splunk-sdk-ruby 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (81) hide show
  1. data/CHANGELOG.md +160 -0
  2. data/Gemfile +8 -0
  3. data/LICENSE +177 -0
  4. data/README.md +310 -0
  5. data/Rakefile +40 -0
  6. data/examples/1_connect.rb +51 -0
  7. data/examples/2_manage.rb +103 -0
  8. data/examples/3_blocking_searches.rb +82 -0
  9. data/examples/4_asynchronous_searches.rb +79 -0
  10. data/examples/5_stream_data_to_splunk.rb +79 -0
  11. data/lib/splunk-sdk-ruby.rb +47 -0
  12. data/lib/splunk-sdk-ruby/ambiguous_entity_reference.rb +28 -0
  13. data/lib/splunk-sdk-ruby/atomfeed.rb +323 -0
  14. data/lib/splunk-sdk-ruby/collection.rb +417 -0
  15. data/lib/splunk-sdk-ruby/collection/apps.rb +35 -0
  16. data/lib/splunk-sdk-ruby/collection/case_insensitive_collection.rb +58 -0
  17. data/lib/splunk-sdk-ruby/collection/configuration_file.rb +50 -0
  18. data/lib/splunk-sdk-ruby/collection/configurations.rb +80 -0
  19. data/lib/splunk-sdk-ruby/collection/jobs.rb +136 -0
  20. data/lib/splunk-sdk-ruby/collection/messages.rb +51 -0
  21. data/lib/splunk-sdk-ruby/context.rb +522 -0
  22. data/lib/splunk-sdk-ruby/entity.rb +260 -0
  23. data/lib/splunk-sdk-ruby/entity/index.rb +191 -0
  24. data/lib/splunk-sdk-ruby/entity/job.rb +339 -0
  25. data/lib/splunk-sdk-ruby/entity/message.rb +36 -0
  26. data/lib/splunk-sdk-ruby/entity/saved_search.rb +71 -0
  27. data/lib/splunk-sdk-ruby/entity/stanza.rb +45 -0
  28. data/lib/splunk-sdk-ruby/entity_not_ready.rb +26 -0
  29. data/lib/splunk-sdk-ruby/illegal_operation.rb +27 -0
  30. data/lib/splunk-sdk-ruby/namespace.rb +239 -0
  31. data/lib/splunk-sdk-ruby/resultsreader.rb +716 -0
  32. data/lib/splunk-sdk-ruby/service.rb +339 -0
  33. data/lib/splunk-sdk-ruby/splunk_http_error.rb +49 -0
  34. data/lib/splunk-sdk-ruby/synonyms.rb +50 -0
  35. data/lib/splunk-sdk-ruby/version.rb +27 -0
  36. data/lib/splunk-sdk-ruby/xml_shim.rb +117 -0
  37. data/splunk-sdk-ruby.gemspec +27 -0
  38. data/test/atom_test_data.rb +472 -0
  39. data/test/data/atom/atom_feed_with_message.xml +19 -0
  40. data/test/data/atom/atom_with_feed.xml +99 -0
  41. data/test/data/atom/atom_with_several_entries.xml +101 -0
  42. data/test/data/atom/atom_with_simple_entries.xml +30 -0
  43. data/test/data/atom/atom_without_feed.xml +248 -0
  44. data/test/data/export/4.2.5/export_results.xml +88 -0
  45. data/test/data/export/4.3.5/export_results.xml +87 -0
  46. data/test/data/export/5.0.1/export_results.xml +78 -0
  47. data/test/data/export/5.0.1/nonreporting.xml +232 -0
  48. data/test/data/results/4.2.5/results-empty.xml +0 -0
  49. data/test/data/results/4.2.5/results-preview.xml +255 -0
  50. data/test/data/results/4.2.5/results.xml +336 -0
  51. data/test/data/results/4.3.5/results-empty.xml +0 -0
  52. data/test/data/results/4.3.5/results-preview.xml +1057 -0
  53. data/test/data/results/4.3.5/results.xml +626 -0
  54. data/test/data/results/5.0.2/results-empty.xml +1 -0
  55. data/test/data/results/5.0.2/results-empty_preview.xml +1 -0
  56. data/test/data/results/5.0.2/results-preview.xml +448 -0
  57. data/test/data/results/5.0.2/results.xml +501 -0
  58. data/test/export_test_data.json +360 -0
  59. data/test/resultsreader_test_data.json +1119 -0
  60. data/test/services.server.info.xml +43 -0
  61. data/test/services.xml +111 -0
  62. data/test/test_atomfeed.rb +71 -0
  63. data/test/test_collection.rb +278 -0
  64. data/test/test_configuration_file.rb +124 -0
  65. data/test/test_context.rb +119 -0
