| 27 | |
| 28 | |
| 29 | class SplunkQueryManager(object): |
| 30 | # The offset within the query |
| 31 | _OFFSET = 0 |
| 32 | |
| 33 | # How many results to fetch |
| 34 | _COUNT = 100 |
| 35 | |
| 36 | # The result count |
| 37 | RESULTCOUNT = 0 |
| 38 | |
| 39 | # The Splunk client connection |
| 40 | _CLIENT = None |
| 41 | |
| 42 | # A pointer to the last job executed |
| 43 | _JOB = None |
| 44 | |
| 45 | # The logger |
| 46 | _logger = None |
| 47 | |
| 48 | def _log(self): |
| 49 | """ |
| 50 | Get the log |
| 51 | """ |
| 52 | return logging.getLogger(__name__) |
| 53 | |
| 54 | def __init__(self, config_file="", log_level=None): |
| 55 | """ |
| 56 | Initialize the query manager |
| 57 | """ |
| 58 | self._logger = self._log() |
| 59 | if log_level is not None: |
| 60 | self._logger.setLevel(log_level) |
| 61 | |
| 62 | if self._CLIENT is None: |
| 63 | splunk_connector = SplunkConnector.SplunkConnector(config_file) |
| 64 | self._CLIENT = splunk_connector.get_splunk_client() |
| 65 | |
| 66 | if self._CLIENT is None: |
| 67 | self._logger.error("FATAL: Could not create Splunk client") |
| 68 | exit(1) |
| 69 | |
| 70 | self._OFFSET = 0 |
| 71 | self._COUNT = 100 |
| 72 | |
| 73 | def _create_job(self, search_query): |
| 74 | """ |
| 75 | Create the new job |
| 76 | """ |
| 77 | return self._CLIENT.jobs.create( |
| 78 | search_query, **{"exec_mode": "blocking", "output_mode": "json"} |
| 79 | ) |
| 80 | |
| 81 | def do_search(self, search_query, count): |
| 82 | """ |
| 83 | Perform a paginated search. |
| 84 | The search query should in the format of "search index=...." |
| 85 | Count refers to the number of results per page. |
| 86 | """ |
nothing calls this directly
no outgoing calls
no test coverage detected