Python Intersplunk.generateErrorResults方法代码示例

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def parseSpan(span):
    #maxspan = [<integer> s|m|h|d]
    match = re.search("(\d*)([shdwmqy])", span)
    if match == None:
        si.generateErrorResults(" 'timeunit' argument required, such as s (seconds), h (hours), d (days), w (weeks), y (years). Optionally prefix with a number: 600s (10 minutes), 2w (2 weeks).")
        exit(-1)
    scalar, units = match.groups()
    if len(scalar) == 0:
        scalar = 1
    secs = scalar = int(scalar)
    if units == "s":
        pass
    elif units == "h":
        secs *= 60 * 60
    elif units == "d":
        secs *= 24 * 60 * 60
    elif units == "w":
        secs *= 7 * 24 * 60 * 60
    elif units == "m":
        secs *= 30 * 24 * 60 * 60
    elif units == "q":
        secs *= 365/4. * 24 * 60 * 60
    elif units == "y":
        secs *= 365 * 24 * 60 * 60
    else:
        return None, None, None
    return secs, scalar, units

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def run(results, fields):
    
    try:
        values = set()
        for result in results:
            field = None
            for f,v in result.items():
                if f not in ['count','percent']:
                    field = f
                    break
            else:
                continue
            value = result[field]
            if value.lower() == "other":
                value = ' '.join(['NOT %s="%s" ' % (field, v.replace('"','\\"')) for v in values]) + ' %s=*' % field
            elif value.lower() == "null":
                value = 'NOT %s=*' % field
            else:
                values.add(value)
                value = '%s="%s"' % (field, v.replace('"','\\"'))

            result['_drilldown'] = value

        if '_drilldown' not in fields:
            fields.append('_drilldown')

        si.outputResults(results, {}, fields=fields)
    except Exception, e2:
        stack2 =  traceback.format_exc()
        si.generateErrorResults("Error '%s'. %s" % (e2, stack2))

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def run(spantext, seriesmode, results):
    
    try:

        secsPerSpan, scalar, unit = parseSpan(spantext)
        maxtime = -1
        # for each results
        time_data = {}
        fields_seen = {}
        span = None
        latest = None
        for result in results:
            if maxtime < 0:
                try:
                    maxtime = int(float(result['info_max_time']))
                except:
                    maxtime = int(time.time())
                maxtime -= 1 # not inclusive
            if '_time' not in result:
                raise Exception("Missing required _time field on data")
            if span == None and '_span' in result:
                span = result['_span']
            mytime = int(float(result['_time']))  
            spansago =  int((maxtime-mytime) / secsPerSpan)
            new_time = mytime + (spansago * secsPerSpan)

            if new_time not in time_data:
                time_data[new_time] = { '_time': new_time, '_span': span }
            this_row = time_data[new_time]

            spanstart = maxtime - ((spansago+1)*secsPerSpan) + 1
            series = seriesName(series_mode, scalar, spansago, unit, spanstart)
            if spansago == 0: latest = series
            acount = len(result)
            for k,v in result.items():
                if k not in ['_time', 'info_sid', 'info_max_time', 'info_min_time', 'info_search_time', 'info_sid', '_span']:
                    if k == 'count':
                        attr = series
                    else:
                        attr = '%s_%s' % (k, series)
                    this_row[attr] = result[k]
                    fields_seen[attr] = spansago

        field_order = fields_seen.items()
        field_order.sort(lambda x,y: cmp(x[1], y[1]))
        field_order = [f for f,v in field_order]
        field_order.insert(0,'_time')
        field_order.append('_span')

        results = time_data.values()
        results.sort(lambda x,y: cmp(x['_time'], y['_time']))

        si.outputResults(results, {}, fields=field_order)
    except Exception, e2:
        stack2 =  traceback.format_exc()
        si.generateErrorResults("Error '%s'. %s" % (e2, stack2))

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def main():
    # get config from config file
    config = ConfigParser.ConfigParser()
    
    if os.path.exists(os.path.join('..', 'local', 'slack.conf')):
        config.readfp(open(os.path.join('..', 'local', 'slack.conf')))
    else:
        config.readfp(open(os.path.join('..', 'default', 'slack.conf')))