  66. data/test/test_entity.rb +95 -0
  67. data/test/test_helper.rb +250 -0
  68. data/test/test_http_error.rb +52 -0
  69. data/test/test_index.rb +91 -0
  70. data/test/test_jobs.rb +319 -0
  71. data/test/test_messages.rb +17 -0
  72. data/test/test_namespace.rb +188 -0
  73. data/test/test_restarts.rb +49 -0
  74. data/test/test_resultsreader.rb +106 -0
  75. data/test/test_roles.rb +41 -0
  76. data/test/test_saved_searches.rb +119 -0
  77. data/test/test_service.rb +65 -0
  78. data/test/test_users.rb +33 -0
  79. data/test/test_xml_shim.rb +28 -0
  80. data/test/testfile.txt +1 -0
  81. metadata +200 -0
data/test/data/results/4.3.5/results.xml ADDED
@@ -0,0 +1,626 @@
1
+ <?xml version='1.0' encoding='UTF-8'?>
2
+ <results preview='0'>
3
+ <meta>
4
+ <fieldOrder>
5
+ <field>_cd</field>
6
+ <field>_indextime</field>
7
+ <field>_kv</field>
8
+ <field>_raw</field>
9
+ <field>_serial</field>
10
+ <field>_si</field>
11
+ <field>_sourcetype</field>
12
+ <field>_subsecond</field>
13
+ <field>_time</field>
14
+ <field>bytes</field>
15
+ <field>client_app</field>
16
+ <field>clientip</field>
17
+ <field>cookie</field>
18
+ <field>count</field>
19
+ <field>date_hour</field>
20
+ <field>date_mday</field>
21
+ <field>date_minute</field>
22
+ <field>date_month</field>
23
+ <field>date_second</field>
24
+ <field>date_wday</field>
25
+ <field>date_year</field>
26
+ <field>date_zone</field>
27
+ <field>display_row_numbers</field>
28
+ <field>earliest</field>
29
+ <field>enable_event_actions</field>
30
+ <field>enable_field_actions</field>
31
+ <field>entity_name</field>
32
+ <field>eventtype</field>
33
+ <field>field_list</field>
34
+ <field>file</field>
35
+ <field>fillcontents</field>
36
+ <field>host</field>
37
+ <field>ident</field>
38
+ <field>index</field>
39
+ <field>latest</field>
40
+ <field>linecount</field>
41
+ <field>max_lines</field>
42
+ <field>max_lines_constraint</field>
43
+ <field>method</field>
44
+ <field>min_freq</field>
45
+ <field>min_lines</field>
46
+ <field>offset</field>
47
+ <field>other</field>
48
+ <field>output_mode</field>
49
+ <field>output_time_format</field>
50
+ <field>punct</field>
51
+ <field>q</field>
52
+ <field>referer</field>
53
+ <field>referer_domain</field>
54
+ <field>req_time</field>
55
+ <field>reverse_order</field>
56
+ <field>root</field>
57
+ <field>s</field>
58
+ <field>segmentation</field>
59
+ <field>show_empty_fields</field>
60
+ <field>sid</field>
61
+ <field>source</field>
62
+ <field>sourcetype</field>
63
+ <field>spent</field>
64
+ <field>splunk_server</field>
65
+ <field>status</field>
66
+ <field>time_format</field>
67
+ <field>timeendpos</field>
68
+ <field>timestartpos</field>
69
+ <field>truncation_mode</field>
70
+ <field>uri</field>
71
+ <field>uri_domain</field>
72
+ <field>uri_path</field>
73
+ <field>uri_query</field>
74
+ <field>user</field>
75
+ <field>useragent</field>
76
+ <field>version</field>
77
+ </fieldOrder>
78
+ </meta>
79
+ <result offset='0'>
80
+ <field k='_cd'>
81
+ <value><text>54:23786</text></value>
82
+ </field>
83
+ <field k='_indextime'>
84
+ <value><text>1355946940</text></value>
85
+ </field>
86
+ <field k='_kv'>
87
+ <value><text>1</text></value>
88
+ </field>
89
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:55:39.296 -0800] &quot;POST /en-US/api/shelper HTTP/1.1&quot; 200 1398 &quot;http://localhost:8000/en-US/app/<sg h='1'>search</sg>/flashtimeline?q=<sg h='1'>search</sg>%20<sg h='1'>search</sg>%20index%3D_internal%20%7C%20head%2010&amp;earliest=rt-1h&amp;latest=rt&quot; &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0&quot; - 50d21bbb4b5224c10 3ms</v></field>
