Hi,..
I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?
Saved Search:
source="abc.log" index="index1" | search host=$temp$| stats count(host)
Java Code:
SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443");
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**
Job jobSavedSearch = null;
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);
Error :
Exception in thread "main" com.splunk.HttpException: HTTP 400 --
In handler 'savedsearch': Argument "temp" is not supported by this handler.
What arguments should I pass from the code?
Thanks
It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:
host=my_host field1=$args.surname$
then you can do:
SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name
SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.add("args.surname", "IVAN*");
Job job = savedSearch.dispatch(dispatchArgs);
while(!job.isDone()){
try {
Thread.sleep(500);
} catch (InterruptedException ex) {
System.out.println("Waiting thread was interrupted: " + ex.toString());
}
}
try{
Args outputArgs = new Args();
outputArgs.put("output_mode","json");
InputStream inputStream = job.getEvents(outputArgs);
byte[] buffer = new byte[4096];
while(inputStream.read(buffer)!=-1){
System.out.println(new String(buffer));
}
}catch(Exception ex){
System.out.println("Error getting result from Splunk: " + ex.toString());
}
Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY