Class: Hutils::Ltap::SplunkDrainer

Inherits:
Object
  • Object
show all
Defined in:
lib/hutils/ltap/splunk_drainer.rb

Instance Method Summary collapse

Constructor Details

#initialize(earliest:, key:, timeout:, query:, timestamps:, url:, verbose:) ⇒ SplunkDrainer

Returns a new instance of SplunkDrainer.



9
10
11
12
13
14
15
16
17
18
 
# File 'lib/hutils/ltap/splunk_drainer.rb', line 9

def initialize(earliest:, key:, timeout:, query:, timestamps:, url:, verbose:)
  @earliest = earliest
  @timeout = timeout
  @query = query
  @timestamps = timestamps
  @verbose = verbose

  @user = URI.parse(url).user
  @api = Excon.new(url)
end

Instance Method Details

#cancel_job ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/hutils/ltap/splunk_drainer.rb', line 47

def cancel_job
  return unless @job_id
  @api.post(
    path: "/servicesNS/#{@user}/search/search/jobs/#{@job_id}/control",
    expects: 200,
    body: URI.encode_www_form({
      action: "cancel"
    })
  )
  debug("cancelled")
end

#run ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/hutils/ltap/splunk_drainer.rb', line 20

def run
  create_job(@query)
  start = Time.now

  loop do
    sleep(2)
    break if job_finished?

    # finalize the job if we've broken our timeout point
    if (Time.now - start).to_i > @timeout
      debug("breaking: reached timeout")
      finalize_job
      break
    end
  end

  messages = []
  loop do
    new_messages = get_job_results(messages.count)
    messages += new_messages
    break if new_messages.count < MAX_RESULTS_PAGE
  end

  # give oldest first by default
  messages.reverse
end