90
+ <field k='_serial'>
91
+ <value><text>0</text></value>
92
+ </field>
93
+ <field k='_si'>
94
+ <value><text>fross-mbp15.local</text></value>
95
+ <value><text>_internal</text></value>
96
+ </field>
97
+ <field k='_sourcetype'>
98
+ <value><text>splunk_web_access</text></value>
99
+ </field>
100
+ <field k='_subsecond'>
101
+ <value><text>.296</text></value>
102
+ </field>
103
+ <field k='_time'>
104
+ <value><text>2012-12-19T11:55:39.296-08:00</text></value>
105
+ </field>
106
+ <field k='bytes'>
107
+ <value><text>1398</text></value>
108
+ </field>
109
+ <field k='clientip'>
110
+ <value><text>127.0.0.1</text></value>
111
+ </field>
112
+ <field k='date_hour'>
113
+ <value><text>11</text></value>
114
+ </field>
115
+ <field k='date_mday'>
116
+ <value><text>19</text></value>
117
+ </field>
118
+ <field k='date_minute'>
119
+ <value><text>55</text></value>
120
+ </field>
121
+ <field k='date_month'>
122
+ <value><text>december</text></value>
123
+ </field>
124
+ <field k='date_second'>
125
+ <value><text>39</text></value>
126
+ </field>
127
+ <field k='date_wday'>
128
+ <value><text>wednesday</text></value>
129
+ </field>
130
+ <field k='date_year'>
131
+ <value><text>2012</text></value>
132
+ </field>
133
+ <field k='date_zone'>
134
+ <value><text>-480</text></value>
135
+ </field>
136
+ <field k='earliest'>
137
+ <value><text>rt-1h</text></value>
138
+ </field>
139
+ <field k='file'>
140
+ <value><text>shelper</text></value>
141
+ </field>
142
+ <field k='host'>
143
+ <value><text>fross-mbp15.local</text></value>
144
+ </field>
145
+ <field k='ident'>
146
+ <value><text>-</text></value>
147
+ </field>
148
+ <field k='index'>
149
+ <value h='1'><text>_internal</text></value>
150
+ </field>
151
+ <field k='latest'>
152
+ <value><text>rt</text></value>
153
+ </field>
154
+ <field k='linecount'>
155
+ <value><text>1</text></value>
156
+ </field>
157
+ <field k='method'>
158
+ <value><text>POST</text></value>
159
+ </field>
160
+ <field k='other'>
161
+ <value><text>- 50d21bbb4b5224c10 3ms</text></value>
162
+ </field>
163
+ <field k='punct'>
164
+ <value><text>..._-__[//:::._-]_&quot;_/-//_/.&quot;___&quot;://:/-///?=%%%%%%%</text></value>
165
+ </field>
166
+ <field k='q'>
167
+ <value><text>search%20search%20index%3D_internal%20%7C%20head%2010</text></value>
168
+ </field>
169
+ <field k='referer'>
170
+ <value><text>http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&amp;earliest=rt-1h&amp;latest=rt</text></value>
171
+ </field>
172
+ <field k='referer_domain'>
173
+ <value><text>http://localhost:8000</text></value>
174
+ </field>
175
+ <field k='req_time'>
176
+ <value><text>19/Dec/2012:11:55:39.296 -0800</text></value>
177
+ </field>
178
+ <field k='root'>
179
+ <value><text>en-US</text></value>
180
+ </field>
181
+ <field k='source'>
182
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/web_access.log</text></value>
183
+ </field>
184
+ <field k='sourcetype'>
185
+ <value><text>splunk_web_access</text></value>
186
+ </field>
187
+ <field k='spent'>
188
+ <value><text>3</text></value>
189
+ </field>
190
+ <field k='splunk_server'>
191
+ <value><text>fross-mbp15.local</text></value>
192
+ </field>
193
+ <field k='status'>
194
+ <value><text>200</text></value>
195
+ </field>
196
+ <field k='timeendpos'>
197
+ <value><text>49</text></value>
