Current File : //usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyo
�
���^c @@ s: d Z d d l m Z m Z m Z d d l Z d d l Z d d l m Z e Z
y" d d l Z d d l
Z
e Z
Wn e k
r� n Xd d l Z d d l m Z e j e � Z i d d 6Z d Z d � Z d
� Z d � Z d d
� Z d d � Z d d � Z d d � Z d d � Z d d d d d d d � Z" d S( u�
Module for interop with the Splunk API
.. versionadded:: 2015.5.0
:depends: - splunk-sdk python module
:configuration: Configure this module by specifying the name of a configuration
profile in the minion config, minion pillar, or master config. The module
will use the 'splunk' key by default, if defined.
For example:
.. code-block:: yaml
splunk:
username: alice
password: abc123
host: example.splunkcloud.com
port: 8080
i ( t absolute_importt unicode_literalst print_functionN( t six( t OrderedDictu listu list_u
splunk_searchc C@ s t r
t St d f S( uF
Only load this module if splunk is installed on this minion.
u� The splunk_search execution module failed to load: requires both the requests and the splunk-sdk python library to be installed.( t HAS_LIBSt __virtualname__t False( ( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt __virtual__4 s c
C@ s� t d | � } d j | j d � | j d � | j d � | j d � � } | t k r� t j j d | j d � d | j d � d | j d � d
| j d � � t | <n t | S( uK
Return the splunk client, cached into __context__ for performance
u
config.optionu splunk_search.{0}:{1}:{2}:{3}u hostu portu usernameu passwordt hostt portt usernamet password( t __salt__t formatt gett __context__t splunklibt clientt connect( t profilet configt key( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt _get_splunk> s c C@ s- | j } | j j | d <| j j | d <| S( u5
Get splunk search properties from an object
u appu sharing( t contentt accesst appt sharing( t searcht props( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt _get_splunk_search_propsR s u splunkc C@ s; t | � } d } y | j | } Wn t k
r6 n X| S( u[
Get a splunk search
CLI Example:
splunk_search.get 'my search name'
N( R t Nonet saved_searchest KeyError( t nameR R R ( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyR \ s
c
K@ s t | � } | j | } t | � } | } t } t � } g } x� t | � D]� }
| j |
d � } | j |
d � } t | t j
� r� | j � } n t | t j
� r� | j � } n | | k rM | | |
<t } | j
d j |
| | � � qM qM W| r| j | � j � | | f St S( um
Update a splunk search
CLI Example:
splunk_search.update 'my search name' sharing=app
u {0}: '{1}' => '{2}'N( R R R R t dictt sortedR R t
isinstanceR t string_typest stript Truet appendR t updatet refresh(
R" R t kwargsR R R t updatest
update_neededt
update_sett diffsR t old_valuet new_value( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyR* n s.
c
K@ s� t | � } | j j | | � } t d | � } d j | j d � | j d � � } | j d � | j d � f } i | j d � d 6d d 6d
d 6} d j | | j d � t j | � � } t j | d
| d t
d | �t | � S( ut
Create a splunk search
CLI Example:
splunk_search.create 'my search name' search='error msg'
u
config.optionu https://{0}:{1}u hostu portu usernameu passwordu owneru appu sharingu *u
perms.readu0 {0}/servicesNS/{1}/search/saved/searches/{2}/aclt autht verifyt data( R R t createR
R R t urllibt quotet requestst postR( R (
R" R R, R R R t urlR3 R5 t _req_url( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyR6 � s $
! c C@ s= t | � } y | j j | � t SWn t k
r8 d SXd S( u`
Delete a splunk search
CLI Example:
splunk_search.delete 'my search name'
N( R R t deleteR( R! R ( R" R R ( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyR= � s
c C@ s0 t | � } g | j D] } | d ^ q } | S( uX
List splunk searches (names only)
CLI Example:
splunk_search.list
u name( R R ( R R t xt searches( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt list_� s c
C@ sD t | � } d } y | j j | � Wn t k
r9 n X| j j | d d �} t | j � } | j j | � d }
t � } t g | j D] } | j | f ^ q� � }
xw|
D]o\ } } | r� | j
j | k r� q� n | r� | j
j | k r� q� n | r| | k rq� n | r:| j
| � r-q� n | | } n i | d 6g } d
} x� t | j j � � D]� \ } } | |
k r�qfn | j
d � r�qfn | s�qfn | | k r�| | | k r�qfn | j i | | 6� | d k rf| } qfqfW| r | | k r q� n i | d 6| d | <q� Wt j j j | d t d d �S( ur
Get all splunk search details. Produces results that can be used to create
an sls file.
if app or owner are specified, results will be limited to matching saved
searches.
if description_contains is specified, results will be limited to those
where "description_contains in description" is true if name_not_contains is
specified, results will be limited to those where "name_not_contains not in
name" is true.
If prefix parameter is given, alarm names in the output will be prepended
with the prefix; alarms that have the prefix will be skipped. This can be
used to convert existing alarms to be managed by salt, as follows:
CLI example:
1. Make a "backup" of all existing searches
$ salt-call splunk_search.list_all --out=txt | sed "s/local: //" > legacy_searches.sls
2. Get all searches with new prefixed names
$ salt-call splunk_search.list_all "prefix=**MANAGED BY SALT** " --out=txt | sed "s/local: //" > managed_searches.sls
3. Insert the managed searches into splunk
$ salt-call state.sls managed_searches.sls
4. Manually verify that the new searches look right
5. Delete the original searches
$ sed s/present/absent/ legacy_searches.sls > remove_legacy_searches.sls
$ salt-call state.sls remove_legacy_searches.sls
6. Get all searches again, verify no changes
$ salt-call splunk_search.list_all --out=txt | sed "s/local: //" > final_searches.sls
$ diff final_searches.sls managed_searches.sls
u# splunk_search.list_all get defaultsR u nothingu triggered_alert_countu action.emailu action.populate_lookupu
action.rssu
action.scriptu action.summary_indexu qualifiedSearchu next_scheduled_timeu nameu u display.u descriptionu splunk_search.presentu manage splunk search t default_flow_stylet widthix ( u triggered_alert_countu action.emailu action.populate_lookupu
action.rssu
action.scriptu action.summary_indexu qualifiedSearchu next_scheduled_time( R R R= t ExceptionR6 R# R R R$ R" R R t ownert
startswitht itemsR) t saltt utilst yamlt safe_dumpR ( t prefixR RD t description_containst name_not_containsR R R" R t defaultst
readonly_keyst resultst sR? t dt descriptiont kt v( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt list_all� s` '
+
"
(# t __doc__t
__future__R R R t loggingR7 t salt.extR R R t splunklib.clientR R9 R( t ImportErrort salt.utils.yamlRG t salt.utils.odictR t getLoggert __name__t logt __func_alias__R R R R R R* R6 R= R@ R RV ( ( ( s> /usr/lib/python2.7/site-packages/salt/modules/splunk_search.pyt <module> s6
"
Mini Shell