splunk-sdk-ruby 0.1.0
Sign up to get free protection for your applications and to get access to all the features.
- data/CHANGELOG.md +160 -0
- data/Gemfile +8 -0
- data/LICENSE +177 -0
- data/README.md +310 -0
- data/Rakefile +40 -0
- data/examples/1_connect.rb +51 -0
- data/examples/2_manage.rb +103 -0
- data/examples/3_blocking_searches.rb +82 -0
- data/examples/4_asynchronous_searches.rb +79 -0
- data/examples/5_stream_data_to_splunk.rb +79 -0
- data/lib/splunk-sdk-ruby.rb +47 -0
- data/lib/splunk-sdk-ruby/ambiguous_entity_reference.rb +28 -0
- data/lib/splunk-sdk-ruby/atomfeed.rb +323 -0
- data/lib/splunk-sdk-ruby/collection.rb +417 -0
- data/lib/splunk-sdk-ruby/collection/apps.rb +35 -0
- data/lib/splunk-sdk-ruby/collection/case_insensitive_collection.rb +58 -0
- data/lib/splunk-sdk-ruby/collection/configuration_file.rb +50 -0
- data/lib/splunk-sdk-ruby/collection/configurations.rb +80 -0
- data/lib/splunk-sdk-ruby/collection/jobs.rb +136 -0
- data/lib/splunk-sdk-ruby/collection/messages.rb +51 -0
- data/lib/splunk-sdk-ruby/context.rb +522 -0
- data/lib/splunk-sdk-ruby/entity.rb +260 -0
- data/lib/splunk-sdk-ruby/entity/index.rb +191 -0
- data/lib/splunk-sdk-ruby/entity/job.rb +339 -0
- data/lib/splunk-sdk-ruby/entity/message.rb +36 -0
- data/lib/splunk-sdk-ruby/entity/saved_search.rb +71 -0
- data/lib/splunk-sdk-ruby/entity/stanza.rb +45 -0
- data/lib/splunk-sdk-ruby/entity_not_ready.rb +26 -0
- data/lib/splunk-sdk-ruby/illegal_operation.rb +27 -0
- data/lib/splunk-sdk-ruby/namespace.rb +239 -0
- data/lib/splunk-sdk-ruby/resultsreader.rb +716 -0
- data/lib/splunk-sdk-ruby/service.rb +339 -0
- data/lib/splunk-sdk-ruby/splunk_http_error.rb +49 -0
- data/lib/splunk-sdk-ruby/synonyms.rb +50 -0
- data/lib/splunk-sdk-ruby/version.rb +27 -0
- data/lib/splunk-sdk-ruby/xml_shim.rb +117 -0
- data/splunk-sdk-ruby.gemspec +27 -0
- data/test/atom_test_data.rb +472 -0
- data/test/data/atom/atom_feed_with_message.xml +19 -0
- data/test/data/atom/atom_with_feed.xml +99 -0
- data/test/data/atom/atom_with_several_entries.xml +101 -0
- data/test/data/atom/atom_with_simple_entries.xml +30 -0
- data/test/data/atom/atom_without_feed.xml +248 -0
- data/test/data/export/4.2.5/export_results.xml +88 -0
- data/test/data/export/4.3.5/export_results.xml +87 -0
- data/test/data/export/5.0.1/export_results.xml +78 -0
- data/test/data/export/5.0.1/nonreporting.xml +232 -0
- data/test/data/results/4.2.5/results-empty.xml +0 -0
- data/test/data/results/4.2.5/results-preview.xml +255 -0
- data/test/data/results/4.2.5/results.xml +336 -0
- data/test/data/results/4.3.5/results-empty.xml +0 -0
- data/test/data/results/4.3.5/results-preview.xml +1057 -0
- data/test/data/results/4.3.5/results.xml +626 -0
- data/test/data/results/5.0.2/results-empty.xml +1 -0
- data/test/data/results/5.0.2/results-empty_preview.xml +1 -0
- data/test/data/results/5.0.2/results-preview.xml +448 -0
- data/test/data/results/5.0.2/results.xml +501 -0
- data/test/export_test_data.json +360 -0
- data/test/resultsreader_test_data.json +1119 -0