198
+ </field>
199
+ <field k='timestartpos'>
200
+ <value><text>19</text></value>
201
+ </field>
202
+ <field k='uri'>
203
+ <value><text>/en-US/api/shelper</text></value>
204
+ </field>
205
+ <field k='uri_path'>
206
+ <value><text>/en-US/api/shelper</text></value>
207
+ </field>
208
+ <field k='user'>
209
+ <value><text>admin</text></value>
210
+ </field>
211
+ <field k='useragent'>
212
+ <value><text>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0</text></value>
213
+ </field>
214
+ <field k='version'>
215
+ <value><text>HTTP/1.1</text></value>
216
+ </field>
217
+ </result>
218
+ <result offset='1'>
219
+ <field k='_cd'>
220
+ <value><text>54:23689</text></value>
221
+ </field>
222
+ <field k='_indextime'>
223
+ <value><text>1355946940</text></value>
224
+ </field>
225
+ <field k='_kv'>
226
+ <value><text>1</text></value>
227
+ </field>
228
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:55:39.265 -0800] &quot;GET /services/<sg h='1'>search</sg>/jobs/rt_1355946914.13 HTTP/1.1&quot; 200 10957 - - - 4ms</v></field>
229
+ <field k='_serial'>
230
+ <value><text>1</text></value>
231
+ </field>
232
+ <field k='_si'>
233
+ <value><text>fross-mbp15.local</text></value>
234
+ <value><text>_internal</text></value>
235
+ </field>
236
+ <field k='_sourcetype'>
237
+ <value><text>splunkd_access</text></value>
238
+ </field>
239
+ <field k='_subsecond'>
240
+ <value><text>.265</text></value>
241
+ </field>
242
+ <field k='_time'>
243
+ <value><text>2012-12-19T11:55:39.265-08:00</text></value>
244
+ </field>
245
+ <field k='bytes'>
246
+ <value><text>10957</text></value>
247
+ </field>
248
+ <field k='clientip'>
249
+ <value><text>127.0.0.1</text></value>
250
+ </field>
251
+ <field k='date_hour'>
252
+ <value><text>11</text></value>
253
+ </field>
254
+ <field k='date_mday'>
255
+ <value><text>19</text></value>
256
+ </field>
257
+ <field k='date_minute'>
258
+ <value><text>55</text></value>
259
+ </field>
260
+ <field k='date_month'>
261
+ <value><text>december</text></value>
262
+ </field>
263
+ <field k='date_second'>
264
+ <value><text>39</text></value>
265
+ </field>
266
+ <field k='date_wday'>
267
+ <value><text>wednesday</text></value>
268
+ </field>
269
+ <field k='date_year'>
270
+ <value><text>2012</text></value>
271
+ </field>
272
+ <field k='date_zone'>
273
+ <value><text>-480</text></value>
274
+ </field>
275
+ <field k='eventtype'>
276
+ <value><text>splunkd-access</text></value>
277
+ </field>
278
+ <field k='file'>
279
+ <value><text>rt_1355946914.13</text></value>
280
+ </field>
281
+ <field k='host'>
282
+ <value><text>fross-mbp15.local</text></value>
283
+ </field>
284
+ <field k='ident'>
285
+ <value><text>-</text></value>
286
+ </field>
287
+ <field k='index'>
288
+ <value h='1'><text>_internal</text></value>
289
+ </field>
290
+ <field k='linecount'>
291
+ <value><text>1</text></value>
292
+ </field>
293
+ <field k='method'>
294
+ <value><text>GET</text></value>
295
+ </field>
296
+ <field k='other'>
297
+ <value><text>- - - 4ms</text></value>
298
+ </field>
299
+ <field k='punct'>
300
+ <value><text>..._-__[//:::._-]_&quot;_////._/.&quot;___-_-_-_</text></value>
301
+ </field>
302
+ <field k='req_time'>
303
+ <value><text>19/Dec/2012:11:55:39.265 -0800</text></value>
304
+ </field>
305
+ <field k='root'>
306
+ <value><text>services</text></value>
307
+ </field>
308
+ <field k='source'>
309
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log</text></value>
310
+ </field>
311
