com.splunk.modularinput
Class Event

java.lang.Object
  com.splunk.modularinput.Event

public class Event
extends java.lang.Object

The Event class represents an event or fragment of an event to be written by this modular input to Splunk. To write an Event to an XML stream, call its writeTo method with an XMLStreamWriter object to write to. The Event must have at least the data field set or writeTo will throw a MalformedDataException. All other fields are optional. If you omit the time field, the writeTo method will fill in the current time when it is called. Typically, you will also want to call setStanza to specify which instance of the modular input kind this event should go to, setTime to set the timestamp, and setSource, setHost, and setSourceType specify where this event came from.

Constructor Summary

Event()

Method Summary

java.lang.String	getData() Gets the text of the event that Splunk should index.
java.lang.String	getHost() Gets a host specifying the name of the network host on which this event was produced.
java.lang.String	getIndex() Gets an index field specifying which index Splunk should write this event to.
java.lang.String	getSource() Gets the file, service, or other producer that this Event comes from.
java.lang.String	getSourceType() Gets a classification of this event.
java.lang.String	getStanza() Gets the name of the input this event should be sent to.
java.util.Date	getTime() Gets a java.util.Date object giving the timestamp that should be sent with this event.
boolean	isDone() Gets a value indicating whether this is the last piece of an event broken across multiple Event objects.
boolean	isUnbroken() Gets a value indicating whether this event is completely encapsulated in this Event object.
void	setData(java.lang.String data) Sets the text of the event that Splunk should index.
void	setDone(boolean done) Sets a value indicating whether this is the last piece of an event broken across multiple Event objects.
void	setHost(java.lang.String host) Sets a host specifying the name of the network host on which this event was produced.
void	setIndex(java.lang.String index) Sets an index field specifying which index Splunk should write this event to.
void	setSource(java.lang.String source) Sets the file, service, or other producer that this Event comes from.
void	setSourceType(java.lang.String sourceType) Sets a classification of this event.
void	setStanza(java.lang.String stanza) Sets the name of the input this event should be sent to.
void	setTime(java.util.Date time) Sets a java.util.Date object giving the timestamp that should be sent with this event.
void	setUnbroken(boolean unbroken) Sets a value indicating whether this event is completely encapsulated in this Event object.
void	writeTo(javax.xml.stream.XMLStreamWriter out) Writes this event to the given XMLStreamWriter.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Event

public Event()

Method Detail

writeTo

public void writeTo(javax.xml.stream.XMLStreamWriter out)
             throws javax.xml.stream.XMLStreamException,
                    MalformedDataException

Writes this event to the given XMLStreamWriter.

Parameters:

out - The XMLStreamWriter to append to.

Throws:

javax.xml.stream.XMLStreamException - if there is a problem in the XMLStreamWriter.

MalformedDataException - if you have not specified data for this event.

getTime

public java.util.Date getTime()

Gets a java.util.Date object giving the timestamp that should be sent with this event. If this field is null, Splunk will assign the time at which the event is indexed as its timestamp.

Returns:

A java.util.Date object giving the time assigned to this Event, or null if Splunk should apply a default timestamp.

setTime

public void setTime(java.util.Date time)

Sets a java.util.Date object giving the timestamp that should be sent with this event. If this field is null, Splunk will assign the time at which the event is indexed as its timestamp.

Parameters:

time - The java.util.Date which should be used as this event's timestamp, or null to have Splunk use a default timestamp.

getData

public java.lang.String getData()

Gets the text of the event that Splunk should index.

Returns:

A String containing the event text.

setData

public void setData(java.lang.String data)

Sets the text of the event that Splunk should index.

Parameters:

data - A String containing the event text.

getSource

public java.lang.String getSource()

Gets the file, service, or other producer that this Event comes from. For lines in log files, it is typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source.

Returns:

A String giving the source of this event, or null to have Splunk guess.

setSource

public void setSource(java.lang.String source)

Sets the file, service, or other producer that this Event comes from. For lines in log files, it is typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source.

Parameters:

source - A String to be used as the source of this event, or null to have Splunk guess.

getSourceType

public java.lang.String getSourceType()

Gets a classification of this event. For example, all different web server logs might be assigned the same source type, or different source types can be assigned to distinct classes of events that all have the same source. If it is omitted, Splunk will guess a sensible name for the source type.

Returns:

The source type currently set on this event, or null if Splunk is to guess a source.

setSourceType

public void setSourceType(java.lang.String sourceType)

Sets a classification of this event. For example, all different web server logs might be assigned the same source type, or different source types can be assigned to distinct classes of events that all have the same source. If this field is omitted, Splunk will make a guess as to the source type.

Parameters:

sourceType - A String to use as the source type for this event, or null to have Splunk guess.

getIndex

public java.lang.String getIndex()

Gets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default index where events will be written.

Returns:

The index this event is specified to write to, or null if it will be written to the default index.

setIndex

public void setIndex(java.lang.String index)

Sets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default index where events will be written.

Parameters:

index - The name of the index to write to, or null to have Splunk write to the default index.

getHost

public java.lang.String getHost()

Gets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use the host from which it directly received the event.

Returns:

A String giving the host name of the event source, or null to use the host Splunk receives the event from.

setHost

public void setHost(java.lang.String host)

Sets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use the host from which it directly received the event.

Parameters:

host - A String giving the host name of the event source, or null to use the host Splunk receives the event from.

setDone

public void setDone(boolean done)

Sets a value indicating whether this is the last piece of an event broken across multiple Event objects. Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available one at a time, they can be sent (in events with setUnbroken(false) called on them) as hunks. At the end of the event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event received will be taken to be part of another event. By default, done is true and unbroken is true, so if you do not touch these fields, you will send one complete event per Event object.

Parameters:

done - Is this the last hunk of an event broken across multiple Event objects?

isDone

public boolean isDone()

Gets a value indicating whether this is the last piece of an event broken across multiple Event objects. Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available one at a time, they can be sent (in events with setUnbroken(false) called on them) as hunks. At the end of the event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event received will be taken to be part of another event. By default, done is true and unbroken is true, so if you do not touch these fields, you will send one complete event per Event object.

Returns:

Is this the last hunk of an event broken across multiple Event objects?

setUnbroken

public void setUnbroken(boolean unbroken)

Sets a value indicating whether this event is completely encapsulated in this Event object. Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to true, then this event is assumed to be a complete event, not a piece of one. By default, unbroken is true. If you set unbroken to false, you need to call setDone(true) on the last hunk of the complete event for Splunk to know to terminate it.

Parameters:

unbroken - Is this event completely encapsulated in this Event object?

isUnbroken

public boolean isUnbroken()

Gets a value indicating whether this event is completely encapsulated in this Event object. Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to true, then this event is assumed to be a complete event, not a piece of one. By default, unbroken is true. If you set unbroken to false, you need to call setDone(true) on the last hunk of the complete event for Splunk to know to terminate it.

Returns:

Is this event completely encapsulated in this Event object?

getStanza

public java.lang.String getStanza()

Gets the name of the input this event should be sent to. A single modular input script can feed events to multiple instances of the modular input. In this case, each event must be marked with the name of the input it should be sent to. This is also the name of the configuration stanza that describes that input.

Returns:

The name of the input this event should be sent to.

setStanza

public void setStanza(java.lang.String stanza)

Sets the name of the input this event should be sent to. A single modular input script can feed events to multiple instances of the modular input. In this case, each event must be marked with the name of the input it should be sent to. This is also the name of the configuration stanza that describes that input.

Parameters:

stanza - The name of the input this event should be sent to.