- data/test/services.server.info.xml +43 -0
- data/test/services.xml +111 -0
- data/test/test_atomfeed.rb +71 -0
- data/test/test_collection.rb +278 -0
- data/test/test_configuration_file.rb +124 -0
- data/test/test_context.rb +119 -0
- data/test/test_entity.rb +95 -0
- data/test/test_helper.rb +250 -0
- data/test/test_http_error.rb +52 -0
- data/test/test_index.rb +91 -0
- data/test/test_jobs.rb +319 -0
- data/test/test_messages.rb +17 -0
- data/test/test_namespace.rb +188 -0
- data/test/test_restarts.rb +49 -0
- data/test/test_resultsreader.rb +106 -0
- data/test/test_roles.rb +41 -0
- data/test/test_saved_searches.rb +119 -0
- data/test/test_service.rb +65 -0
- data/test/test_users.rb +33 -0
- data/test/test_xml_shim.rb +28 -0
- data/test/testfile.txt +1 -0
- metadata +200 -0
@@ -0,0 +1,501 @@
|
|
1
|
+
<?xml version='1.0' encoding='UTF-8'?>
|
2
|
+
<results preview='0'>
|
3
|
+
<meta>
|
4
|
+
<fieldOrder>
|
5
|
+
<field>_bkt</field>
|
6
|
+
<field>_cd</field>
|
7
|
+
<field>_indextime</field>
|
8
|
+
<field>_kv</field>
|
9
|
+
<field>_raw</field>
|
10
|
+
<field>_serial</field>
|
11
|
+
<field>_si</field>
|
12
|
+
<field>_sourcetype</field>
|
13
|
+
<field>_subsecond</field>
|
14
|
+
<field>_time</field>
|
15
|
+
<field>abandoned_channels</field>
|
16
|
+
<field>active_hist_searches</field>
|
17
|
+
<field>active_realtime_searches</field>
|
18
|
+
<field>average_kbps</field>
|
19
|
+
<field>avg_age</field>
|
20
|
+
<field>bytes</field>
|
21
|
+
<field>chillOrFreeze</field>
|
22
|
+
<field>clientip</field>
|
23
|
+
<field>component</field>
|
24
|
+
<field>cookie</field>
|
25
|
+
<field>current_size</field>
|
26
|
+
<field>current_size_kb</field>
|
27
|
+
<field>date_hour</field>
|
28
|
+
<field>date_mday</field>
|
29
|
+
<field>date_minute</field>
|
30
|
+
<field>date_month</field>
|
31
|
+
<field>date_second</field>
|
32
|
+
<field>date_wday</field>
|
33
|
+
<field>date_year</field>
|
34
|
+
<field>date_zone</field>
|
35
|
+
<field>drop_count</field>
|
36
|
+
<field>eps</field>
|
37
|
+
<field>ev</field>
|
38
|
+
<field>eventtype</field>
|
39
|
+
<field>file</field>
|
40
|
+
<field>flushBlockSig</field>
|
41
|
+
<field>fork_recovermetadata</field>
|
42
|
+
<field>group</field>
|
43
|
+
<field>host</field>
|
44
|
+
<field>ident</field>
|
45
|
+
<field>inactive_channels</field>
|
46
|
+
<field>index</field>
|
47
|
+
<field>instantaneous_eps</field>
|
48
|
+
<field>instantaneous_kbps</field>
|
49
|
+
<field>kb</field>
|
50
|
+
<field>kbps</field>
|
51
|
+
<field>largest_size</field>
|
52
|
+
<field>linecount</field>
|
53
|
+
<field>load_average</field>
|
54
|
+
<field>log_level</field>
|
55
|
+
<field>max_age</field>
|
56
|
+
<field>max_size_kb</field>
|
57
|
+
<field>message</field>
|
58
|
+
<field>method</field>
|
59
|
+
<field>name</field>
|
60
|
+
<field>namespace</field>
|
61
|
+
<field>new_channels</field>
|
62
|
+
<field>numMsgs</field>
|
63
|
+
<field>other</field>
|
64
|
+
<field>punct</field>
|
65
|
+
<field>qsize</field>
|
66
|
+
<field>qwork_units</field>
|
67