+ <field k='sourcetype'>
312
+ <value><text>splunkd_access</text></value>
313
+ </field>
314
+ <field k='spent'>
315
+ <value><text>4</text></value>
316
+ </field>
317
+ <field k='splunk_server'>
318
+ <value><text>fross-mbp15.local</text></value>
319
+ </field>
320
+ <field k='status'>
321
+ <value><text>200</text></value>
322
+ </field>
323
+ <field k='timeendpos'>
324
+ <value><text>49</text></value>
325
+ </field>
326
+ <field k='timestartpos'>
327
+ <value><text>19</text></value>
328
+ </field>
329
+ <field k='uri'>
330
+ <value><text>/services/search/jobs/rt_1355946914.13</text></value>
331
+ </field>
332
+ <field k='uri_path'>
333
+ <value><text>/services/search/jobs/rt_1355946914.13</text></value>
334
+ </field>
335
+ <field k='user'>
336
+ <value><text>admin</text></value>
337
+ </field>
338
+ <field k='version'>
339
+ <value><text>HTTP/1.1</text></value>
340
+ </field>
341
+ </result>
342
+ <result offset='2'>
343
+ <field k='_cd'>
344
+ <value><text>54:23682</text></value>
345
+ </field>
346
+ <field k='_indextime'>
347
+ <value><text>1355946940</text></value>
348
+ </field>
349
+ <field k='_kv'>
350
+ <value><text>1</text></value>
351
+ </field>
352
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:55:39.258 -0800] &quot;GET /servicesNS/admin/<sg h='1'>search</sg>/properties/event_renderers?fillcontents=1 HTTP/1.1&quot; 200 3657 - - - 1ms</v></field>
353
+ <field k='_serial'>
354
+ <value><text>2</text></value>
355
+ </field>
356
+ <field k='_si'>
357
+ <value><text>fross-mbp15.local</text></value>
358
+ <value><text>_internal</text></value>
359
+ </field>
360
+ <field k='_sourcetype'>
361
+ <value><text>splunkd_access</text></value>
362
+ </field>
363
+ <field k='_subsecond'>
364
+ <value><text>.258</text></value>
365
+ </field>
366
+ <field k='_time'>
367
+ <value><text>2012-12-19T11:55:39.258-08:00</text></value>
368
+ </field>
369
+ <field k='bytes'>
370
+ <value><text>3657</text></value>
371
+ </field>
372
+ <field k='clientip'>
373
+ <value><text>127.0.0.1</text></value>
374
+ </field>
375
+ <field k='date_hour'>
376
+ <value><text>11</text></value>
377
+ </field>
378
+ <field k='date_mday'>
379
+ <value><text>19</text></value>
380
+ </field>
381
+ <field k='date_minute'>
382
+ <value><text>55</text></value>
383
+ </field>
384
+ <field k='date_month'>
385
+ <value><text>december</text></value>
386
+ </field>
387
+ <field k='date_second'>
388
+ <value><text>39</text></value>
389
+ </field>
390
+ <field k='date_wday'>
391
+ <value><text>wednesday</text></value>
392
+ </field>
393
+ <field k='date_year'>
394
+ <value><text>2012</text></value>
395
+ </field>
396
+ <field k='date_zone'>
397
+ <value><text>-480</text></value>
398
+ </field>
399
+ <field k='eventtype'>
400
+ <value><text>splunkd-access</text></value>
401
+ </field>
402
+ <field k='file'>
403
+ <value><text>event_renderers</text></value>
404
+ </field>
405
+ <field k='fillcontents'>
406
+ <value><text>1</text></value>
407
+ </field>
408
+ <field k='host'>
409
+ <value><text>fross-mbp15.local</text></value>
410
+ </field>
411
+ <field k='ident'>
412
+ <value><text>-</text></value>
413
+ </field>
414
+ <field k='index'>
415
+ <value h='1'><text>_internal</text></value>
416
+ </field>
417
+ <field k='linecount'>
418
+ <value><text>1</text></value>
419
+ </field>
420
+ <field k='method'>
421
+ <value><text>GET</text></value>
422
+ </field>
423
+ <field k='other'>
424
+ <value><text>- - - 1ms</text></value>
425
+ </field>
426
+ <field k='punct'>
