/** * Indicates whether to enable lookups for this search. Enabling lookups might slow searches significantly depending on the nature of the lookups. * * @param enableLookups * {@code true} to enable lookups, {@code false} if not. */ public void setEnableLookups(boolean enableLookups) { this.put("enable_lookups", enableLookups); }
/** * Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. * * @param realtimeMaximumBlockSeconds * The maximum time to block, in seconds. */ public void setRealtimeMaximumBlockSeconds(int realtimeMaximumBlockSeconds) { this.put("rt_maxblocksecs", realtimeMaximumBlockSeconds); }
/** * Sets the number of seconds to keep this search after processing has stopped. * * @param timeout * The timeout, in seconds. */ public void setTimeout(int timeout) { this.put("timeout", timeout); }
/** * Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. * * @param autoPause * The number of seconds after which to pause. */ public void setAutoPause(int autoPause) { this.put("auto_pause", autoPause); }
/** * Sets the number of events that can be accessible in any given status bucket. Also, in transforming mode, this sets the maximum number of results to store. Specifically, in all calls, {@code codeoffset + count <= max_count}. * * @param maximumCount * The maximum count of events. */ public void setMaximumCount(int maximumCount) { this.put("max_count", maximumCount); }
/** * Indicates whether to reload macro definitions from the macros.conf configuration file. * * @param reloadMacros * {@code true} to reload macro definitions, {@code false} if not. */ public void setReloadMacros(boolean reloadMacros) { this.put("reload_macros", reloadMacros); }
/** * Indicates whether the indexer blocks if the queue for this search is * full. Only applies to real-time searches. * * @param realtimeBlocking * {@code true} to block the indexer for a full queue, {@code false} if not. */ public void setRealtimeBlocking(boolean realtimeBlocking) { this.put("rt_blocking", realtimeBlocking); }
/** * Sets the maximum number of status buckets to generate. A value of 0 means to not generate timeline information. * * @param statusBuckets * The maximum number of buckets. */ public void setStatusBuckets(int statusBuckets) { this.put("status_buckets", statusBuckets); }
/** * Sets the type of search to run ("blocking", "oneshot", or "normal"). * * @param executionMode * The search type. */ public void setExecutionMode(ExecutionMode executionMode) { this.put("exec_mode", executionMode); }
/** * Sets a search ID (SID). If unspecified, a random ID is generated. * * @param id * The search ID. */ public void setId(String id) { this.put("id", id); }
/** * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * * @param latestTime * The latest time. */ public void setLatestTime(String latestTime) { this.put("latest_time", latestTime); }
/** * Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.<p>You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.<p>For information about relative time modifiers, see <a href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers" target="_blank">Time modifiers for search</a> in the Search Reference. * * @param now * The time string. */ public void setNow(String now) { this.put("now", now); }
/** * Sets one or more required fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. * * @param requiredFieldList * The list of fields. */ public void setRequiredFieldList(String[] requiredFieldList) { this.put("rf", requiredFieldList); }
/** * Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. * * @param autoCancel * The number of seconds after which to cancel a job. */ public void setAutoCancel(int autoCancel) { this.put("auto_cancel", autoCancel); }
/** * Sets the number of events to process after which to auto-finalize the search. A value of 0 means no limit. * * @param autoFinalizeEventCount * The number of events. */ public void setAutoFinalizeEventCount(int autoFinalizeEventCount) { this.put("auto_finalize_ec", autoFinalizeEventCount); }
/** * Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * * @param earliestTime * The earliest time. */ public void setEarliestTime(String earliestTime) { this.put("earliest_time", earliestTime); }
/** * Sets the number indicating the queue size (in events) that the indexer * should use for this search. Only applies to real-time searches. * * @param realtimeQueueSize * The queue size, in events. */ public void setRealtimeQueueSize(int realtimeQueueSize) { this.put("rt_queue_size", realtimeQueueSize); }
/** * Sets the search mode ("normal" or "realtime"). * * @param searchMode * The search mode. */ public void setSearchMode(SearchMode searchMode) { this.put("search_mode", searchMode); }
/** * Indicates whether the search should run in a separate spawned process. Searches against indexes must run in a separate process. * * @param spawnProcess * {@code true} to run the search in a separate process, {@code false} if not. */ public void setSpawnProcess(boolean spawnProcess) { this.put("spawn_process", spawnProcess); }
/** * Indicates whether this search should wait for bundle replication to complete. * * @param synchronizeBundleReplication * {@code true} to wait for bundle replication, {@code false} if not. */ public void setSynchronizeBundleReplication(boolean synchronizeBundleReplication) { this.put("sync_bundle_replication", synchronizeBundleReplication); }