|
+
<field>rebuild_metadata</field>
|
68
|
+
<field>reclaimed_channels</field>
|
69
|
+
<field>referer</field>
|
70
|
+
<field>referer_domain</field>
|
71
|
+
<field>removed_channels</field>
|
72
|
+
<field>replicate_semislice</field>
|
73
|
+
<field>req_time</field>
|
74
|
+
<field>retryMove_1hotBkt</field>
|
75
|
+
<field>roll_hotBkt</field>
|
76
|
+
<field>root</field>
|
77
|
+
<field>series</field>
|
78
|
+
<field>service_externProc</field>
|
79
|
+
<field>service_maxSizes</field>
|
80
|
+
<field>service_volumes</field>
|
81
|
+
<field>sid</field>
|
82
|
+
<field>size_hotBkt</field>
|
83
|
+
<field>smallest_size</field>
|
84
|
+
<field>source</field>
|
85
|
+
<field>sourcetype</field>
|
86
|
+
<field>spent</field>
|
87
|
+
<field>splunk_server</field>
|
88
|
+
<field>status</field>
|
89
|
+
<field>sync_hotBkt</field>
|
90
|
+
<field>task</field>
|
91
|
+
<field>throttle_optimize</field>
|
92
|
+
<field>timedout_channels</field>
|
93
|
+
<field>timeendpos</field>
|
94
|
+
<field>timestartpos</field>
|
95
|
+
<field>total_k_processed</field>
|
96
|
+
<field>update_bktManifest</field>
|
97
|
+
<field>update_checksums</field>
|
98
|
+
<field>uri</field>
|
99
|
+
<field>uri_domain</field>
|
100
|
+
<field>uri_path</field>
|
101
|
+
<field>uri_query</field>
|
102
|
+
<field>user</field>
|
103
|
+
<field>useragent</field>
|
104
|
+
<field>version</field>
|
105
|
+
<field>workers</field>
|
106
|
+
</fieldOrder>
|
107
|
+
</meta>
|
108
|
+
<result offset='0'>
|
109
|
+
<field k='_bkt'>
|
110
|
+
<value><text>_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B</text></value>
|
111
|
+
</field>
|
112
|
+
<field k='_cd'>
|
113
|
+
<value><text>21:59296</text></value>
|
114
|
+
</field>
|
115
|
+
<field k='_indextime'>
|
116
|
+
<value><text>1355946377</text></value>
|
117
|
+
</field>
|
118
|
+
<field k='_kv'>
|
119
|
+
<value><text>1</text></value>
|
120
|
+
</field>
|
121
|
+
<field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:46:15.549 -0800] "GET /services/messages HTTP/1.1" 200 1984 - - - 1ms</v></field>
|
122
|
+
<field k='_serial'>
|
123
|
+
<value><text>0</text></value>
|
124
|
+
</field>
|
125
|
+
<field k='_si'>
|
126
|
+
<value><text>fross-mbp15.local</text></value>
|
127
|
+
<value><text>_internal</text></value>
|
128
|
+
</field>
|
129
|
+
<field k='_sourcetype'>
|
130
|
+
<value><text>splunkd_access</text></value>
|
131
|
+
</field>
|
132
|
+
<field k='_subsecond'>
|
133
|
+
<value><text>.549</text></value>
|
134
|
+
</field>
|
135
|
+
<field k='_time'>
|
136
|
+
<value><text>2012-12-19T11:46:15.549-08:00</text></value>
|
137
|
+
</field>
|
138
|
+
<field k='bytes'>
|
139
|
+
<value><text>1984</text></value>
|
140
|
+
</field>
|
141
|
+
<field k='clientip'>
|
142
|
+
<value><text>127.0.0.1</text></value>
|
143
|
+
</field>
|
144
|
+
<field k='date_hour'>
|
145
|
+
<value><text>11</text></value>
|
146
|
+
</field>
|
147
|
+
<field k='date_mday'>
|
148
|
+
<value><text>19</text></value>
|
149
|
+
</field>
|
150
|
+
<field k='date_minute'>
|
151
|
+
