/**
* Send data to server.
*
* @param string $message
*
* @return bool
*/
protected function send($message)
{
try {
$params = ['username' => $this->login, 'password' => $this->password, 'host' => $this->host, 'port' => 8089, 'scheme' => 'https'];
$splunkService = new \Splunk_Service($params);
$splunkService->login();
$params = ['source' => $this->project, 'sourcetype' => 'json_auto_timestamp', 'host' => gethostname() ?: null];
$splunkReceiver = $splunkService->getReceiver();
$result = $splunkReceiver->submit($message, $params);
return $result;
} catch (Exception $e) {
var_dump($e->getMessage());
}
return true;
//return $statusCode == 200;
}
/**
* Returns a Splunk_Service connected to a mock Http object.
*/
protected function loginToMockService($secondPostReturnValue = NULL, $secondPostExpectedArgs = NULL, $extraConnectArgs = array())
{
$http = $this->getMock('Splunk_Http');
$service = new Splunk_Service(array_merge(array('http' => $http), $extraConnectArgs));
$httpResponse = (object) array('status' => 200, 'reason' => 'OK', 'headers' => array(), 'body' => '
<response>
<sessionKey>' . SplunkTest::MOCK_SESSION_TOKEN . '</sessionKey>
</response>');
if ($secondPostReturnValue === NULL) {
$http->expects($this->once())->method('post')->will($this->returnValue($httpResponse));
} else {
$http->expects($this->at(0))->method('post')->will($this->returnValue($httpResponse))->with($this->anything());
$m = $http->expects($this->at(1))->method('post')->will($this->returnValue($secondPostReturnValue));
if ($secondPostExpectedArgs !== NULL) {
call_user_func_array(array($m, 'with'), $secondPostExpectedArgs);
}
}
$service->login();
return array($service, $http);
}
$log_filename = 'get_rtt';
$get_date = empty($_REQUEST['get_date']) ? date('Y-m-d', time() - 86400) : $_REQUEST['get_date'];
echo $run_time = "\r\n<br>开始：" . date('Y-m-d H:i:s') . ',生成时间:' . $get_date;
Common::TimedTaskLog($log_filename, $run_time);
$search = 'search send_host="107.150.99.249" AND ip_dst="10.11.3.120" earliest=' . date("m/d/Y:00:00:00", strtotime($get_date)) . ' latest=' . date("m/d/Y:23:59:59", strtotime($get_date)) . ' | where not like(ip_src," 10.11.3.%") | lookup mygeocn clientip as ip_src | stats avg(rtt) as avg_rtt ,stdev(rtt) as stdev_rtt ,count as nums , median(rtt) as mrtt ,max(rtt) as max_rtt ,p25(rtt) as p25, p75(rtt) as p75 ,p95(rtt) as p95 , p99(rtt) as p99 by client_country send_host | eval IQR=p75-p25';
//$search = 'search send_host="107.150.99.249" AND ip_dst="10.11.3.120" earliest="08/03/2015:5:00:00" latest="08/04/2015:12:00:00" | where not like(ip_src," 10.11.3.%") | lookup mygeocn clientip as ip_src | stats avg(rtt) as avg_rtt ,stdev(rtt) as stdev_rtt ,count as nums , median(rtt) as mrtt ,max(rtt) as max_rtt ,p25(rtt) as p25, p75(rtt) as p75 ,p95(rtt) as p95 , p99(rtt) as p99 by client_country send_host | eval IQR=p75-p25';
echo $search;
// Modify by zhouyf 2015-06-15 修改ip地址
//$search = 'search send_host="115.231.160.100" OR send_host="119.97.132.122" OR send_host="218.60.24.70" OR send_host="117.27.155.52" OR send_host="58.22.107.133" OR send_host="221.228.81.164" earliest='.date("m/d/Y:00:00:00",strtotime($get_date)).' latest='.date("m/d/Y:23:59:59",strtotime($get_date)).' | lookup mygeocn clientip as ip_src | stats avg(rtt) as avg_rtt ,stdev(rtt) as stdev_rtt ,count as nums , median(rtt) as mrtt ,max(rtt) as max_rtt ,p25(rtt) as p25, p75(rtt) as p75 ,p95(rtt) as p95 , p99(rtt) as p99 by client_region send_host | eval IQR=p75-p25';
