phpDocumentor
Back to top  

Represents a running or completed search job.

package Splunk

 Methods

Stops this search job and deletes the results.

cancel() 

Exceptions

\Splunk_IOException

Deletes this entity.

delete() 
Inherited
inherited_from \Splunk_Entity::delete()

Exceptions

\Splunk_IOException

Stops this search job but keeps the partial results.

finalize() 

Exceptions

\Splunk_IOException

Gets an array that contains the properties of this entity.

getContent() : array
Inherited
inherited_from \Splunk_Entity::getContent()

Returns

arrayThe properties of this entity.

Gets the name of this entity.

getName() : string
see \Splunk_Entity::getName()

Returns

stringThe name of this entity. This name can be used to lookup this entity from its collection.

Gets the non-wildcarded namespace in which this entity resides.

getNamespace() : \Splunk_Namespace
Inherited
inherited_from \Splunk_Entity::getNamespace()

Returns

\Splunk_NamespaceThe non-wildcarded namespace in which this entity resides.

Returns a value that indicates the percentage of this job's results that were computed at the time this job was last loaded or refreshed.

getProgress() : float
see \Splunk_Entity::refresh()

Returns

floatPercentage of this job's results that were computed (0.0-1.0) at the time this job was last loaded or refreshed.

Returns an iterator over the results from this job.

getResults(array $args) : \Iterator

Large result sets will be paginated automatically.

Example:

 $job = ...;
 while (!$job->refresh()->isDone()) { usleep(0.5 * 1000000); }

 foreach ($job->getResults() as $result)
 {
     // (See documentation for Splunk_ResultsReader to see how to
     //  interpret $result.)
     ...
 }

This method cannot be used to access results from realtime jobs, which are never done. Use getResultsPreviewPage() instead.

link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults

Parameters

$args

array

(optional) {
count: (optional) The maximum number of results to return, or -1 to return as many as possible. Defaults to returning as many as possible.
offset: (optional) The offset of the first result to return. Defaults to 0.
pagesize: (optional) The number of results to fetch from the server on each request when paginating internally, or -1 to return as many results as possible. Defaults to returning as many results as possible.
field_list: (optional) Comma-separated list of fields to return in the result set. Defaults to all fields.
output_mode: (optional) The output format of the result. Valid values:
- "csv"
- "raw"
- "xml": The format parsed by Splunk_ResultsReader.
- "json"
Defaults to "xml".
You should not change this unless you are parsing results yourself.
search: (optional) The post processing search to apply to results. Can be any valid search language string. For example "search sourcetype=splunkd" will match any result whose "sourcetype" field is "splunkd".
}

Exceptions

\Splunk_JobNotDoneException If the results are not ready yet. Check isDone() to ensure the results are ready prior to calling this method.
\Splunk_IOException

Returns

\IteratorThe results (i.e. transformed events) of this job, via an iterator.

Returns a single page of results from this job.

getResultsPage(array $args) : resource

Most potential callers should use getResults() instead. Only use this method if you wish to parse job results yourself or want to control pagination manually.

By default, all results are returned. For large result sets, it is advisable to fetch items using multiple calls with the paging options (i.e. 'offset' and 'count').

The format of the results depends on the 'output_mode' argument (which defaults to "xml"). XML-formatted results can be parsed using Splunk_ResultsReader. For example:

 $job = ...;
 while (!$job->refresh()->isDone()) { usleep(0.5 * 1000000); }

 $results = new Splunk_ResultsReader($job->getResultsPage());
 foreach ($results as $result)
 {
     // (See documentation for Splunk_ResultsReader to see how to
     //  interpret $result.)
     ...
 }

This method cannot be used to access results from realtime jobs, which are never done. Use getResultsPreviewPage() instead.