<value><text>46</text></value>
|
152
|
+
</field>
|
153
|
+
<field k='date_month'>
|
154
|
+
<value><text>december</text></value>
|
155
|
+
</field>
|
156
|
+
<field k='date_second'>
|
157
|
+
<value><text>15</text></value>
|
158
|
+
</field>
|
159
|
+
<field k='date_wday'>
|
160
|
+
<value><text>wednesday</text></value>
|
161
|
+
</field>
|
162
|
+
<field k='date_year'>
|
163
|
+
<value><text>2012</text></value>
|
164
|
+
</field>
|
165
|
+
<field k='date_zone'>
|
166
|
+
<value><text>-480</text></value>
|
167
|
+
</field>
|
168
|
+
<field k='eventtype'>
|
169
|
+
<value><text>splunkd-access</text></value>
|
170
|
+
</field>
|
171
|
+
<field k='file'>
|
172
|
+
<value><text>messages</text></value>
|
173
|
+
</field>
|
174
|
+
<field k='host'>
|
175
|
+
<value><text>fross-mbp15.local</text></value>
|
176
|
+
</field>
|
177
|
+
<field k='ident'>
|
178
|
+
<value><text>-</text></value>
|
179
|
+
</field>
|
180
|
+
<field k='index'>
|
181
|
+
<value h='1'><text>_internal</text></value>
|
182
|
+
</field>
|
183
|
+
<field k='linecount'>
|
184
|
+
<value><text>1</text></value>
|
185
|
+
</field>
|
186
|
+
<field k='method'>
|
187
|
+
<value><text>GET</text></value>
|
188
|
+
</field>
|
189
|
+
<field k='other'>
|
190
|
+
<value><text>- - - 1ms</text></value>
|
191
|
+
</field>
|
192
|
+
<field k='punct'>
|
193
|
+
<value><text>..._-__[//:::._-]_"_//_/."___-_-_-_</text></value>
|
194
|
+
</field>
|
195
|
+
<field k='req_time'>
|
196
|
+
<value><text>19/Dec/2012:11:46:15.549 -0800</text></value>
|
197
|
+
</field>
|
198
|
+
<field k='root'>
|
199
|
+
<value><text>services</text></value>
|
200
|
+
</field>
|
201
|
+
<field k='source'>
|
202
|
+
<value><text>/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log</text></value>
|
203
|
+
</field>
|
204
|
+
<field k='sourcetype'>
|
205
|
+
<value><text>splunkd_access</text></value>
|
206
|
+
</field>
|
207
|
+
<field k='spent'>
|
208
|
+
<value><text>1</text></value>
|
209
|
+
</field>
|
210
|
+
<field k='splunk_server'>
|
211
|
+
<value><text>fross-mbp15.local</text></value>
|
212
|
+
</field>
|
213
|
+
<field k='status'>
|
214
|
+
<value><text>200</text></value>
|
215
|
+
</field>
|
216
|
+
<field k='timeendpos'>
|
217
|
+
<value><text>49</text></value>
|
218
|
+
</field>
|
219
|
+
<field k='timestartpos'>
|
220
|
+
<value><text>19</text></value>
|
221
|
+
</field>
|
222
|
+
<field k='uri'>
|
223
|
+
<value><text>/services/messages</text></value>
|
224
|
+
</field>
|
225
|
+
<field k='uri_path'>
|
226
|
+
<value><text>/services/messages</text></value>
|
227
|
+
</field>
|
228
|
+
<field k='user'>
|
229
|
+
<value><text>admin</text></value>
|
230
|
+
</field>
|
231
|
+
<field k='version'>
|
232
|
+
<value><text>HTTP/1.1</text></value>
|
233
|
+
</field>
|
234
|
+
</result>
|
235
|
+
<result offset='1'>
|
236
|
+
<field k='_bkt'>
|
237
|
+
<value><text>_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B</text></value>
|
238
|
+
</field>
|
239
|
+
<field k='_cd'>
|
240
|
+
<value><text>21:59301</text></value>
|
241
|
+
</field>
|
242
|
+
