/** * Indicates whether the indexer blocks if the queue for this search is full. Only applies to real-time searches. * * @param realtimeBlocking * {@code true} to block the indexer for a full queue, {@code false} if not. */ public void setRealtimeBlocking(boolean realtimeBlocking) { this.put("rt_blocking", realtimeBlocking); }
/** * Sets the number indicating the queue size (in events) that the indexer should use for this search. Only applies to real-time searches. * * @param realtimeQueueSize * The queue size, in events. */ public void setRealtimeQueueSize(int realtimeQueueSize) { this.put("rt_queue_size", realtimeQueueSize); }
/** * Sets the search mode ("normal" or "realtime"). * * @param searchMode * The search mode. */ public void setSearchMode(SearchMode searchMode) { this.put("search_mode", searchMode); }
/** * Sets the format of the output. * * @param outputMode * The output format. */ public void setOutputMode(OutputMode outputMode) { this.put("output_mode", outputMode); }
/** * Sets the number of seconds of inactivity after which to automatically cancel a job. A value of 0 means never auto-cancel. * * @param autoCancel * The number of seconds after which to cancel a job. */ public void setAutoCancel(int autoCancel) { this.put("auto_cancel", autoCancel); }
/** * Sets the number of seconds to run this search before finalizing. Specify 0 to never finalize. * * @param maximumTime * The maximum time, in seconds. */ public void setMaximumTime(int maximumTime) { this.put("max_time", maximumTime); }
/** * Indicates whether this search should wait for bundle replication to complete. * * @param synchronizeBundleReplication * {@code true} to wait for bundle replication, {@code false} if not. */ public void setSynchronizeBundleReplication(boolean synchronizeBundleReplication) { this.put("sync_bundle_replication", synchronizeBundleReplication); }
/** * Specifies the latest time in the time range to search, based on the index time. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * * @param indexLatest * The latest time. */ public void setIndexLatest(String indexLatest) { this.put("index_latest", indexLatest); }
/** * Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * * @param latestTime * The latest time. */ public void setLatestTime(String latestTime) { this.put("latest_time", latestTime); }
/** * Specifies the application namespace in which to restrict searches. * * @param namespace * The namespace. */ public void setNamespace(String namespace) { this.put("namespace", namespace); }
/** * Specifies a time string that sets the absolute time used for any relative time specifier in the search. This value defaults to the current system time.<p> You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. If you specify a relative time modifier both in this parameter and in the search string, the search string modifier takes precedence.<p>For information about relative time modifiers, see <a href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers" target="_blank">Time modifiers for search</a> in the Search Reference. * * @param now * A time string. */ public void setNow(String now) { this.put("now", now); }
/** * Sets the time to wait between running the MapReduce phase on accumulated map values. * * @param reduceFrequency * The time to wait, in seconds. */ public void setReduceFrequency(int reduceFrequency) { this.put("reduce_freq", reduceFrequency); }
/** * Sets a string that registers a search state listener with the search. Use the format: {@code search_state;results_condition;http_method;uri;}<p>For example:<p>{@code search_listener=onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;} * * @param searchListener * The search listener string. */ public void setSearchListener(String searchListener) { this.put("search_listener", searchListener); }
/** * Sets the format for converting a formatted time string from {start,end}_time into UTC seconds. The default value is ISO-8601. * * @param timeFormat * The time format string. */ public void setTimeFormat(String timeFormat) { this.put("time_format", timeFormat); }
/** * Sets the number of seconds to keep this search after processing has stopped. * * @param timeout * The timeout, in seconds. */ public void setTimeout(int timeout) { this.put("timeout", timeout); }
/** * Sets a UTC time format. * * @param outputTimeFormat * A UTC time format. */ public void setOutputTimeFormat(String outputTimeFormat) { this.put("output_time_format", outputTimeFormat); }
/** * Sets the number of seconds of inactivity after which to automatically pause a job. A value of 0 means never auto-pause. * * @param autoPause * The number of seconds after which to pause. */ public void setAutoPause(int autoPause) { this.put("auto_pause", autoPause); }
/** * Sets one or more fields to the search. These fields, even if not referenced or used directly by the search, are still included by the events and summary endpoints. Splunk Web uses these fields to prepopulate panels in the Search view. * * @param fieldList * The list of fields. */ public void setFieldList(String[] fieldList) { this.put("f", fieldList); }
/** * Indicates whether the indexer pre-filters events. Only applies to real-time searches. * * @param realtimeIndexFilter * {@code true} to pre-filter events, {@code false} if not. */ public void setRealtimeIndexFilter(boolean realtimeIndexFilter) { this.put("rt_indexfilter", realtimeIndexFilter); }
/** * Sets the number of seconds indicating the maximum time to block. A value of 0 means no limit. For real-time searches with "rt_blocking" set to {@code true}. * * @param realtimeMaximumBlockSeconds * The maximum time to block, in seconds. */ public void setRealtimeMaximumBlockSeconds(int realtimeMaximumBlockSeconds) { this.put("rt_maxblocksecs", realtimeMaximumBlockSeconds); }