com.splunk.modularinput

Class Event

java.lang.Object

com.splunk.modularinput.Event

public class Event
extends Object

The Event class represents an event or fragment of an event to be written by this modular input to Splunk. To write an Event to an XML stream, call its writeTo method with an XMLStreamWriter object to write to. The Event must have at least the data field set or writeTo will throw a MalformedDataException. All other fields are optional. If you omit the time field, the writeTo method will fill in the current time when it is called. Typically, you will also want to call setStanza to specify which instance of the modular input kind this event should go to, setTime to set the timestamp, and setSource, setHost, and setSourceType specify where this event came from.

Field Summary

Fields

Modifier and Type	Field and Description
protected String	data
protected boolean	done
protected String	host
protected String	index
protected String	source
protected String	sourceType
protected String	stanza
protected Date	time
protected boolean	unbroken

Constructor Summary

Constructors

Constructor and Description
Event()

Method Summary

Modifier and Type	Method and Description
String	getData() Gets the text of the event that Splunk should index.
String	getHost() Gets a host specifying the name of the network host on which this event was produced.
String	getIndex() Gets an index field specifying which index Splunk should write this event to.
String	getSource() Gets the file, service, or other producer that this Event comes from.
String	getSourceType() Gets a classification of this event.
String	getStanza() Gets the name of the input this event should be sent to.
Date	getTime() Gets a java.util.Date object giving the timestamp that should be sent with this event.
boolean	isDone() Gets a value indicating whether this is the last piece of an event broken across multiple Event objects.
boolean	isUnbroken() Gets a value indicating whether this event is completely encapsulated in this Event object.
void	setData(String data) Sets the text of the event that Splunk should index.
void	setDone(boolean done) Sets a value indicating whether this is the last piece of an event broken across multiple Event objects.
void	setHost(String host) Sets a host specifying the name of the network host on which this event was produced.
void	setIndex(String index) Sets an index field specifying which index Splunk should write this event to.
void	setSource(String source) Sets the file, service, or other producer that this Event comes from.
void	setSourceType(String sourceType) Sets a classification of this event.
void	setStanza(String stanza) Sets the name of the input this event should be sent to.
void	setTime(Date time) Sets a java.util.Date object giving the timestamp that should be sent with this event.
void	setUnbroken(boolean unbroken) Sets a value indicating whether this event is completely encapsulated in this Event object.
protected void	writeFieldTo(XMLStreamWriter out, String name, String value)
void	writeTo(XMLStreamWriter out) Writes this event to the given XMLStreamWriter.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

time

protected Date time

data

protected String data

source

protected String source

sourceType

protected String sourceType

index

protected String index

host

protected String host

done

protected boolean done

unbroken

protected boolean unbroken

stanza

protected String stanza

Constructor Detail

Event

public Event()

Method Detail

writeFieldTo

protected void writeFieldTo(XMLStreamWriter out,
                            String name,
                            String value)
                     throws XMLStreamException

Throws:

XMLStreamException

writeTo

public void writeTo(XMLStreamWriter out)
             throws XMLStreamException,
                    MalformedDataException

Writes this event to the given XMLStreamWriter.

Parameters:

out - The XMLStreamWriter to append to.

Throws:

XMLStreamException - if there is a problem in the XMLStreamWriter.

MalformedDataException - if you have not specified data for this event.

getTime

public Date getTime()

Gets a java.util.Date object giving the timestamp that should be sent with this event. If this field is null, Splunk will assign the time at which the event is indexed as its timestamp.

Returns:

A java.util.Date object giving the time assigned to this Event, or null if Splunk should apply a default timestamp.

setTime

public void setTime(Date time)

Sets a java.util.Date object giving the timestamp that should be sent with this event. If this field is null, Splunk will assign the time at which the event is indexed as its timestamp.

Parameters:

time - The java.util.Date which should be used as this event's timestamp, or null to have Splunk use a default timestamp.

getData

public String getData()

Gets the text of the event that Splunk should index.

Returns:

A String containing the event text.

setData

public void setData(String data)

Sets the text of the event that Splunk should index.

Parameters:

data - A String containing the event text.

getSource

public String getSource()

Gets the file, service, or other producer that this Event comes from. For lines in log files, it is typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source.