link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults

Parameters

$args

array

(optional) {
count: (optional) The maximum number of results to return, or -1 to return as many as possible. Defaults to returning as many as possible.
offset: (optional) The offset of the first result to return. Defaults to 0.
field_list: (optional) Comma-separated list of fields to return in the result set. Defaults to all fields.
output_mode: (optional) The output format of the result. Valid values:
- "csv"
- "raw"
- "xml": The format parsed by Splunk_ResultsReader.
- "json"
Defaults to "xml".
You should not change this unless you are parsing results yourself.
search: (optional) The post processing search to apply to results. Can be any valid search language string. For example "search sourcetype=splunkd" will match any result whose "sourcetype" field is "splunkd".
}

Exceptions

\Splunk_JobNotDoneException If the results are not ready yet. Check isDone() to ensure the results are ready prior to calling this method.
\Splunk_IOException

Returns

resourceThe results (i.e. transformed events) of this job, as a stream.

Returns a single page of results from this job, which may or may not be done running.

getResultsPreviewPage(array $args) : resource
link http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults_preview

Parameters

$args

array

(optional) {
count: (optional) The maximum number of results to return, or -1 to return as many as possible. Defaults to returning as many as possible.
offset: (optional) The offset of the first result to return. Defaults to 0.
field_list: (optional) Comma-separated list of fields to return in the result set. Defaults to all fields.
output_mode: (optional) The output format of the result. Valid values:
- "csv"
- "raw"
- "xml": The format parsed by Splunk_ResultsReader.
- "json"
Defaults to "xml".
You should not change this unless you are parsing results yourself.
search: (optional) The post processing search to apply to results. Can be any valid search language string. For example "search sourcetype=splunkd" will match any result whose "sourcetype" field is "splunkd".
}

Exceptions

\Splunk_IOException

Returns

resourceThe results (i.e. transformed events) of this job, as a stream.

Returns the search string executed by this job.

getSearch() : string

Returns

stringThe search string executed by this job.

Returns a value that indicates whether this job's results were available at the time this job was last loaded or refreshed.

isDone() : boolean
see \Splunk_Entity::refresh()

Returns

booleanWhether this job's results were available at the time this job was last loaded or refreshed.

Returns a value that indicates whether this job has been loaded.

isReady() : bool

Returns

boolWhether this job has been loaded.

Loads this job, retrying the specified number of times as necessary.

makeReady(int $maxTries, float $delayPerRetry) : \Splunk_Entity

Parameters

$maxTries

int

The maximum number of times to try loading this job.

$delayPerRetry

float

The number of seconds to wait between attempts to retry loading this job.

Exceptions

\Splunk_IOException

Returns

\Splunk_EntityThis entity.

Gets a value that indicates whether the specified entity property exists.

offsetExists(string $key) : string
Inherited
inherited_from \Splunk_Entity::offsetExists()

Parameters

$key

string

The name of an entity property.

Returns

stringWhether the specified entity property exists.

Gets the value of the specified entity property.

offsetGet(string $key) : string
Inherited
inherited_from \Splunk_Entity::offsetGet()

Parameters

$key

string

The name of an entity property.

Returns

stringThe value of the specified entity property.

Pauses this search job.

pause() 

Exceptions

\Splunk_IOException

Refreshes this entity's properties from the Splunk server.

refresh() : \Splunk_Entity
Inherited
inherited_from \Splunk_Entity::refresh()

Exceptions

\Splunk_IOException

Returns

\Splunk_EntityThis entity.

Sends an HTTP DELETE request relative to this endpoint.

sendDelete(string $relativePath, array $args) : \Splunk_HttpResponse
Inherited
see \Splunk_Http::delete()
inherited_from \Splunk_Endpoint::sendDelete()
inherited_from \Splunk_Entity::sendDelete()

Parameters

$relativePath

string

relative URL path.

$args

array

(optional) query parameters, merged with {
namespace: (optional) namespace to use, or NULL to use the context's default namespace.
}

Exceptions

\Splunk_IOException

Returns

\Splunk_HttpResponse

Sends an HTTP GET request relative to this endpoint.

sendGet(string $relativePath, array $args) : \Splunk_HttpResponse
Inherited
see \Splunk_Http::get()
inherited_from \Splunk_Endpoint::sendGet()
inherited_from \Splunk_Entity::sendGet()

Parameters

$relativePath

string

relative URL path.