<field k='_indextime'>
|
243
|
+
<value><text>1355946377</text></value>
|
244
|
+
</field>
|
245
|
+
<field k='_kv'>
|
246
|
+
<value><text>1</text></value>
|
247
|
+
</field>
|
248
|
+
<field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:46:15.544 -0800] "GET /en-US/api/messages/index HTTP/1.1" 200 341 "http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0" - 50d219878b6ae2790 7ms</v></field>
|
249
|
+
<field k='_serial'>
|
250
|
+
<value><text>1</text></value>
|
251
|
+
</field>
|
252
|
+
<field k='_si'>
|
253
|
+
<value><text>fross-mbp15.local</text></value>
|
254
|
+
<value><text>_internal</text></value>
|
255
|
+
</field>
|
256
|
+
<field k='_sourcetype'>
|
257
|
+
<value><text>splunk_web_access</text></value>
|
258
|
+
</field>
|
259
|
+
<field k='_subsecond'>
|
260
|
+
<value><text>.544</text></value>
|
261
|
+
</field>
|
262
|
+
<field k='_time'>
|
263
|
+
<value><text>2012-12-19T11:46:15.544-08:00</text></value>
|
264
|
+
</field>
|
265
|
+
<field k='bytes'>
|
266
|
+
<value><text>341</text></value>
|
267
|
+
</field>
|
268
|
+
<field k='clientip'>
|
269
|
+
<value><text>127.0.0.1</text></value>
|
270
|
+
</field>
|
271
|
+
<field k='date_hour'>
|
272
|
+
<value><text>11</text></value>
|
273
|
+
</field>
|
274
|
+
<field k='date_mday'>
|
275
|
+
<value><text>19</text></value>
|
276
|
+
</field>
|
277
|
+
<field k='date_minute'>
|
278
|
+
<value><text>46</text></value>
|
279
|
+
</field>
|
280
|
+
<field k='date_month'>
|
281
|
+
<value><text>december</text></value>
|
282
|
+
</field>
|
283
|
+
<field k='date_second'>
|
284
|
+
<value><text>15</text></value>
|
285
|
+
</field>
|
286
|
+
<field k='date_wday'>
|
287
|
+
<value><text>wednesday</text></value>
|
288
|
+
</field>
|
289
|
+
<field k='date_year'>
|
290
|
+
<value><text>2012</text></value>
|
291
|
+
</field>
|
292
|
+
<field k='date_zone'>
|
293
|
+
<value><text>-480</text></value>
|
294
|
+
</field>
|
295
|
+
<field k='file'>
|
296
|
+
<value><text>index</text></value>
|
297
|
+
</field>
|
298
|
+
<field k='host'>
|
299
|
+
<value><text>fross-mbp15.local</text></value>
|
300
|
+
</field>
|
301
|
+
<field k='ident'>
|
302
|
+
<value><text>-</text></value>
|
303
|
+
</field>
|
304
|
+
<field k='index'>
|
305
|
+
<value h='1'><text>_internal</text></value>
|
306
|
+
</field>
|
307
|
+
<field k='linecount'>
|
308
|
+
<value><text>1</text></value>
|
309
|
+
</field>
|
310
|
+
<field k='method'>
|
311
|
+
<value><text>GET</text></value>
|
312
|
+
</field>
|
313
|
+
<field k='namespace'>
|
314
|
+
<value><text>search</text></value>
|
315
|
+
</field>
|
316
|
+
<field k='other'>
|
317
|
+
<value><text>- 50d219878b6ae2790 7ms</text></value>
|
318
|
+
</field>
|
319
|
+
<field k='punct'>
|
320
|
+
<value><text>..._-__[//:::._-]_"_/-///_/."___"://:/-//?=.&="_"/</text></value>
|
321
|
+
</field>
|
322
|
+
<field k='referer'>
|
323
|
+
<value><text>http://localhost:8000/en-US/search/inspector?sid=1355946305.42&namespace=search</text></value>
|
324
|
+
</field>
|
325
|
+
<field k='referer_domain'>
|
326
|
+
