class Splunk::Jobs

Class representing a search job in Splunk.

Jobs adds two additional methods to Collection to start additional kinds of search job. The basic create method starts a normal, asynchronous search job. The two new methods, create_oneshot and create_stream, creating oneshot and streaming searches, respectively, which block until the search finishes and return the results directly.

Public Class Methods

new(service) click to toggle source
Calls superclass method Splunk::ReadOnlyCollection.new
# File lib/splunk-sdk-ruby/collection/jobs.rb, line 37
def initialize(service)
  super(service, PATH_JOBS, entity_class=Job)

  # +Jobs+ is one of the inconsistent collections where 0 means
  # list all, not -1.
  @infinite_count = 0
end

Public Instance Methods

create(query, args={}) click to toggle source

Creates an asynchronous search job.

The search job requires a query, and takes a hash of other, optional arguments, which are documented in the Splunk REST documentation.

# File lib/splunk-sdk-ruby/collection/jobs.rb, line 56
def create(query, args={})
  if args.has_key?(:exec_mode)
    raise ArgumentError.new("Cannot specify exec_mode for create. Use " +
                                "create_oneshot or create_stream instead.")
  end

  args['search'] = query
  response = @service.request(:method => :POST,
                              :resource => @resource,
                              :body => args)
  sid = Splunk::text_at_xpath("/response/sid", response.body)
  Job.new(@service, sid)
end
create_export(query, args={}) click to toggle source

Creates a blocking search without transforming search commands.

The create_export method starts a search query, and any optional arguments specified in a hash (which are identical to those taken by create). It then blocks until the job is finished, and returns the events found by the job before any transforming search commands (equivalent to calling events on a Job).

Returns: a stream readable by MultiResultsReader.

# File lib/splunk-sdk-ruby/collection/jobs.rb, line 105
def create_export(query, args={})
  args["search"] = query
  # Suppress segmentation (<sg> tags in the XML response) by default:
  if !args.has_key?(:segmentation)
    args[:segmentation] = "none"
  end
  response = @service.request(:method => :GET,
                              :resource => @resource + ["export"],
                              :query => args)
  return ExportStream.new(response.body)
end
create_oneshot(query, args={}) click to toggle source

Creates a blocking search.

The create_oneshot method starts a search query, and any optional arguments specified in a hash (which are identical to those taken by create). It then blocks until the job finished, and returns the results, as transformed by any transforming search commands in query (equivalent to calling the results method on a Job).

Returns: a stream readable by ResultsReader.

# File lib/splunk-sdk-ruby/collection/jobs.rb, line 81
def create_oneshot(query, args={})
  args[:search] = query
  args[:exec_mode] = 'oneshot'
  # Suppress segmentation (<sg> tags in the XML response) by default:
  if !args.has_key?(:segmentation)
    args[:segmentation] = "none"
  end
  response = @service.request(:method => :POST,
                              :resource => @resource,
                              :body => args)
  return response.body
end