427
+ <value><text>..._-__[//:::._-]_&quot;_/////?=_/.&quot;___-_-_-_</text></value>
428
+ </field>
429
+ <field k='req_time'>
430
+ <value><text>19/Dec/2012:11:55:39.258 -0800</text></value>
431
+ </field>
432
+ <field k='root'>
433
+ <value><text>servicesNS</text></value>
434
+ </field>
435
+ <field k='source'>
436
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log</text></value>
437
+ </field>
438
+ <field k='sourcetype'>
439
+ <value><text>splunkd_access</text></value>
440
+ </field>
441
+ <field k='spent'>
442
+ <value><text>1</text></value>
443
+ </field>
444
+ <field k='splunk_server'>
445
+ <value><text>fross-mbp15.local</text></value>
446
+ </field>
447
+ <field k='status'>
448
+ <value><text>200</text></value>
449
+ </field>
450
+ <field k='timeendpos'>
451
+ <value><text>49</text></value>
452
+ </field>
453
+ <field k='timestartpos'>
454
+ <value><text>19</text></value>
455
+ </field>
456
+ <field k='uri'>
457
+ <value><text>/servicesNS/admin/search/properties/event_renderers?fillcontents=1</text></value>
458
+ </field>
459
+ <field k='uri_path'>
460
+ <value><text>/servicesNS/admin/search/properties/event_renderers</text></value>
461
+ </field>
462
+ <field k='uri_query'>
463
+ <value><text>fillcontents=1</text></value>
464
+ </field>
465
+ <field k='user'>
466
+ <value><text>admin</text></value>
467
+ </field>
468
+ <field k='version'>
469
+ <value><text>HTTP/1.1</text></value>
470
+ </field>
471
+ </result>
472
+ <result offset='3'>
473
+ <field k='_cd'>
474
+ <value><text>54:23670</text></value>
475
+ </field>
476
+ <field k='_indextime'>
477
+ <value><text>1355946940</text></value>
478
+ </field>
479
+ <field k='_kv'>
480
+ <value><text>1</text></value>
481
+ </field>
482
+ <field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:55:39.231 -0800] &quot;GET /services/<sg h='1'>search</sg>/jobs/rt_1355946914.13/events?count=0&amp;segmentation=full&amp;output_mode=xml&amp;time_format=%25s.%25Q&amp;max_lines=10&amp;show_empty_fields=True&amp;offset=-10&amp;output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&amp;field_list=&amp;truncation_mode=abstract HTTP/1.1&quot; 200 32837 - - - 6ms</v></field>
483
+ <field k='_serial'>
484
+ <value><text>3</text></value>
485
+ </field>
486
+ <field k='_si'>
487
+ <value><text>fross-mbp15.local</text></value>
488
+ <value><text>_internal</text></value>
489
+ </field>
490
+ <field k='_sourcetype'>
491
+ <value><text>splunkd_access</text></value>
492
+ </field>
493
+ <field k='_subsecond'>
494
+ <value><text>.231</text></value>
495
+ </field>
496
+ <field k='_time'>
497
+ <value><text>2012-12-19T11:55:39.231-08:00</text></value>
498
+ </field>
499
+ <field k='bytes'>
500
+ <value><text>32837</text></value>
501
+ </field>
502
+ <field k='clientip'>
503
+ <value><text>127.0.0.1</text></value>
504
+ </field>
505
+ <field k='count'>
506
+ <value><text>0</text></value>
507
+ </field>
508
+ <field k='date_hour'>
509
+ <value><text>11</text></value>
510
+ </field>
511
+ <field k='date_mday'>
512
+ <value><text>19</text></value>
513
+ </field>
514
+ <field k='date_minute'>
515
+ <value><text>55</text></value>
516
+ </field>
517
+ <field k='date_month'>
518
+ <value><text>december</text></value>
519
+ </field>
520
+ <field k='date_second'>
521
+ <value><text>39</text></value>
522
+ </field>
523
+ <field k='date_wday'>
524
+ <value><text>wednesday</text></value>
525
+ </field>
526
+ <field k='date_year'>
527
+ <value><text>2012</text></value>
528
+ </field>