Returns:

A String giving the source of this event, or null to have Splunk guess.

setSource

public void setSource(String source)

Sets the file, service, or other producer that this Event comes from. For lines in log files, it is typically the full path to the log file. If it is omitted, Splunk will guess a sensible name for the source.

Parameters:

source - A String to be used as the source of this event, or null to have Splunk guess.

getSourceType

public String getSourceType()

Gets a classification of this event. For example, all different web server logs might be assigned the same source type, or different source types can be assigned to distinct classes of events that all have the same source. If it is omitted, Splunk will guess a sensible name for the source type.

Returns:

The source type currently set on this event, or null if Splunk is to guess a source.

setSourceType

public void setSourceType(String sourceType)

Sets a classification of this event. For example, all different web server logs might be assigned the same source type, or different source types can be assigned to distinct classes of events that all have the same source. If this field is omitted, Splunk will make a guess as to the source type.

Parameters:

sourceType - A String to use as the source type for this event, or null to have Splunk guess.

getIndex

public String getIndex()

Gets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default index where events will be written.

Returns:

The index this event is specified to write to, or null if it will be written to the default index.

setIndex

public void setIndex(String index)

Sets an index field specifying which index Splunk should write this event to. If it is omitted, Splunk has a default index where events will be written.

Parameters:

index - The name of the index to write to, or null to have Splunk write to the default index.

getHost

public String getHost()

Gets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use the host from which it directly received the event.

Returns:

A String giving the host name of the event source, or null to use the host Splunk receives the event from.

setHost

public void setHost(String host)

Sets a host specifying the name of the network host on which this event was produced. If it is omitted, Splunk will use the host from which it directly received the event.

Parameters:

host - A String giving the host name of the event source, or null to use the host Splunk receives the event from.

setDone

public void setDone(boolean done)

Sets a value indicating whether this is the last piece of an event broken across multiple Event objects. Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available one at a time, they can be sent (in events with setUnbroken(false) called on them) as hunks. At the end of the event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event received will be taken to be part of another event. By default, done is true and unbroken is true, so if you do not touch these fields, you will send one complete event per Event object.

Parameters:

done - Is this the last hunk of an event broken across multiple Event objects?

isDone

public boolean isDone()

Gets a value indicating whether this is the last piece of an event broken across multiple Event objects. Splunk allows events from modular inputs to be sent in pieces. For example, if lines of an event become available one at a time, they can be sent (in events with setUnbroken(false) called on them) as hunks. At the end of the event, you must manually tell Splunk to break after this hunk by setting done to true. Then the next event received will be taken to be part of another event. By default, done is true and unbroken is true, so if you do not touch these fields, you will send one complete event per Event object.

Returns:

Is this the last hunk of an event broken across multiple Event objects?

setUnbroken

public void setUnbroken(boolean unbroken)

Sets a value indicating whether this event is completely encapsulated in this Event object. Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to true, then this event is assumed to be a complete event, not a piece of one. By default, unbroken is true. If you set unbroken to false, you need to call setDone(true) on the last hunk of the complete event for Splunk to know to terminate it.

Parameters:

unbroken - Is this event completely encapsulated in this Event object?

isUnbroken

public boolean isUnbroken()

Gets a value indicating whether this event is completely encapsulated in this Event object. Splunk allows events from modular inputs to be sent in pieces. If unbroken is set to true, then this event is assumed to be a complete event, not a piece of one. By default, unbroken is true. If you set unbroken to false, you need to call setDone(true) on the last hunk of the complete event for Splunk to know to terminate it.

Returns:

Is this event completely encapsulated in this Event object?

getStanza

public String getStanza()

Gets the name of the input this event should be sent to. A single modular input script can feed events to multiple instances of the modular input. In this case, each event must be marked with the name of the input it should be sent to. This is also the name of the configuration stanza that describes that input.

Returns:

The name of the input this event should be sent to.

setStanza

public void setStanza(String stanza)

Sets the name of the input this event should be sent to. A single modular input script can feed events to multiple instances of the modular input. In this case, each event must be marked with the name of the input it should be sent to. This is also the name of the configuration stanza that describes that input.

Parameters:

stanza - The name of the input this event should be sent to.