/** * Do not instantiate this class directly. * Please call Splunk_Job::getResults() instead. */ public function __construct($job, $args) { list($args, $pageMaxSize) = Splunk_Util::extractArgument($args, 'pagesize', -1); list($args, $offset) = Splunk_Util::extractArgument($args, 'offset', 0); list($args, $count) = Splunk_Util::extractArgument($args, 'count', -1); if ($pageMaxSize <= 0 && $pageMaxSize != -1) { throw new InvalidArgumentException('Page size must be positive or -1 (infinity).'); } if ($offset < 0) { throw new InvalidArgumentException('Offset must be >= 0.'); } if ($count <= 0 && $count != -1) { throw new InvalidArgumentException('Count must be positive or -1 (infinity).'); } // (Use PHP_INT_MAX for infinity internally because it works // well with the min() function.) if ($pageMaxSize == -1) { $pageMaxSize = PHP_INT_MAX; } // internal infinity value if ($count == -1) { $count = PHP_INT_MAX; } // internal infinity value $this->job = $job; $this->args = $args; $this->curPageResults = NULL; $this->curOffset = $offset; $this->limOffset = $count == PHP_INT_MAX ? PHP_INT_MAX : $offset + $count; $this->pageMaxSize = $pageMaxSize; $this->fieldOrderWasReturned = FALSE; $this->currentElement = $this->readNextElement(); $this->atStart = TRUE; }
private function attachAndSendEvents($numEvents, $indexDelay) { list($service, $indexName, $index, $expectedEvents, $data) = $this->makeEvents($numEvents); // Submit events $eventOutputStream = $service->getReceiver()->attach(array('index' => $indexName, 'sourcetype' => 'php_unit_test')); Splunk_Util::fwriteall($eventOutputStream, $data); fclose($eventOutputStream); $this->checkEvents($service, $indexName, $index, $expectedEvents, $numEvents, $indexDelay); }
public function testAttach() { $service = $this->loginToRealService(); $index = $service->getIndexes()->get('_internal'); // (Only test that this code path appears to work. // The ReceiverTest checks whether submitted events actually show up.) $eventOutputStream = $index->attach(array('sourcetype' => 'php_unit_test')); Splunk_Util::fwriteall($eventOutputStream, 'DELETEME'); fclose($eventOutputStream); }
/** * Creates a new search job. * * @param string $search The search query for the job to perform. * @param array $args (optional) Job-specific creation arguments, * merged with {<br/> * **namespace**: (optional) {Splunk_Namespace} The namespace in which * to create the entity. Defaults to the service's * namespace.<br/> * }<br/> * For details, see the * <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs"> * "POST search/jobs"</a> * endpoint in the REST API Documentation. * @return Splunk_Job * @throws Splunk_IOException */ public function create($search, $args = array()) { $args = array_merge(array('search' => $search), $args); if (array_key_exists('exec_mode', $args) && $args['exec_mode'] === 'oneshot') { throw new InvalidArgumentException('Cannot create oneshot jobs with this method. Use createOneshot() instead.'); } $namespace = Splunk_Util::getArgument($args, 'namespace', NULL); $response = $this->sendPost('', $args); $xml = new SimpleXMLElement($response->body); $sid = Splunk_XmlUtil::getTextContentAtXpath($xml, '/response/sid'); return $this->getReference($sid, $namespace); }
private function getBody() { if (array_key_exists('body', $this->state)) { return $this->state['body']; } if ($this->body === NULL) { if (!array_key_exists('bodyStream', $this->state)) { throw new Splunk_UnsupportedOperationException('Response object does not contain body stream.'); } $this->body = Splunk_Util::stream_get_contents($this->state['bodyStream']); } return $this->body; }
/** * @return resource A stream that reads from the specified byte string. */ public static function create($string) { $stream = fopen('php://memory', 'rwb'); Splunk_Util::fwriteall($stream, $string); fseek($stream, 0); /* * fseek() causes the next call to feof() to always return FALSE, * which is undesirable if we seeked to the EOF. In this case, * attempt a read past EOF so that the next call to feof() returns * TRUE as expected. */ if ($string === '') { fread($stream, 1); } // trigger EOF explicitly return $stream; }
