1355946583</text></value>
872
+ </field>
873
+ <field k='_kv'>
874
+ <value><text>1</text></value>
875
+ </field>
876
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 11:49:43.322 -0800 INFO Metrics - group=realtime_<sg h='1'>search</sg>_data, system total, drop_count=0</v></field>
877
+ <field k='_serial'>
878
+ <value><text>725</text></value>
879
+ </field>
880
+ <field k='_si'>
881
+ <value><text>fross-mbp15.local</text></value>
882
+ <value><text>_internal</text></value>
883
+ </field>
884
+ <field k='_sourcetype'>
885
+ <value><text>splunkd</text></value>
886
+ </field>
887
+ <field k='_subsecond'>
888
+ <value><text>.322</text></value>
889
+ </field>
890
+ <field k='_time'>
891
+ <value><text>2012-12-19T11:49:43.322-08:00</text></value>
892
+ </field>
893
+ <field k='component'>
894
+ <value><text>Metrics</text></value>
895
+ </field>
896
+ <field k='date_hour'>
897
+ <value><text>11</text></value>
898
+ </field>
899
+ <field k='date_mday'>
900
+ <value><text>19</text></value>
901
+ </field>
902
+ <field k='date_minute'>
903
+ <value><text>49</text></value>
904
+ </field>
905
+ <field k='date_month'>
906
+ <value><text>december</text></value>
907
+ </field>
908
+ <field k='date_second'>
909
+ <value><text>43</text></value>
910
+ </field>
911
+ <field k='date_wday'>
912
+ <value><text>wednesday</text></value>
913
+ </field>
914
+ <field k='date_year'>
915
+ <value><text>2012</text></value>
916
+ </field>
917
+ <field k='date_zone'>
918
+ <value><text>-480</text></value>
919
+ </field>
920
+ <field k='drop_count'>
921
+ <value><text>0</text></value>
922
+ </field>
923
+ <field k='group'>
924
+ <value><text>realtime_search_data</text></value>
925
+ </field>
926
+ <field k='host'>
927
+ <value><text>fross-mbp15.local</text></value>
928
+ </field>
929
+ <field k='index'>
930
+ <value h='1'><text>_internal</text></value>
931
+ </field>
932
+ <field k='linecount'>
933
+ <value><text>1</text></value>
934
+ </field>
935
+ <field k='log_level'>
936
+ <value><text>INFO</text></value>
937
+ </field>
938
+ <field k='message'>
939
+ <value><text>group=realtime_search_data, system total, drop_count=0</text></value>
940
+ </field>
941
+ <field k='punct'>
942
+ <value><text>--_::._-____-_=,__,_=</text></value>
943
+ </field>
944
+ <field k='source'>
945
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log</text></value>
946
+ </field>
947
+ <field k='sourcetype'>
948
+ <value><text>splunkd</text></value>
949
+ </field>
950
+ <field k='splunk_server'>
951
+ <value><text>fross-mbp15.local</text></value>
952
+ </field>
953
+ <field k='timeendpos'>
954
+ <value><text>29</text></value>
955
+ </field>
956
+ <field k='timestartpos'>
957
+ <value><text>0</text></value>
958
+ </field>
959
+ </result>
960
+ <result offset='9'>
961
+ <field k='_cd'>
962
+ <value><text>54:10097</text></value>
963
+ </field>
964
+ <field k='_indextime'>
965
+ <value><text>1355946614</text></value>
966
+ </field>
967
+ <field k='_kv'>
968
+ <value><text>1</text></value>
969
+ </field>
970
+ <field k='_raw'><v xml:space='preserve' trunc='0'>12-19-2012 11:50:14.351 -0800 INFO Metrics - group=<sg h='1'>search</sg>_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</v></field>
971
+ <field k='_serial'>
972
+ <value><text>722</text></value>
973
+ </field>
974
+ <field k='_si'>
975
+ <value><text>fross-mbp15.local</text></value>
976
+ <value><text>_internal</text></value>
977
+ </field>
978
+ <field k='_sourcetype'>
979
+ <value><text>splunkd</text></value>
980
+ </field>
981
+ <field k='_subsecond'>
982
+ <value><text>.351</text></value>
983
+ </field>
984
+ <field k='_time'>
985
+ <value><text>2012-12-19T11:50:14.351-08:00</text></value>
986
+ </field>
987
+ <field k='active_hist_searches'>
988
+ <value><text>0</text></value>
989
+ </field>
990
+ <field k='active_realtime_searches'>
991
+ <value><text>0</text></value>
992
+ </field>
993
+ <field k='component'>
994
+ <value><text>Metrics</text></value>
995
+ </field>
996
+ <field k='date_hour'>
997
+ <value><text>11</text></value>
998
+ </field>
999
+ <field k='date_mday'>
1000
+ <value><text>19</text></value>
1001
+ </field>
1002
+ <field k='date_minute'>
1003
+ <value><text>50</text></value>
1004
+ </field>
1005
+ <field k='date_month'>
1006
+ <value><text>december</text></value>
1007
+ </field>
1008
+ <field k='date_second'>
1009
+ <value><text>14</text></value>
1010
+ </field>
1011
+ <field k='date_wday'>
1012
+ <value><text>wednesday</text></value>
1013
+ </field>
1014
+ <field k='date_year'>
1015
+ <value><text>2012</text></value>
1016
+ </field>
1017
+ <field k='date_zone'>
1018
+ <value><text>-480</text></value>
1019
+ </field>
1020
+ <field k='group'>
1021
+ <value><text>search_concurrency</text></value>
1022
+ </field>
1023
+ <field k='host'>
1024
+ <value><text>fross-mbp15.local</text></value>
1025
+ </field>
1026
+ <field k='index'>
1027
+ <value h='1'><text>_internal</text></value>
1028
+ </field>
1029
+ <field k='linecount'>
1030
+ <value><text>1</text></value>
1031
+ </field>
1032
+ <field k='log_level'>
1033
+ <value><text>INFO</text></value>
1034
+ </field>
1035
+ <field k='message'>
1036
+ <value><text>group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</text></value>
1037
+ </field>
1038
+ <field k='punct'>
1039
+ <value><text>--_::._-____-_=,__,_=,_=</text></value>
1040
+ </field>
1041
+ <field k='source'>
1042
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/metrics.log</text></value>
1043
+ </field>
1044
+ <field k='sourcetype'>
1045
+ <value><text>splunkd</text></value>
1046
+ </field>
1047
+ <field k='splunk_server'>
1048
+ <value><text>fross-mbp15.local</text></value>
1049
+ </field>
1050
+ <field k='timeendpos'>
1051
+ <value><text>29</text></value>
1052
+ </field>
1053
+ <field k='timestartpos'>
1054
+ <value><text>0</text></value>
1055
+ </field>
1056
+ </result>
1057
+ </results>