    # username and icon can only be set by conf
    username = config.get('config', 'username')
    icon = config.get('config', 'icon')

    # update args if user speicify them in search
    channel = kwargs.get('channel', config.get('config', 'channel'))
    if not channel.startswith('#'): channel = '#' + channel
    if config.get('config', 'allow_user_set_slack_url').lower() in TRUE_VALUES:
        url = kwargs.get('url', config.get('config', 'url'))
    else:
        url = config.get('config', 'url')

    # no url specified, dont procceed.
    if not url:
        raise Exception("Not slack url specified!")

    # read search results
    results = sis.readResults(None, None, True)

    https_proxy = config.get('config', 'proxy')
    proxyDict = { 
                  "https" : https_proxy
                }

    # prepare data to be sent to slack
    data = {
        'text': get_pretty_table(results),
        'username': username,
        'channel': channel,
        'icon_url': icon,
        'mrkdwn': True,
    }

    if https_proxy != "":  
        # send data to slack.
        r = requests.post(url, data=json.dumps(data), proxies=proxyDict)
    else:
        r = requests.post(url, data=json.dumps(data))

    if r.status_code == 200:
        sis.outputResults(results)
    else:
        err_msg = ("Error sending results to slack, reason: {r}, {t}".format( 
                    r=r.reason, t=r.text))
        sis.generateErrorResults(err_msg)

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def getRanges(options):
    ranges = {}
    for name,startend in options.items():
        if name in ['field','default']:
            continue
        try:
            start,end = re.match("(-?\d+)-(-?\d+)", startend).groups()
            ranges[name] = (float(start),float(end))
        except:
            si.generateErrorResults("Invalid range: '%s'.  '<start_num>-<end_num>' expected." % startend)
            exit(0)
    return ranges

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def main():
    # get config from config file
    config = ConfigParser.ConfigParser()
    config.readfp(open(os.path.join('..', 'default', 'hipchat.conf')))

    # update args if user speicify them in search
    room    = kwargs.get('room', config.get('default', 'room'))
    color   = kwargs.get('color', config.get('default', 'color'))
    notify  = kwargs.get('notify', config.get('default', 'notify'))
    msg_fmt = kwargs.get('message_format', 
                         config.get('default', 'message_format'))

    if config.get('default', 'allow_users_set_base_url').lower() in TRUE_VALUES:
        base_url = kwargs.get('base_url', config.get('default', 'base_url'))
    else:
        base_url = config.get('default', 'base_url')

    # check if auth token is set properly
    try:
        auth_token = {"auth_token": config.get(room, 'auth_token')}
    except ConfigParser.NoSectionError as e:
        raise Exception("Room not set, please set the room stanza")
    except ConfigParser.NoOptionError as e:
        raise Exception("Auth token not set, please set auth token for room")

    # construct url
    url = base_url + "{s}{r}/notification".format(
        s='' if base_url.endswith('/') else '/', r=room)

    # read search results
    results = sis.readResults(None, None, True)

    # prepare data to be sent
    data = {
        'message': get_pretty_table(results, msg_fmt),
        'message_format': msg_fmt,
        'color': color,
        'notify': notify.lower() in TRUE_VALUES
    }

    # send data
    headers = {'Content-type': 'application/json'}
    r = requests.post(url, 
        data=json.dumps(data), 
        params=auth_token, 
        headers=headers)

    if r.status_code == 204:
        sis.outputResults(results)
    else:
        err_msg = ("Error sending results to slack, reason: {r}, {t}".format( 
                    r=r.reason, t=r.text))
        sis.generateErrorResults(err_msg)

