About Neeraj_Luthra

Neeraj_Luthra · ‎04-01-2013

job.cancel() will remove that particular job from the saved search's history ... if that's what you are asking.

Neeraj_Luthra · ‎03-29-2013

The Splunk SDK for C# does not currently support any APIs on Storm.

Neeraj_Luthra · ‎03-29-2013

It is a fresh deployment so if you run into issues, please let us know and we try to fix them soon. <repositories> <repository> <id>ext-release-local</id> <url>http://splunk.artifactoryonline.com/splunk/ext-releases-local</url> </repository> </repositories> <dependencies> <dependency> <groupId>com.splunk</groupId> <artifactId>splunk</artifactId> <version>1.1.0</version> </dependency> </dependencies>

Neeraj_Luthra · ‎03-26-2013

If the jobColl is not empty, then the first element in the array will be the most recent run. SavedSearch savedSearch = service.getSavedSearches().get("mysavedsearch"); Job[] jobColl =savedSearch.history(); Job job; if (jobColl.length > 0) { // get the most recent run job = jobColl[0]; } else { job = savedSearch.dispatch(); }

Neeraj_Luthra · ‎03-26-2013

Yeah, absolutely. Just make sure to put the search keyword before the search criteria. Good luck.

Neeraj_Luthra · ‎03-26-2013

Try this - searchQuery = "search java.sql.SQLException: Closed Connection";

Neeraj_Luthra · ‎03-26-2013

Can you tell me what value are you passing for searchQuery variable?

Neeraj_Luthra · ‎03-26-2013

Yes, you can.

Neeraj_Luthra · ‎03-26-2013

You may not be passing the values in the right format. Here is a way to pass time strings and you can also pass in relative time like "-20m@m". Please go through the documentation to learn more about job arguments. JobArgs jobArgs = new JobArgs(); jobArgs.setEarliestTime("2013-03-26T00:00:00.000-07:00"); Job job = service.getJobs().create("search index=_internal", jobArgs); while (!job.isDone()) { Thread.sleep(500); } System.out.println(job.getResultCount());

Neeraj_Luthra · ‎03-26-2013

You may be passing invalid arguments during creation. Keep in mind that the list of arguments are different for creation vs. getting results. Please review the documentation for How to run searches.

Neeraj_Luthra · ‎03-25-2013

getResultsCount is the total count of results returned by the job. Keep in mind that this is different from getEventCount. You can read more here. Btw, I think the reason you are getting 100 is because of your you have " ... | head 100" in your search query.

Neeraj_Luthra · ‎03-25-2013

Try this code: InputStream inpStream = job.getResults(jobRes); System.out.println("result size: " + job.getResultCount()); ResultsReaderXml resultsReader = new ResultsReaderXml(inpStream); Event event = null; while ((event = resultsReader.getNextEvent()) != null) { System.out.println("_raw:" + event.get("_raw")); System.out.println("host:" + event.get("host")); System.out.println("sourcetype:" + event.get("sourcetype")); System.out.println("source:" + event.get("source")); } Similarly you can use ResultsReaderJson as well. You can also refer to sample code in the How-To section of our Java SDK.

Neeraj_Luthra · ‎03-21-2013

How about this ... kwargs_results = {"count": 0} search_results = job.results(**kwargs_results)

Neeraj_Luthra · ‎03-21-2013

Try this: body=urllib.urlencode({'search': searchQuery1, 'count': 0})

Neeraj_Luthra · ‎03-21-2013

You can write a while loop and continue to refresh the job and check for isDone property on the job. Exit when the property value changes to 1. Checkout the Python SDK and code sample for this while loop at http://dev.splunk.com/view/SP-CAAAEE5#normaljob.

Neeraj_Luthra · ‎03-20-2013

There are a few issues with what you are doing: If you are on Splunk 5, you do not need xml2json, unless of course you are trying to run the unit tests. service.login function call is missing a couple of closing parenthesis. scheme should be https, unless you have changed the default Splunk installation. You need to serve this page from a web server and in that web server you will need to set up the proxy. This last steps is taken care of if you run the examples through node, i.e. node sdkdo examples from the command line. This is also documented at JavaScript SDK Browser Examples.

Neeraj_Luthra · ‎03-20-2013

I understand now what you are asking for. Unfortunately, the Splunk SDKs don't have that capability at this point. You will have to roll your own for now.

Neeraj_Luthra · ‎03-20-2013

If you are up for it, send me an email and I can get you the assembly for testing against VS 2010.

Neeraj_Luthra · ‎03-20-2013

For server side languages, going through proxy should work too but I am not sure I understand your use case. That is a common ask for browser related code and we have some documentation on how to go through proxy in that scenario. Are you running into any specific issue?

Neeraj_Luthra · ‎03-20-2013

We have not tested that with Visual Studio 2010. We will be providing an assembly soon that you should be able to use in VS 2010.

Neeraj_Luthra · ‎03-19-2013

The latest jar for Splunk SDK for Java is available at http://dev.splunk.com/view/java-sdk/SP-CAAAECN. You can download the pre-built jar directly from there.

Neeraj_Luthra · ‎03-19-2013

The splunk2.jar on code.google.com is legacy code and no longer available and/or supported. The SDKs available on Developer Platform are the ones that are officially kept up to date with the latest Splunk versions. Unfortunately there is no documented migration path but we have very rich documentation on the the Splunk SDK for Java. How-To section has sample code for running searches and displaying results. You can use that as a reference and update your code accordingly.

Neeraj_Luthra · ‎03-19-2013

For now the Splunk jar is available on spring’s maven repo - http://repo.springsource.org/simple/ext-release-local. The latest 1.0 release of Splunk SDK for Java can be added as a dependency in your project’s pom as follows: <dependency> <groupId>com.splunk</groupId> <artifactId>splunk</artifactId> <version>1.0.0</version> </dependency> Of course, you will need to add the above repo to your list as well so maven knows where to look for this artifact.

Neeraj_Luthra · ‎03-15-2013

We have had the Java SDK out for quite some time now and have a fair number of customers using it as well. If you have any questions using the SDK, we would be happy to assist you. Look for answers on Splunkbase for similar questions and you can also reach out to Splunk Support if you have purchased a Splunk enterprise license.

Neeraj_Luthra · ‎03-15-2013

The JSON output format has changed in 5.0. I would recommend using the Splunk SDK for Java. It is compatible with Splunk 4.2x as well as 5.0. We have rich documentation, examples and a lot of How-Tos that you can use as reference for common use cases.

Posts	100
Solutions	14
Karma Given	3
Karma Received	41
Member Since	‎08-02-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: How to call scheduled saved search from java s...

Re: Default Host & Port for C# SDK and SplunkStorm...

Re: Do we have splunk 1.1 jar as maven dependency

Re: How to call scheduled saved search from java s...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: How to run a search and retrieve elements from...

Re: REST API Python - Issue with pulling results b...

Re: REST API Python - Issue with pulling results b...

Re: REST API Python - Issue with pulling results b...

Re: Not able to connect to splunk using javascript...

Re: Splunk SDK connect through a proxy

Re: C# SDK compile

Re: Splunk SDK connect through a proxy

Re: C# SDK compile

Re: Where do I get the latest splunk jar?

Re: Moving from splunk2.jar to new jar file splunk...

Re: splunk.jar in maven2 repo?

Re: Migrating to 5.0.1 but old Splunk Java API no ...

Re: Migrating to 5.0.1 but old Splunk Java API no ...

Join the Conversation