<value><text>http://localhost:8000</text></value>
|
327
|
+
</field>
|
328
|
+
<field k='req_time'>
|
329
|
+
<value><text>19/Dec/2012:11:46:15.544 -0800</text></value>
|
330
|
+
</field>
|
331
|
+
<field k='root'>
|
332
|
+
<value><text>en-US</text></value>
|
333
|
+
</field>
|
334
|
+
<field k='sid'>
|
335
|
+
<value><text>1355946305.42</text></value>
|
336
|
+
</field>
|
337
|
+
<field k='source'>
|
338
|
+
<value><text>/Users/fross/splunks/splunk-5.0.2/var/log/splunk/web_access.log</text></value>
|
339
|
+
</field>
|
340
|
+
<field k='sourcetype'>
|
341
|
+
<value><text>splunk_web_access</text></value>
|
342
|
+
</field>
|
343
|
+
<field k='spent'>
|
344
|
+
<value><text>7</text></value>
|
345
|
+
</field>
|
346
|
+
<field k='splunk_server'>
|
347
|
+
<value><text>fross-mbp15.local</text></value>
|
348
|
+
</field>
|
349
|
+
<field k='status'>
|
350
|
+
<value><text>200</text></value>
|
351
|
+
</field>
|
352
|
+
<field k='timeendpos'>
|
353
|
+
<value><text>49</text></value>
|
354
|
+
</field>
|
355
|
+
<field k='timestartpos'>
|
356
|
+
<value><text>19</text></value>
|
357
|
+
</field>
|
358
|
+
<field k='uri'>
|
359
|
+
<value><text>/en-US/api/messages/index</text></value>
|
360
|
+
</field>
|
361
|
+
<field k='uri_path'>
|
362
|
+
<value><text>/en-US/api/messages/index</text></value>
|
363
|
+
</field>
|
364
|
+
<field k='user'>
|
365
|
+
<value><text>admin</text></value>
|
366
|
+
</field>
|
367
|
+
<field k='useragent'>
|
368
|
+
<value><text>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20100101 Firefox/17.0</text></value>
|
369
|
+
</field>
|
370
|
+
<field k='version'>
|
371
|
+
<value><text>HTTP/1.1</text></value>
|
372
|
+
</field>
|
373
|
+
</result>
|
374
|
+
<result offset='2'>
|
375
|
+
<field k='_bkt'>
|
376
|
+
<value><text>_internal~21~D8F318D9-5D7F-43B5-911F-9821FBAEEA9B</text></value>
|
377
|
+
</field>
|
378
|
+
<field k='_cd'>
|
379
|
+
<value><text>21:59281</text></value>
|
380
|
+
</field>
|
381
|
+
<field k='_indextime'>
|
382
|
+
<value><text>1355946374</text></value>
|
383
|
+
</field>
|
384
|
+
<field k='_kv'>
|
385
|
+
<value><text>1</text></value>
|
386
|
+
</field>
|
387
|
+
<field k='_raw'><v xml:space='preserve' trunc='0'>127.0.0.1 - admin [19/Dec/2012:11:46:14.260 -0800] "GET /services/messages HTTP/1.1" 200 1984 - - - 1ms</v></field>
|
388
|
+
<field k='_serial'>
|
389
|
+
<value><text>2</text></value>
|
390
|
+
</field>
|
391
|
+
<field k='_si'>
|
392
|
+
<value><text>fross-mbp15.local</text></value>
|
393
|
+
<value><text>_internal</text></value>
|
394
|
+
</field>
|
395
|
+
<field k='_sourcetype'>
|
396
|
+
<value><text>splunkd_access</text></value>
|
397
|
+
</field>
|
398
|
+
<field k='_subsecond'>
|
399
|
+
<value><text>.260</text></value>
|
400
|
+
</field>
|
401
|
+
<field k='_time'>
|
402
|
+
<value><text>2012-12-19T11:46:14.260-08:00</text></value>
|
403
|
+
</field>
|
404
|
+
<field k='bytes'>
|
405
|
+
<value><text>1984</text></value>
|
406
|
+
</field>
|
407
|
+
<field k='clientip'>
|
408
|
+
<value><text>127.0.0.1</text></value>
|
409
|
+