529
+ <field k='date_zone'>
530
+ <value><text>-480</text></value>
531
+ </field>
532
+ <field k='eventtype'>
533
+ <value><text>splunkd-access</text></value>
534
+ </field>
535
+ <field k='file'>
536
+ <value><text>events</text></value>
537
+ </field>
538
+ <field k='host'>
539
+ <value><text>fross-mbp15.local</text></value>
540
+ </field>
541
+ <field k='ident'>
542
+ <value><text>-</text></value>
543
+ </field>
544
+ <field k='index'>
545
+ <value h='1'><text>_internal</text></value>
546
+ </field>
547
+ <field k='linecount'>
548
+ <value><text>1</text></value>
549
+ </field>
550
+ <field k='max_lines'>
551
+ <value><text>10</text></value>
552
+ </field>
553
+ <field k='method'>
554
+ <value><text>GET</text></value>
555
+ </field>
556
+ <field k='offset'>
557
+ <value><text>-10</text></value>
558
+ </field>
559
+ <field k='other'>
560
+ <value><text>- - - 6ms</text></value>
561
+ </field>
562
+ <field k='output_mode'>
563
+ <value><text>xml</text></value>
564
+ </field>
565
+ <field k='output_time_format'>
566
+ <value><text>%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z</text></value>
567
+ </field>
568
+ <field k='punct'>
569
+ <value><text>..._-__[//:::._-]_&quot;_////./?=&amp;=&amp;=&amp;=%.%&amp;=&amp;=&amp;=-&amp;=%-%-</text></value>
570
+ </field>
571
+ <field k='req_time'>
572
+ <value><text>19/Dec/2012:11:55:39.231 -0800</text></value>
573
+ </field>
574
+ <field k='root'>
575
+ <value><text>services</text></value>
576
+ </field>
577
+ <field k='segmentation'>
578
+ <value><text>full</text></value>
579
+ </field>
580
+ <field k='show_empty_fields'>
581
+ <value><text>True</text></value>
582
+ </field>
583
+ <field k='source'>
584
+ <value><text>/Users/fross/splunks/splunk-4.3.5/var/log/splunk/splunkd_access.log</text></value>
585
+ </field>
586
+ <field k='sourcetype'>
587
+ <value><text>splunkd_access</text></value>
588
+ </field>
589
+ <field k='spent'>
590
+ <value><text>6</text></value>
591
+ </field>
592
+ <field k='splunk_server'>
593
+ <value><text>fross-mbp15.local</text></value>
594
+ </field>
595
+ <field k='status'>
596
+ <value><text>200</text></value>
597
+ </field>
598
+ <field k='time_format'>
599
+ <value><text>%25s.%25Q</text></value>
600
+ </field>
601
+ <field k='timeendpos'>
602
+ <value><text>49</text></value>
603
+ </field>
604
+ <field k='timestartpos'>
605
+ <value><text>19</text></value>
606
+ </field>
607
+ <field k='truncation_mode'>
608
+ <value><text>abstract</text></value>
609
+ </field>
610
+ <field k='uri'>
611
+ <value><text>/services/search/jobs/rt_1355946914.13/events?count=0&amp;segmentation=full&amp;output_mode=xml&amp;time_format=%25s.%25Q&amp;max_lines=10&amp;show_empty_fields=True&amp;offset=-10&amp;output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&amp;field_list=&amp;truncation_mode=abstract</text></value>
612
+ </field>
613
+ <field k='uri_path'>
614
+ <value><text>/services/search/jobs/rt_1355946914.13/events</text></value>
615
+ </field>
616
+ <field k='uri_query'>
617
+ <value><text>count=0&amp;segmentation=full&amp;output_mode=xml&amp;time_format=%25s.%25Q&amp;max_lines=10&amp;show_empty_fields=True&amp;offset=-10&amp;output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&amp;field_list=&amp;truncation_mode=abstract</text></value>
618
+ </field>
619
+ <field k='user'>
620
+ <value><text>admin</text></value>
621
+ </field>
622
+ <field k='version'>
623
+ <value><text>HTTP/1.1</text></value>
624
+ </field>
625
+ </result>
626
+ </results>