Here is a loose example on how to do this.
search_params = {'name': "Some lame search",
'search': "<FILL ME IN>",
'dispatch.ttl': 60 * 60 * 24 * 7 }
search_params_update = {
'description': 'Some description',
'is_scheduled': True,
'cron_schedule': '0 1 * * *', # Daily at 1am
'schedule_window': 120,
}
credentials = SplunkAuth._asdict()
service = client.connect(**credentials)
try:
saved_search = service.saved_searches.create(**search_params)
except HTTPError as err:
if "A saved search with that name already exists." not in "{}".format(err):
log.warning("Unable to set off search - {}".format(" :: ".join("{}".format(err).split("\n"))))
raise
else:
saved_search = service.saved_searches[search_params.get('name')]
update_required = False
for k, v in search_params_update.items():
if saved_search.content.get(k) != v:
update_required = True
break
if update_required:
saved_search.update(**search_params_update).refresh()
else:
saved_search.update(**search_params_update).refresh()
# Do we have a job that is ready to go..
job_data = json.load(service.jobs.get(output_mode='json').get('body'))
completed_jobs = [x for x in job_data.get('entry') if x.get('content', {}).get('label') == search_params['name']
and x.get('content', {}).get('isDone')]
try:
latest = completed_jobs[0]
last_update = datetime.datetime.strptime(latest.get('published').rpartition("-")[0], "%Y-%m-%dT%H:%M:%S.%f")
if (datetime.datetime.now() - last_update).total_seconds() > 60 * 60 * 12:
log.info("Launching new job it's pretty old. {}".format(last_update))
saved_search.dispatch()
log.info("Getting latest completed job {}".format(latest.get('updated')))
job = service.jobs[latest.get('content').get('sid')]
except KeyError:
# What do we have in progress.
in_process_jobs = [x for x in job_data.get('entry') if
x.get('content', {}).get('label') == search_params['name']
and not x.get('content', {}).get('isDone')]
if not in_process_jobs:
saved_search.dispatch()
log.info("New Job has been dispatched")
return {'message': "Job has been dispatched"}
else:
in_process_job = in_process_jobs[-1]
log.info("Job previously dispatched and is at {:.2%}".format(
in_process_job.get('content', {}).get('doneProgress')))
return {'message': "Job previously dispatched and is at {:.2%}".format(
in_process_job.get('content', {}).get('doneProgress'))}
... View more