//$search = 'search send_host="115.231.160.100" earliest="05/28/2015:5:00:00" latest="05/28/2015:10:00:00" | lookup mygeocn clientip as ip_src | stats avg(rtt) as avg_rtt ,stdev(rtt) as stdev_rtt ,count as nums , median(rtt) as mrtt ,max(rtt) as max_rtt ,p25(rtt) as p25, p75(rtt) as p75 ,p95(rtt) as p95 , p99(rtt) as p99 by client_region send_host | eval IQR=p75-p25'; $search = 'search send_host="115.231.160.100" earliest="05/27/2015:12:00:00" latest="05/27/2015:16:00:00" | lookup mygeocn clientip as ip_src | stats avg(rtt) as avg_rtt ,stdev(rtt) as stdev_rtt ,count as nums , median(rtt) as mrtt ,max(rtt) as max_rtt ,p25(rtt) as p25, p75(rtt) as p75 ,p95(rtt) as p95 , p99(rtt) as p99 by client_region send_host | eval IQR=p75-p25';
//echo '<br>'.$search;
$s_time = microtime(true);
if ($search !== '') {
try {
// Login and start search job
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
// (NOTE: Can throw HTTP 400 if search command not recognized)
$job = $service->getJobs()->create($search, array('exec_mode' => 'blocking'));
// (NOTE: Can throw HTTP 400 if search command arguments not recognized)
$results = $job->getResults();
//echo '<br>results';
//var_dump($results);
$messages = array();
} catch (Exception $e) {
// Generate fake result that contains the exception message
$results = array();
$e_time = microtime(true);
echo $log_content = '<br>Splunk error info：' . $e->getMessage() . '<br>run_time:' . ($e_time - $s_time);
Common::TimedTaskLog($log_filename, $log_content);
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Jobs | Splunk SDK for PHP Examples</title>
<link rel="stylesheet" type="text/css" href="shared/style.css" />
</head>
<body>
<?php
require 'shared/navbar.php';
?>
<h2>Jobs</h2>
<?php
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
// Get all jobs
$jobs = $service->getJobs()->items(array('namespace' => Splunk_Namespace::createUser(NULL, NULL)));
?>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Search Expression</th>
<th>Owner</th>
<th>App</th>
<th>Status</th>
<th>Actions</th>
</tr>
#!/usr/bin/php
<?php
require_once '/Users/nluthra/git/splunk-sdk-php/Splunk.php';
?>
<?php
$service = new Splunk_Service(array('host' => 'localhost', 'port' => '8089', 'username' => 'admin', 'password' => 'changeme'));
$service->login();
print_r($service->getToken());
$searchQueryOneshot = 'search index=_internal';
// Return the first 100 events
// Set the search parameters; specify a time range
$searchParams = array('count' => 30, 'offset' => 100000, 'earliest_time' => '2012-06-20T12:00:00.000-07:00', 'latest_time' => '2013-12-02T12:00:00.000-07:00');
// Run a oneshot search that returns the job's results
$resultsStream = $service->oneshotSearch($searchQueryOneshot, $searchParams);
$resultsOneshotSearch = new Splunk_ResultsReader($resultsStream);
// Use the built-in XML parser to display the job results
foreach ($resultsOneshotSearch as $result) {
if ($result instanceof Splunk_ResultsFieldOrder) {
// Process the field order
print "FIELDS: " . implode(',', $result->getFieldNames()) . "\r\n";
} else {
if ($result instanceof Splunk_ResultsMessage) {
// Process a message
print "[{$result->getType()}] {$result->getText()}\r\n";
} else {
if (is_array($result)) {
// Process a row
print "{\r\n";
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Saved Searches | Splunk SDK for PHP Examples</title>
<link rel="stylesheet" type="text/css" href="shared/style.css" />
</head>
<body>
<?php
require 'shared/navbar.php';
?>
<h2>Saved Searches</h2>