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def main():
  try:    
    messages = {}

    keywords,options = si.getKeywordsAndOptions()
    DEFAULT_MAX_TYPES = 10
    maxtypes = options.get('max', str(DEFAULT_MAX_TYPES))

    error = None
    if not maxtypes.isdigit():
        error = 'max must be an integer between 1-%s.' % MAXRESULTS
    else:
        maxtypes = int(maxtypes)
        if not (0 < maxtypes <= MAXRESULTS):
            error = 'max must be an integer between 1-%s.' % MAXRESULTS
    if error:
      si.generateErrorResults(error)
      return

    ignore_covered = 'notcovered' in keywords
    useraw         = 'useraw' in keywords
      
    results,dummyresults,settings = si.getOrganizedResults()
    #for r in results:
    #  for attr in r:
    #     print attr, r[attr], len(r[attr])
    if len(results) > MAXRESULTS:
      results = results[:MAXRESULTS]
      si.addWarnMessage(messages, "For performance reasons, the maximum number of results used to discover event types was capped at %s. Consider a more restrictive search." % MAXRESULTS)

    argc = len(sys.argv)
    argv = sys.argv

    sessionKey  = settings.get("sessionKey", None)
    owner       = settings.get("owner", None)
    namespace   = settings.get("namespace", None)

    searchhead = ''
    try:
      searches = sutils.getCommands(settings.get("search", ''), None)
      firstcmd = searches[0][0][0]
      firstarg = searches[0][0][1].strip()
      if firstcmd == 'search' and firstarg != '*':
        searchhead = firstarg
    except Exception, e:
      pass
    
    results = discover(results, searchhead, maxtypes, ignore_covered, useraw)

    if len(results) == 0:
      si.addWarnMessage(messages, "Unable to isolate useful groups of events.")

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def getArgs():
        badcounts = False
        try:
            maxcount   = int(options.get('maxcount',  '20'))
            if maxcount <= 0: 
                badcounts = True
        except:
            badcounts = True
        if badcounts:
            si.generateErrorResults("Error: invalid required 'maxcount' (1-INF) setting.")
            exit()
   
        sizefield  = options.get('sizefield',  'totalCount')
        pathfield  = options.get('pathfield',  'source')
        if sizefield == None or pathfield == None:
            si.generateErrorResults("Error: both pathfield and sizefield must be specified.")
            exit()
            
        countfield = options.get('countfield', 'count')
        delimiter = options.get('sep', os.sep)
        return maxcount, sizefield, pathfield, countfield, delimiter

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
def usage():
    si.generateErrorResults(" 'timeunit' argument required, such as s (seconds), h (hours), d (days), w (weeks), or y (years). Optionally prefix with a number: 600s (10 minutes), 2w (2 weeks). Optionally add another argument to specify the time-range label: series=[short,exact,relative]")
    exit(-1)

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
        logger.error(examples)


        if len(keywords) == 0:
            msg = "A required fieldname is missing"
        elif examples == None:
            msg = "Value for 'examples' is required"
        else:
            try:
                maxtrainers = int(maxtrainers)
                if maxtrainers < 1 or maxtrainers > 1000:
                    raise Exception()
            except: msg = "Value for 'maxtrainers' must be an integer between 1-1000"
        if msg != None:
            si.generateErrorResults(msg)                
            exit(0)
        messages = {}
        
        results,dummyresults,settings = si.getOrganizedResults()
        values = []
        # for first N result used as training
        for result in results[:maxtrainers]:
            val = result.get(fromfield, None)
            if val != None:
                values.append(val)

        examples = [ex.strip() for ex in examples.split(",")]
        if badexamples == None:
            badexamples = []
        else:

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
    owner       = settings.get("owner", None)
    namespace   = settings.get("namespace", None)

    searchhead = ''
    try:
      searches = sutils.getCommands(settings.get("search", ''), None)
      firstcmd = searches[0][0][0]
      firstarg = searches[0][0][1].strip()
      if firstcmd == 'search' and firstarg != '*':
        searchhead = firstarg
    except Exception, e:
      pass
    
    results = discover(results, searchhead, maxtypes, ignore_covered, useraw)

    if len(results) == 0:
      si.addWarnMessage(messages, "Unable to isolate useful groups of events.")


  except:
    import traceback
    stack =  traceback.format_exc()
    results = si.generateErrorResults("Error : Traceback: " + str(stack))

  si.outputResults( results, messages )


if __name__ == '__main__':
  #profileMain()
  main()

