/**
* Do not instantiate this class directly.
* Please call Splunk_Job::getResults() instead.
*/
public function __construct($job, $args)
{
list($args, $pageMaxSize) = Splunk_Util::extractArgument($args, 'pagesize', -1);
list($args, $offset) = Splunk_Util::extractArgument($args, 'offset', 0);
list($args, $count) = Splunk_Util::extractArgument($args, 'count', -1);
if ($pageMaxSize <= 0 && $pageMaxSize != -1) {
throw new InvalidArgumentException('Page size must be positive or -1 (infinity).');
}
if ($offset < 0) {
throw new InvalidArgumentException('Offset must be >= 0.');
}
if ($count <= 0 && $count != -1) {
throw new InvalidArgumentException('Count must be positive or -1 (infinity).');
}
// (Use PHP_INT_MAX for infinity internally because it works
// well with the min() function.)
if ($pageMaxSize == -1) {
$pageMaxSize = PHP_INT_MAX;
}
// internal infinity value
if ($count == -1) {
$count = PHP_INT_MAX;
}
// internal infinity value
$this->job = $job;
$this->args = $args;
$this->curPageResults = NULL;
$this->curOffset = $offset;
$this->limOffset = $count == PHP_INT_MAX ? PHP_INT_MAX : $offset + $count;
$this->pageMaxSize = $pageMaxSize;
$this->fieldOrderWasReturned = FALSE;
$this->currentElement = $this->readNextElement();
$this->atStart = TRUE;
}
private function attachAndSendEvents($numEvents, $indexDelay)
{
list($service, $indexName, $index, $expectedEvents, $data) = $this->makeEvents($numEvents);
// Submit events
$eventOutputStream = $service->getReceiver()->attach(array('index' => $indexName, 'sourcetype' => 'php_unit_test'));
Splunk_Util::fwriteall($eventOutputStream, $data);
fclose($eventOutputStream);
$this->checkEvents($service, $indexName, $index, $expectedEvents, $numEvents, $indexDelay);
}
public function testAttach()
{
$service = $this->loginToRealService();
$index = $service->getIndexes()->get('_internal');
// (Only test that this code path appears to work.
// The ReceiverTest checks whether submitted events actually show up.)
$eventOutputStream = $index->attach(array('sourcetype' => 'php_unit_test'));
Splunk_Util::fwriteall($eventOutputStream, 'DELETEME');
fclose($eventOutputStream);
}
/**
* Creates a new search job.
*
* @param string $search The search query for the job to perform.
* @param array $args (optional) Job-specific creation arguments,
* merged with {<br/>
* **namespace**: (optional) {Splunk_Namespace} The namespace in which
* to create the entity. Defaults to the service's
* namespace.<br/>
* }<br/>
* For details, see the
* <a href="http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs">
* "POST search/jobs"</a>
* endpoint in the REST API Documentation.
* @return Splunk_Job
* @throws Splunk_IOException
*/
public function create($search, $args = array())
{
$args = array_merge(array('search' => $search), $args);
if (array_key_exists('exec_mode', $args) && $args['exec_mode'] === 'oneshot') {
throw new InvalidArgumentException('Cannot create oneshot jobs with this method. Use createOneshot() instead.');
}
$namespace = Splunk_Util::getArgument($args, 'namespace', NULL);
$response = $this->sendPost('', $args);
$xml = new SimpleXMLElement($response->body);
$sid = Splunk_XmlUtil::getTextContentAtXpath($xml, '/response/sid');
return $this->getReference($sid, $namespace);
}
private function getBody()
{
if (array_key_exists('body', $this->state)) {
return $this->state['body'];
}
if ($this->body === NULL) {
if (!array_key_exists('bodyStream', $this->state)) {
throw new Splunk_UnsupportedOperationException('Response object does not contain body stream.');
}
$this->body = Splunk_Util::stream_get_contents($this->state['bodyStream']);
}
return $this->body;
}
/**
* @return resource A stream that reads from the specified byte string.
*/
public static function create($string)
{
$stream = fopen('php://memory', 'rwb');
Splunk_Util::fwriteall($stream, $string);
fseek($stream, 0);
/*
* fseek() causes the next call to feof() to always return FALSE,
* which is undesirable if we seeked to the EOF. In this case,
* attempt a read past EOF so that the next call to feof() returns
* TRUE as expected.
*/
if ($string === '') {
fread($stream, 1);
}
// trigger EOF explicitly
return $stream;
}
/**
* Creates a stream for logging events to the specified index.
*
* In addition to the index name it is highly recommended to specify
* a sourcetype explicitly.
*
* The returned stream should eventually be closed via fclose().