</field>
|
410
|
+
<field k='date_hour'>
|
411
|
+
<value><text>11</text></value>
|
412
|
+
</field>
|
413
|
+
<field k='date_mday'>
|
414
|
+
<value><text>19</text></value>
|
415
|
+
</field>
|
416
|
+
<field k='date_minute'>
|
417
|
+
<value><text>46</text></value>
|
418
|
+
</field>
|
419
|
+
<field k='date_month'>
|
420
|
+
<value><text>december</text></value>
|
421
|
+
</field>
|
422
|
+
<field k='date_second'>
|
423
|
+
<value><text>14</text></value>
|
424
|
+
</field>
|
425
|
+
<field k='date_wday'>
|
426
|
+
<value><text>wednesday</text></value>
|
427
|
+
</field>
|
428
|
+
<field k='date_year'>
|
429
|
+
<value><text>2012</text></value>
|
430
|
+
</field>
|
431
|
+
<field k='date_zone'>
|
432
|
+
<value><text>-480</text></value>
|
433
|
+
</field>
|
434
|
+
<field k='eventtype'>
|
435
|
+
<value><text>splunkd-access</text></value>
|
436
|
+
</field>
|
437
|
+
<field k='file'>
|
438
|
+
<value><text>messages</text></value>
|
439
|
+
</field>
|
440
|
+
<field k='host'>
|
441
|
+
<value><text>fross-mbp15.local</text></value>
|
442
|
+
</field>
|
443
|
+
<field k='ident'>
|
444
|
+
<value><text>-</text></value>
|
445
|
+
</field>
|
446
|
+
<field k='index'>
|
447
|
+
<value h='1'><text>_internal</text></value>
|
448
|
+
</field>
|
449
|
+
<field k='linecount'>
|
450
|
+
<value><text>1</text></value>
|
451
|
+
</field>
|
452
|
+
<field k='method'>
|
453
|
+
<value><text>GET</text></value>
|
454
|
+
</field>
|
455
|
+
<field k='other'>
|
456
|
+
<value><text>- - - 1ms</text></value>
|
457
|
+
</field>
|
458
|
+
<field k='punct'>
|
459
|
+
<value><text>..._-__[//:::._-]_"_//_/."___-_-_-_</text></value>
|
460
|
+
</field>
|
461
|
+
<field k='req_time'>
|
462
|
+
<value><text>19/Dec/2012:11:46:14.260 -0800</text></value>
|
463
|
+
</field>
|
464
|
+
<field k='root'>
|
465
|
+
<value><text>services</text></value>
|
466
|
+
</field>
|
467
|
+
<field k='source'>
|
468
|
+
<value><text>/Users/fross/splunks/splunk-5.0.2/var/log/splunk/splunkd_access.log</text></value>
|
469
|
+
</field>
|
470
|
+
<field k='sourcetype'>
|
471
|
+
<value><text>splunkd_access</text></value>
|
472
|
+
</field>
|
473
|
+
<field k='spent'>
|
474
|
+
<value><text>1</text></value>
|
475
|
+
</field>
|
476
|
+
<field k='splunk_server'>
|
477
|
+
<value><text>fross-mbp15.local</text></value>
|
478
|
+
</field>
|
479
|
+
<field k='status'>
|
480
|
+
<value><text>200</text></value>
|
481
|
+
</field>
|
482
|
+
<field k='timeendpos'>
|
483
|
+
<value><text>49</text></value>
|
484
|
+
</field>
|
485
|
+
<field k='timestartpos'>
|
486
|
+
<value><text>19</text></value>
|
487
|
+
</field>
|
488
|
+
<field k='uri'>
|
489
|
+
<value><text>/services/messages</text></value>
|
490
|
+
</field>
|
491
|
+
<field k='uri_path'>
|
492
|
+
<value><text>/services/messages</text></value>
|
493
|
+
</field>
|
494
|
+
<field k='user'>
|
495
|
+
<value><text>admin</text></value>
|
496
|
+
</field>
|
497
|
+
<field k='version'>
|
498
|
+
<value><text>HTTP/1.1</text></value>
|
499
|
+
</field>
|
500
|
+
</result>
|
501
|
+
</results>
|