PivotFilter(DataModelObject dataModelObject, String fieldName) { this.dataModelObject = dataModelObject; if (!dataModelObject.containsField(fieldName)) { throw new IllegalArgumentException("No such field " + fieldName + " on specified data model object."); } this.fieldName = fieldName; }
/** * Local acceleration is tsidx acceleration of a data model object that is handled * manually by a user. You create a job which generates an index, and then use that * index in your pivots on the data model object. * * The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You * would use it in another job by starting your search query with * * | tstats ... from sid={sid} | ... * * The tsidx index created by this job is deleted when the job is garbage collected * by Splunk. * * It is the user's responsibility to manage this job, including cancelling it. * * @return a Job writing a tsidx index. */ public Job createLocalAccelerationJob() { return createLocalAccelerationJob(null); }
public String getQuery() { return "| datamodel " + this.getDataModel().getName() + " " + this.getName() + " search"; }
/** * Start a job that applies querySuffix to all the events in this data model object. * * @param querySuffix a search query, starting with a '|' that will be appended to the command to fetch * the contents of this data model object (e.g., "| head 3"). * @param args arguments to control the job. * @return a Job object. */ public Job runQuery(String querySuffix, JobArgs args) { return getDataModel().getService().search(getQuery() + querySuffix, args); }
/** * @return a list of the names of DataModelObjects from the most remote ancestor that is * not a built-in parent to this data model object. */ public String[] getAttributeOwnerLineage() { return this.dataModelObject.getField(this.sortAttribute).getOwnerLineage(); }
/** * Parse the JSON returned from splunkd describing this data model. * * This method writes the results into fields of this object. * * @param input a String containing JSON. */ private void parseDescription(String input) { objects = new HashMap<String, DataModelObject>(); JsonElement rootElement = jsonParser.parse(input); for (Entry<String, JsonElement> entry : rootElement.getAsJsonObject().entrySet()) { if (entry.getKey().equals(MODEL_NAME_LABEL)) { content.put(MODEL_NAME_LABEL, entry.getValue().getAsString()); } else if (entry.getKey().equals(DISPLAY_NAME_LABEL)) { content.put(DISPLAY_NAME_LABEL, entry.getValue().getAsString()); } else if (entry.getKey().equals(DESCRIPTION_LABEL)) { description = entry.getValue().getAsString(); } else if (entry.getKey().equals("objects")) { JsonArray objectArray = entry.getValue().getAsJsonArray(); for (JsonElement object : objectArray) { DataModelObject dmo = DataModelObject.parse(this, object); objects.put(dmo.getName(), dmo); } } else { // Allow new keys without complaining } } }
this.statsFunction = statsFunction; if (!dataModelObject.containsField(fieldName)) { throw new IllegalArgumentException("No such field named " + fieldName + " on data model object."); FieldType t = dataModelObject.getField(fieldName).getType();
/** * Start a job that fetches all the events of this data model object. * * @return a Job object. */ public Job runQuery() { return runQuery("", null); }
/** * @return the data model object this one inherits from if it is a user defined data model object * in the same data model; otherwise returns null (for example if the data model object inherits from BaseEvent * or BaseTransaction). */ public DataModelObject getParent() { return this.getDataModel().getObject(this.parentName); }
dmo = new DataModelTransaction(dataModel); } else { dmo = new DataModelObject(dataModel);
/** * Local acceleration is tsidx acceleration of a data model object that is handled * manually by a user. You create a job which generates an index, and then use that * index in your pivots on the data model object. * * The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You * would use it in another job by starting your search query with * * | tstats ... from sid={sid} | ... * * The tsidx index created by this job is deleted when the job is garbage collected * by Splunk. * * It is the user's responsibility to manage this job, including cancelling it. * * @param earliestTime A time modifier (e.g., "-2w") setting the earliest time to index. * @return a Job writing a tsidx index. */ public Job createLocalAccelerationJob(String earliestTime) { String query = "| datamodel " + this.model.getName() + " " + this.getName() + " search | tscollect"; JobArgs args = new JobArgs(); if (earliestTime != null) { args.setEarliestTime(earliestTime); } return this.model.getService().search(query, args); }