<?php
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
// Get all saved searches
$savedSearches = $service->getSavedSearches()->items(array('namespace' => Splunk_Namespace::createUser(NULL, NULL)));
?>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Name</th>
<th>Actions</th>
</tr>
</thead>
<?php
foreach ($savedSearches as $savedSearch) {
<?php
require_once '../Splunk.php';
require_once 'settings.php';
$username = array_key_exists('username', $SplunkExamples_connectArguments) ? $SplunkExamples_connectArguments['username'] : '******';
$password = array_key_exists('username', $SplunkExamples_connectArguments) ? $SplunkExamples_connectArguments['password'] : '******';
$usingDefaultCredentials = $username === 'admin' && $password === 'changeme';
$loginFailed = FALSE;
$loginFailReason = NULL;
try {
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
} catch (Exception $e) {
$loginFailed = TRUE;
$loginFailReason = $e->getMessage();
}
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Splunk SDK for PHP Examples</title>
<link rel="stylesheet" type="text/css" href="shared/style.css" />
</head>
<body>
<?php
require 'shared/navbar.php';
?>
<?php
<?php
require_once '../Splunk.php';
require_once 'settings.php';
$method = $_SERVER['REQUEST_METHOD'];
$action = array_key_exists('action', $_REQUEST) ? $_REQUEST['action'] : 'help';
$id = array_key_exists('id', $_REQUEST) ? $_REQUEST['id'] : '';
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
if ($id !== '') {
$savedSearch = $service->getSavedSearches()->get($id, Splunk_Namespace::createUser(NULL, NULL));
}
if ($method === 'POST') {
$search = $_POST['search'];
if ($action === 'create') {
$name = $_POST['name'];
$service->getSavedSearches()->create($name, array('search' => $search));
header('Location: list_saved_searches.php');
exit;
} else {
if ($action === 'edit') {
$savedSearch->update(array('search' => $search));
header('Location: list_saved_searches.php');
exit;
} else {
die('Unrecognized action.');
}
}
} else {
if ($method === 'GET') {
<?php
require_once '../Splunk.php';
require_once 'settings.php';
$method = $_SERVER['REQUEST_METHOD'];
$action = array_key_exists('action', $_REQUEST) ? $_REQUEST['action'] : 'help';
$id = array_key_exists('id', $_REQUEST) ? $_REQUEST['id'] : '';
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
if ($id !== '') {
$job = $service->getJobs()->get($id, Splunk_Namespace::createUser(NULL, NULL));
}
if ($method === 'GET') {
if ($action === 'help') {
header('Location: list_jobs.php');
exit;
} else {
if ($action === 'view') {
// (continue)
} else {
if ($action === 'pause') {
$job->pause();
header('Location: list_jobs.php');
exit;
} else {
if ($action === 'unpause') {
$job->unpause();
header('Location: list_jobs.php');
exit;
} else {
placeholder="search index=_internal | top sourcetype"
value="<?php
echo htmlspecialchars($search);
?>
"/>
<input type="submit" value="Search" class="btn"/>
</form>
<?php
if ($search !== '') {
?>
<h2>Progress</h2>
<?php
try {
// Login and start search job
$service = new Splunk_Service($SplunkExamples_connectArguments);
// (NOTE: Can throw HTTP 401 if bad credentials)
$service->login();
// (NOTE: Can throw HTTP 400 if search command not recognized)
$job = $service->getJobs()->create($search);
// Print progress of the job as it is running
echo '<ul>';
while (!$job->isDone()) {
echo '<li>';
printf("%03.1f%%", $job->getProgress() * 100);
echo '</li>';
flush();
usleep(0.5 * 1000000);
$job->refresh();
}
echo '<li>Done</li>';