/* * Copyright 2012 Splunk, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"): you may * not use this file except in compliance with the License. You may obtain * a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the * License for the specific language governing permissions and limitations * under the License. */ namespace Splunk { using System; /// /// Extends Args for Job creation setters /// public class JobArgs : Args { /// /// Sets the auto-cancel frequency check, in seconds. The default is 0. /// A value of zero means never auto-cancel. /// public int AutoCancel { set { this["auto_cancel"] = value; } } /// /// Sets the auto-finalize counter. When at least these many events have /// been processed, the job is finalized. The default is 0. A value of /// zero means no limit. /// public int AutoFinalizeEventCount { set { this["auto_finalize_ec"] = value; } } /// /// Sets the auto-pause frequency check, in seconds. The default is 0. /// A value of zero means never auto-pause. /// public int AutoPause { set { this["auto_pause"] = value; } } /// /// Sets the inclusive earliest time bounds for the search. Note that /// although this is a time stamp, it is left as a string in order to /// support Splunk relative time format, such as "+2d" that specifies /// two days from now. /// public string EarliestTime { set { // convert date to string this["earliest_time"] = value; } } /// /// Sets a value indicating whether lookups should be applied to events. /// The default is true. Specifying true may slow searches significantly /// depending on the nature of the lookups. /// public bool EnableLookups { set { this["enable_lookups"] = value; } } /// /// Sets the search execution mode. Valid values are from the list, /// "blocking", "oneshot", "normal". /// /// If set to normal, runs an asynchronous search. /// If set to blocking, returns the sid when the job is /// complete. /// If set to oneshot, returns results in the same call. /// /// The default is normal. /// public string ExecMode { set { this["exec_mode"] = value; } } /// /// Sets a value indicating whether this search should cause (and wait /// depending on the value of sync_bundle_replication) for bundle /// synchronization with all search peers. The default is false. /// public bool ForceBundleReplication { set { this["force_bundle_replication"] = value; } } /// /// Sets the search id. If unset, a random ID is generated. /// public string Id { set { this["id"] = value; } } /// /// Sets the exclusive latest time bounds for the search. Note that /// although this is a time stamp, it is left as a string in order to /// support Splunk relative time format, such as "+2d" that specifies /// two days from now. /// public string LatestTime { set { this["latest_time"] = value; } } /// /// Sets the number of events that can be accesible in any given status /// bucket. When a search is transformed, the maximum number of events /// to store. Specifically, in all calls, codeoffset+count /// <= max_count. The default is 1000. /// public int MaxCount { set { this["max_count"] = value; } } // namespace?? /// /// Sets the absolute time for any relative time specifier in the /// search. Defaults to the current system time. Note that although /// this is a time stamp, it is left as a string in order to support /// Splunk relative time format, such as "+2d" that specifies two days /// from now. /// public string Now { set { this["now"] = value; } } /// /// Sets the MapReduce reduce phase on accumulated map values frequency, /// in seconds. /// public int ReduceFreq { set { this["reduce_freq"] = value; } } /// /// Sets a value indicating whether to reload macro definitions from /// macros.conf. The default is true. /// public bool ReloadMacros { set { this["reload_macros"] = value; } } /// /// Sets the list of (possibly wildcarded) servers from which raw events /// should be pulled. This same server list is to be used in /// subsearches. This list is a comma-separated list. The default is an /// empty list. /// public string RemoteServerList { set { this["remote_server_list"] = value; } } /// /// Sets the list of required fields returned in the search. /// public string[] Rf { set { this["rf"] = value; } } /// /// Sets a value indicating whether the indexer blocks if the queue for /// this search is full. This only applies to real-time searches. The /// default is false. /// public bool RtBlocking { set { this["rt_blocking"] = value; } } /// /// Sets a value indicating whether the indexer prefilters the events. /// This only applies to real-time searches. The default is true. /// public bool RtIndexfilter { set { this["rt_indexfilter"] = value; } } /// /// Sets the maximum time to block, in seconds. This only applies to /// real-time searches and when rt_blocking is true. The default is 60. /// public int RtMaxblockSeconds { set { this["rt_maxblocksecs"] = value; } } /// /// Sets the queue size, in number of events, the indexer should use for /// this search. This only applies for real-time searches. The default /// is 10,000. /// public int RtQueueSize { set { this["rt_queue_size"] = value; } } /// /// Sets a search state listener with the search. The format of this /// string is: /// /// search_state;results_condition;http_method;uri; /// /// For example: /// /// "onResults;true;POST;/servicesNS/admin/search/saved/search/foobar/notify;" /// /// public string SearchListener { set { this["search_listener"] = value; } } /// /// Sets the search mode. Valid values are "normal" and "realtime". /// If set to realtime, search runs over live data. A realtime search /// may also be indicated by earliest_time and latest_time variables /// starting with 'rt' even if the search_mode is set to normal or is /// unset. For a real-time search, if both earliest_time and latest_time /// are both exactly 'rt', the search represents all appropriate live /// data received since the start of the search. Additionally, if /// earliest_time and/or latest_time are 'rt' followed by a relative /// time specifiers then a sliding window is used where the time bounds /// of the window are determined by the relative time specifiers and are /// continuously updated based on the wall-clock time. /// public string SearchMode { set { this["search_mode"] = value; } } /// /// Sets a value indicating whether the search should run in a separate /// spawned process. The default is true. Note: searches against indexes /// must run in a separate process. /// public bool SpawnProcess { set { this["spawn_process"] = value; } } /// /// Sets the maximum number of buckets to create. A value of zero causes /// no timeline information to be generated. The default is 0. /// public int StatusBuckets { set { this["status_buckets"] = value; } } /// /// Sets a value indicating whether this search should wait for bundle /// replication to complete. /// public bool SyncBundleReplication { set { this["sync_bundle_replication"] = value; } } /// /// Sets the time format string, sed to convert a formatted time string /// from {start,end}_time into UTC seconds. It defaults to ISO-8601. /// public string TimeFormat { set { this["time_format"] = value; } } /// /// Sets the number of seconds to keep this search after processing has /// stopped. The default is 86400 (24 hours). /// public int Timeout { set { this["timeout"] = value; } } } }