$args

array

(optional) query parameters, merged with {
namespace: (optional) namespace to use, or NULL to use the context's default namespace.
}

Exceptions

\Splunk_IOException

Returns

\Splunk_HttpResponse

Sends an HTTP POST request relative to this endpoint.

sendPost(string $relativePath, array $args) : \Splunk_HttpResponse
Inherited
see \Splunk_Http::post()
inherited_from \Splunk_Endpoint::sendPost()
inherited_from \Splunk_Entity::sendPost()

Parameters

$relativePath

string

relative URL path.

$args

array

(optional) form parameters to send in the request body, merged with {
namespace: (optional) namespace to use, or NULL to use the context's default namespace.
}

Exceptions

\Splunk_IOException

Returns

\Splunk_HttpResponse

Unpauses this search job.

unpause() 

Exceptions

\Splunk_IOException

Updates this entity's properties.

update(array $args) : \Splunk_Entity
Inherited

Note that the "name" property cannot be updated.

inherited_from \Splunk_Entity::update()

Parameters

$args

array

Dictionary of properties that will be changed, along with their new values.

Exceptions

\Splunk_IOException

Returns

\Splunk_EntityThis entity.

Returns the <entry> element inside the root element.

extractEntryFromRootXmlElement($xml) 

Parameters

$xml

Fetches this entity's Atom feed from the Splunk server.

fetch($fetchArgs) 

Parameters

$fetchArgs

Exceptions

\Splunk_IOException

Gets the namespace in which this entity resides.

getSearchNamespace() : \Splunk_Namespace | NULL
Inherited
inherited_from \Splunk_Entity::getSearchNamespace()

Returns

\Splunk_NamespaceNULLThe namespace in which this endpoint resides, or NULL to use the context's default namespace. Possibly a non-exact namespace.

Gets the title of this entity in the REST API.

getTitle() : string
Inherited
inherited_from \Splunk_Entity::getTitle()

Returns

stringThe title of this entity in the REST API.

Returns a value that indicates whether the entity has been loaded.

isLoaded() 
Inherited
inherited_from \Splunk_Entity::isLoaded()

Loads this resource if not already done.

validate($fetchArgs) : \Splunk_Entity
Inherited

Returns self.

inherited_from \Splunk_Entity::validate()

Parameters

$fetchArgs

Exceptions

\Splunk_IOException

Returns

\Splunk_EntityThis entity.

Fetches a page of the specified type.

fetchPage($pageType, $args) 

Parameters

$pageType

$args

Loads this resource.

load($fetchArgs) 
Inherited
inherited_from \Splunk_Entity::load()

Parameters

$fetchArgs

Exceptions

\Splunk_IOException

Parses the entry's contents.

parseContentsFromEntry() 
Inherited
inherited_from \Splunk_Entity::parseContentsFromEntry()

Posts the specified control action.

sendControlAction($actionName) 

Parameters

$actionName

Exceptions

\Splunk_IOException

Sends a simple request relative to this endpoint.

sendSimpleRequest($method, $relativePath, $args) 
Inherited
inherited_from \Splunk_Endpoint::sendSimpleRequest()
inherited_from \Splunk_Entity::sendSimpleRequest()

Parameters

$method

$relativePath

$args

 Properties

 

$path 
Inherited
inherited_from \Splunk_Endpoint::$$path
inherited_from \Splunk_Entity::$$path
 

$service 
Inherited
inherited_from \Splunk_Endpoint::$$service
inherited_from \Splunk_Entity::$$service
 

$content 
Inherited
inherited_from \Splunk_Entity::$$content
 

$entry 
Inherited
inherited_from \Splunk_Entity::$$entry
 

$loaded 
Inherited
inherited_from \Splunk_Entity::$$loaded
 

$namespace 
Inherited
inherited_from \Splunk_Entity::$$namespace

 Constants

 

DEFAULT_FETCH_DELAY_PER_RETRY

DEFAULT_FETCH_DELAY_PER_RETRY 
 

DEFAULT_FETCH_MAX_TRIES

DEFAULT_FETCH_MAX_TRIES