/** * Creates a stream for logging events to the specified index. * * In addition to the index name it is highly recommended to specify * a sourcetype explicitly. * * The returned stream should eventually be closed via fclose(). * * @param array $args (optional) {<br/> * **host**: (optional) The value to populate in the host field * for events from this data input.<br/> * **host_regex**: (optional) A regular expression used to * extract the host value from each event.<br/> * **index**: (optional) The index to send events from this * input to. Highly recommended. Defaults to "default".<br/> * **source**: (optional) The source value to fill in the * metadata for this input's events.<br/> * **sourcetype**: (optional) The sourcetype to apply to * events from this input.<br/> * } * @return resource A stream that you can write event text to. * @throws Splunk_IOException * @link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fstream */ public function attach($args = array()) { $scheme = $this->service->getScheme(); $host = $this->service->getHost(); $port = $this->service->getPort(); $errno = 0; $errstr = ''; if ($scheme == 'http') { $stream = @fsockopen($host, $port, $errno, $errstr); } else { if ($scheme == 'https') { $stream = @fsockopen('ssl://' . $host, $port, $errno, $errstr); } else { throw new Splunk_UnsupportedOperationException('Unsupported URL scheme.'); } } if ($stream === FALSE) { throw new Splunk_ConnectException($errstr, $errno); } $path = '/services/receivers/stream?' . http_build_query($args); $token = $this->service->getToken(); $headers = array("POST {$path} HTTP/1.1\r\n", "Host: {$host}:{$port}\r\n", "Accept-Encoding: identity\r\n", "Authorization: {$token}\r\n", "X-Splunk-Input-Mode: Streaming\r\n", "\r\n"); Splunk_Util::fwriteall($stream, implode('', $headers)); return $stream; }
/** * Sends an HTTP request to the endpoint at the specified path. * * @param string $method the HTTP method (ex: 'GET' or 'POST'). * @param string $path relative or absolute URL path. * @param array $requestHeaders (optional) dictionary of header names and * values. * @param string $requestBody (optional) content to send in the request. * @param array $args (optional) query parameters, merged with * {<br/> * **namespace**: (optional) namespace to use, or NULL to use * this context's default namespace.<br/> * } * @return Splunk_HttpResponse * @throws Splunk_IOException * @see Splunk_Http::request() */ public function sendRequest($method, $path, $requestHeaders = array(), $requestBody = '', $args = array()) { list($params, $namespace) = Splunk_Util::extractArgument($args, 'namespace', NULL); $url = $this->url($path, $namespace); $fullUrl = count($params) == 0 ? $url : $url . '?' . http_build_query($params); $requestHeaders = array_merge($this->getRequestHeaders(), $requestHeaders); return $this->http->request($method, $fullUrl, $requestHeaders, $requestBody); }
/** * Creates a stream for logging events to the specified index. * * In addition to the index name it is highly recommended to specify * a sourcetype explicitly. * * The returned stream should eventually be closed via fclose(). * * @param array $args (optional) {<br/> * **host**: (optional) The value to populate in the host field * for events from this data input.<br/> * **host_regex**: (optional) A regular expression used to * extract the host value from each event.<br/> * **index**: (optional) The index to send events from this * input to. Highly recommended. Defaults to "default".<br/> * **source**: (optional) The source value to fill in the * metadata for this input's events.<br/> * **sourcetype**: (optional) The sourcetype to apply to * events from this input.<br/> * } * @return resource A stream that you can write event text to. * @throws Splunk_IOException * @link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fstream */ public function attach($args = array()) { $scheme = $this->service->getScheme(); $host = $this->service->getHost(); $port = $this->service->getPort(); $errno = 0; $errstr = ''; $socketContext = stream_context_create(array('ssl' => array('verify_peer' => false, 'verify_peer_name' => false))); if ($scheme == 'http') { $stream = @stream_socket_client($host . ":" . $port, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $socketContext); } else { if ($scheme == 'https') { $stream = @stream_socket_client('ssl://' . $host . ":" . $port, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $socketContext); } else { throw new Splunk_UnsupportedOperationException('Unsupported URL scheme.'); } } if ($stream === FALSE) { throw new Splunk_ConnectException("error: " . $errstr . $host . ":" . $port, $errno); } $path = '/services/receivers/stream?' . http_build_query($args); $token = $this->service->getToken(); $headers = array("POST {$path} HTTP/1.1\r\n", "Host: {$host}:{$port}\r\n", "Accept-Encoding: identity\r\n", "Authorization: {$token}\r\n", "X-Splunk-Input-Mode: Streaming\r\n", "\r\n"); Splunk_Util::fwriteall($stream, implode('', $headers)); return $stream; }