/** * @return return the lineage, most remote ancestor first, of the data model object his filter's field is * defined on. */ public String[] getOwnerLineage() { return this.dataModelObject.getField(this.fieldName).getOwnerLineage(); }
/** * Start a job that fetches all the events of this data model object. * * @param args arguments specifying behavior of the job. * @return a Job object. */ public Job runQuery(JobArgs args) { return runQuery("", args); }
PivotSpecification(DataModelObject dataModelObject) { this.dataModelObject = dataModelObject; if (dataModelObject.getDataModel().isAccelerated()) { this.accelerationNamespace = dataModelObject.getDataModel().getName(); } else { this.accelerationNamespace = null; } }
/** * @return the type of the field we are filtering on. */ public FieldType getType() { return this.dataModelObject.getField(fieldName).getType(); }
/** * @return a JSON serialization of this object. */ JsonObject toJson() { JsonObject root = new JsonObject(); root.addProperty("dataModel", this.dataModelObject.getDataModel().getName()); root.addProperty("baseClass", this.dataModelObject.getName()); JsonArray filterArray = new JsonArray(); for (PivotFilter p : filters) { filterArray.add(p.toJson()); } root.add("filters", filterArray); JsonArray rowsplitArray = new JsonArray(); for (PivotRowSplit p : rows) { rowsplitArray.add(p.toJson()); } root.add("rows", rowsplitArray); JsonArray cellvalueArray = new JsonArray(); for (PivotCellValue p : cells) { cellvalueArray.add(p.toJson()); } root.add("cells", cellvalueArray); JsonArray columnsplitArray = new JsonArray(); for (PivotColumnSplit p : columns) { columnsplitArray.add(p.toJson()); } root.add("columns", columnsplitArray); return root; }
/** * Start a job that applies querySuffix to all the events in this data model object. * * @param querySuffix a search query, starting with a '|' that will be appended to the command to fetch * the contents of this data model object (e.g., "| head 3"). * @return a Job object. */ public Job runQuery(String querySuffix) { return runQuery(querySuffix, null); }
/** * Query Splunk for SPL queries corresponding to this pivot. * * @return a Pivot object encapsulating the returned queries. */ public Pivot pivot() { Service service = this.dataModelObject.getDataModel().getService(); Args args = new Args(); args.put("pivot_json", toJson()); if (this.accelerationNamespace != null) { args.put("namespace", this.accelerationNamespace); } ResponseMessage response = service.get( "datamodel/pivot/" + this.dataModelObject.getDataModel().getName(), args ); if (response.getStatus() != 200) { throw HttpException.create(response); } else { return Pivot.parseStream(service, response.getContent()); } } }
/** * Add a filter that limits the number of values of an aggregated field that will be allowed * into the pivot. * * @param field the name of a field * @param sortAttribute field to aggregate for limiting * @param sortDirection whether to take the lowest or highest values of the aggregated field * @param limit how many values of the aggregated field to take * @param statsFunction the function to use for aggregation * @return The PivotSpecification you are modifying. */ public PivotSpecification addFilter(String field, String sortAttribute, SortDirection sortDirection, int limit, StatsFunction statsFunction) { if (!dataModelObject.containsField(field)) { throw new IllegalArgumentException("No such field " + sortAttribute); } assertCorrectlyTypedField( sortAttribute, new FieldType[] { FieldType.STRING, FieldType.NUMBER, FieldType.OBJECTCOUNT } ); LimitPivotFilter filter = new LimitPivotFilter(this.dataModelObject, field, sortAttribute, sortDirection, limit, statsFunction); filters.add(filter); return this; }
/** * @return the name of the data model object on which this split's field is defined. */ public String getOwnerName() { return this.dataModelObject.getField(fieldName).getOwnerName(); }