*
* @param array $args (optional) {<br/>
* **host**: (optional) The value to populate in the host field
* for events from this data input.<br/>
* **host_regex**: (optional) A regular expression used to
* extract the host value from each event.<br/>
* **index**: (optional) The index to send events from this
* input to. Highly recommended. Defaults to "default".<br/>
* **source**: (optional) The source value to fill in the
* metadata for this input's events.<br/>
* **sourcetype**: (optional) The sourcetype to apply to
* events from this input.<br/>
* }
* @return resource A stream that you can write event text to.
* @throws Splunk_IOException
* @link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fstream
*/
public function attach($args = array())
{
$scheme = $this->service->getScheme();
$host = $this->service->getHost();
$port = $this->service->getPort();
$errno = 0;
$errstr = '';
if ($scheme == 'http') {
$stream = @fsockopen($host, $port, $errno, $errstr);
} else {
if ($scheme == 'https') {
$stream = @fsockopen('ssl://' . $host, $port, $errno, $errstr);
} else {
throw new Splunk_UnsupportedOperationException('Unsupported URL scheme.');
}
}
if ($stream === FALSE) {
throw new Splunk_ConnectException($errstr, $errno);
}
$path = '/services/receivers/stream?' . http_build_query($args);
$token = $this->service->getToken();
$headers = array("POST {$path} HTTP/1.1\r\n", "Host: {$host}:{$port}\r\n", "Accept-Encoding: identity\r\n", "Authorization: {$token}\r\n", "X-Splunk-Input-Mode: Streaming\r\n", "\r\n");
Splunk_Util::fwriteall($stream, implode('', $headers));
return $stream;
}
/**
* Sends an HTTP request to the endpoint at the specified path.
*
* @param string $method the HTTP method (ex: 'GET' or 'POST').
* @param string $path relative or absolute URL path.
* @param array $requestHeaders (optional) dictionary of header names and
* values.
* @param string $requestBody (optional) content to send in the request.
* @param array $args (optional) query parameters, merged with
* {<br/>
* **namespace**: (optional) namespace to use, or NULL to use
* this context's default namespace.<br/>
* }
* @return Splunk_HttpResponse
* @throws Splunk_IOException
* @see Splunk_Http::request()
*/
public function sendRequest($method, $path, $requestHeaders = array(), $requestBody = '', $args = array())
{
list($params, $namespace) = Splunk_Util::extractArgument($args, 'namespace', NULL);
$url = $this->url($path, $namespace);
$fullUrl = count($params) == 0 ? $url : $url . '?' . http_build_query($params);
$requestHeaders = array_merge($this->getRequestHeaders(), $requestHeaders);
return $this->http->request($method, $fullUrl, $requestHeaders, $requestBody);
}
/**
* Creates a stream for logging events to the specified index.
*
* In addition to the index name it is highly recommended to specify
* a sourcetype explicitly.
*
* The returned stream should eventually be closed via fclose().
*
* @param array $args (optional) {<br/>
* **host**: (optional) The value to populate in the host field
* for events from this data input.<br/>
* **host_regex**: (optional) A regular expression used to
* extract the host value from each event.<br/>
* **index**: (optional) The index to send events from this
* input to. Highly recommended. Defaults to "default".<br/>
* **source**: (optional) The source value to fill in the
* metadata for this input's events.<br/>
* **sourcetype**: (optional) The sourcetype to apply to
* events from this input.<br/>
* }
* @return resource A stream that you can write event text to.
* @throws Splunk_IOException
* @link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fstream
*/
public function attach($args = array())
{
$scheme = $this->service->getScheme();
$host = $this->service->getHost();
$port = $this->service->getPort();
$errno = 0;
$errstr = '';
$socketContext = stream_context_create(array('ssl' => array('verify_peer' => false, 'verify_peer_name' => false)));
if ($scheme == 'http') {
$stream = @stream_socket_client($host . ":" . $port, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $socketContext);
} else {
if ($scheme == 'https') {
$stream = @stream_socket_client('ssl://' . $host . ":" . $port, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $socketContext);
} else {
throw new Splunk_UnsupportedOperationException('Unsupported URL scheme.');
}
}
if ($stream === FALSE) {
throw new Splunk_ConnectException("error: " . $errstr . $host . ":" . $port, $errno);
}
$path = '/services/receivers/stream?' . http_build_query($args);
$token = $this->service->getToken();
$headers = array("POST {$path} HTTP/1.1\r\n", "Host: {$host}:{$port}\r\n", "Accept-Encoding: identity\r\n", "Authorization: {$token}\r\n", "X-Splunk-Input-Mode: Streaming\r\n", "\r\n");
Splunk_Util::fwriteall($stream, implode('', $headers));
return $stream;
}
