/** * Creates an asynchronous search using the given query. Use this * method for simple searches. * * @param query The search query. * @return The search job. */ public Job search(String query) { return search(query, null); }
/** * @param args options for creating a Job * @return a Job object running this pivot, accelerated if possible. */ public Job run(JobArgs args) { if (this.getAcceleratedQuery() == null) { return service.search(this.getPivotQuery(), args); } else { return service.search(this.getAcceleratedQuery(), args); } }
/** * Start a job that applies querySuffix to all the events in this data model object. * * @param querySuffix a search query, starting with a '|' that will be appended to the command to fetch * the contents of this data model object (e.g., "| head 3"). * @param args arguments to control the job. * @return a Job object. */ public Job runQuery(String querySuffix, JobArgs args) { return getDataModel().getService().search(getQuery() + querySuffix, args); }
/** * Local acceleration is tsidx acceleration of a data model object that is handled * manually by a user. You create a job which generates an index, and then use that * index in your pivots on the data model object. * * The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You * would use it in another job by starting your search query with * * | tstats ... from sid={sid} | ... * * The tsidx index created by this job is deleted when the job is garbage collected * by Splunk. * * It is the user's responsibility to manage this job, including cancelling it. * * @param earliestTime A time modifier (e.g., "-2w") setting the earliest time to index. * @return a Job writing a tsidx index. */ public Job createLocalAccelerationJob(String earliestTime) { String query = "| datamodel " + this.model.getName() + " " + this.getName() + " search | tscollect"; JobArgs args = new JobArgs(); if (earliestTime != null) { args.setEarliestTime(earliestTime); } return this.model.getService().search(query, args); }