Exemple #1
0
def getSampleEvents(eventtype, args):
    results = []

    if eventtype != '':

        if eventtype.strip().startswith("|") or len(
                shu.getJustCommands(eventtype, None)) > 1:
            raise Exception("Eventtypes cannot contain search commands")

        eventtype = eventtype.replace('\\', '\\\\')
        query = "search %s | head %s | fields | abstract maxlines=%s " % (
            eventtype, MAX_SAMPLES, MAX_LINES)
        maxtime = args.get('maxtime', None)
        if maxtime != None:
            # try to use maxtime to get selecteed event at top
            epochmaxtime = splunk.util.dt2epoch(splunk.util.parseISO(maxtime))
            results = se.searchAll(query,
                                   latest_time=epochmaxtime,
                                   status_buckets=1)

        # if not enough events, research without time constraint
        if len(results) < MIN_SAMPLES:
            results = se.searchAll(query, status_buckets=1)

        results = [r.raw.getRaw() for r in results]
    return results
Exemple #2
0
def getStats(result, search):
    commands = parseutils.getJustCommands(search, None)
    for command in commands:
        field = "%s_count" % command
        result[field] = result.get(field, 0) + 1
    for keyword in ["OR", "NOT", "AND"]:
        result['%s_count' % keyword] = search.count(" %s " % keyword)
    result['unknown_tokens'] = getUnknown(search)
def getStats(result, search):
    commands = parseutils.getJustCommands(search, None)
    for command in commands:
        field = "%s_count" % command
        result[field] = result.get(field, 0) + 1
    for keyword in ["OR", "NOT", "AND"]:
        result['%s_count' % keyword] = search.count(" %s " % keyword)
    result['unknown_tokens'] = getUnknown(search)
Exemple #4
0
def getSampleEvents(eventtype, args, fast=True):
    results = []

    if eventtype != '':

        if eventtype.strip().startswith("|") or len(shu.getJustCommands(eventtype, None)) > 1:
            raise Exception("Eventtypes cannot contain search commands")
        
        eventtype = eventtype.replace('\\', '\\\\')
        sid = args['sid']
        if fast:
            # try to finalize jobs so that search job can be used with loadjob
            try:
                job = se.getJob(sid)
                job.finalize()
                se.waitForJob(job, MAX_JOB_WAIT) # job isn't ready immediately after finalize is called.
            except Exception, ee:
                pass
            query = "| loadjob %s | search %s | head %s | fields | abstract maxlines=%s " % (sid, eventtype, MAX_SAMPLES, MAX_LINES)
        else:
            query = "search %s | head %s | fields | abstract maxlines=%s " % (eventtype, MAX_SAMPLES, MAX_LINES)

        maxtime = args.get('maxtime', None)
        if maxtime != None:
            # try to use maxtime to get selecteed event at top
            epochmaxtime = splunk.util.dt2epoch(splunk.util.parseISO(maxtime))
            results = se.searchAll(query, latest_time=epochmaxtime, status_buckets=1,
                                   auto_finalize_ec=MAX_SAMPLES,
                                   max_out=MAX_SAMPLES,
                                   max_count=MAX_SAMPLES, max_time=MAX_JOB_WAIT,
                                   enable_lookups=0, auto_cancel=int(1.5*MAX_JOB_WAIT)
                                   )

        # if we got no results, perhaps the job expired.  rerun the search.
        if fast and len(results) == 0:
            return getSampleEvents(eventtype, args, False)
        
        # if not enough events, research without time constraint
        if len(results) < MIN_SAMPLES:
            results = se.searchAll(query, status_buckets=1,
                                   auto_finalize_ec=MAX_SAMPLES,
                                   max_out=MAX_SAMPLES,
                                   max_count=MAX_SAMPLES, max_time=MAX_JOB_WAIT,
                                   enable_lookups=0, auto_cancel=int(1.5*MAX_JOB_WAIT)
                                   )
        results =  [ r.raw.getRaw() for r in results ]
Exemple #5
0
def getSampleEvents(eventtype, args):
    results = []

    if eventtype != '':

        if eventtype.strip().startswith("|") or len(shu.getJustCommands(eventtype, None)) > 1:
            raise Exception("Eventtypes cannot contain search commands")
        
        eventtype = eventtype.replace('\\', '\\\\')
        query = "search %s | head %s | fields | abstract maxlines=%s " % (eventtype, MAX_SAMPLES, MAX_LINES)
        maxtime = args.get('maxtime', None)
        if maxtime != None:
            # try to use maxtime to get selecteed event at top
            epochmaxtime = splunk.util.dt2epoch(splunk.util.parseISO(maxtime))
            results = se.searchAll(query, latest_time=epochmaxtime, status_buckets=1)

        # if not enough events, research without time constraint
        if len(results) < MIN_SAMPLES:
            results = se.searchAll(query, status_buckets=1)

        results =  [ r.raw.getRaw() for r in results ]
    return results