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
    logger.error("gpath = %s" % gpath)
    # find all files matching
    complete_path = os.path.expanduser(
        os.path.expandvars(gpath))
    glob_matches = glob.glob(complete_path)
    logger.debug("complete path: %s" % complete_path)
    logger.debug("glob matches: %s" % glob_matches)

    if len(glob_matches)==0:
        logger.error("No file matching %s" % complete_path)
        raise Exception("No files matching %s." % complete_path)


    for pfile in glob_matches:
        logger.error("parsing file: %s" % pfile)
        results += parse_raw_pstack(pfile, thread_id, reverse, separator, fileorderindex)


    #return results
    return results

# noinspection PyUnreachableCode
if __name__ == '__main__':
    try:
        si.outputResults(raw_pstack(), messages, fields)
    except Exception, e:
        import traceback
        stack = traceback.format_exc()
        si.generateErrorResults("Following error occurred while parsing pstack: '%s'." % (e))
        logger.error("%s. %s" % (e, stack))

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
        # e.g., '/data/inputs/monitor'
        entity = keywords[0]
        logger.info("Entity: %s Args: %s" % (entity, args))

        results = []  # we don't care about incoming results
        try:
            entitys = en.getEntities(entity, sessionKey=sessionKey, owner=owner, namespace=namespace, count=-1)
            for name, entity in entitys.items():
                try:
                    myapp = entity["eai:acl"]["app"]
                    if namespace != None and myapp != namespace:
                        continue
                except:
                    continue  # if no eai:acl/app, filter out
                result = entityToResult(name, entity)
                results.append(result)
        except splunk.ResourceNotFound, e2:
            pass
        si.outputResults(results, messages)
    except Exception, e:
        import traceback

        stack = traceback.format_exc()
        logger.error(str(e) + ". Traceback: " + str(stack))
        si.generateErrorResults(str(e))


if __name__ == "__main__":
    execute()

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
        '白沙': {'loc': [109.3703, 19.211], 'fullName': '白沙黎族自治县'},
        '琼海': {'loc': [110.4208, 19.224], 'fullName': '琼海市'},
        '昌江': {'loc': [109.0407, 19.2137], 'fullName': '昌江黎族自治县'},
        '临高': {'loc': [109.6957, 19.8063], 'fullName': '临高县'},
        '陵水': {'loc': [109.9924, 18.5415], 'fullName': '陵水黎族自治县'},
        '屯昌': {'loc': [110.0377, 19.362], 'fullName': '屯昌县'},
        '定安': {'loc': [110.3384, 19.4698], 'fullName': '定安县'},
        '保亭': {'loc': [109.6284, 18.6108], 'fullName': '保亭黎族苗族自治县'},
        '五指': {'loc': [109.5282, 18.8299], 'fullName': '五指山市'}
        }

if __name__ == '__main__':
    try:
        keywords,options = si.getKeywordsAndOptions()
        if len(keywords) == 0:
            si.generateErrorResults('Requires city field.')
            exit(0)
        city = ' '.join(keywords)
        results,dummyresults,settings = si.getOrganizedResults()
        
        for result in results:
            try:
                myvalue = result.get(city, None)
                myvalue = myvalue[:6]
                if dataset[myvalue] != None:
                    result['city_lng'] = dataset[myvalue]['loc'][0]
                    result['city_lat'] = dataset[myvalue]['loc'][1]
                    result['fullcityname'] = dataset[myvalue]['fullName']
            except:
                pass
        si.outputResults(results)

# 需要导入模块: from splunk import Intersplunk [as 别名]
# 或者: from splunk.Intersplunk import generateErrorResults [as 别名]
    if not url:
        raise Exception("Not slack url specified!")

    # read search results
    results = sis.readResults(None, None, True)

    # prepare data to be sent to slack
    data = {
        'text': get_pretty_table(results),
        'username': username,
        'channel': channel,
        'icon_url': icon,
        'mrkdwn': True,
    }
    # send data to slack.
    r = requests.post(url, data=json.dumps(data))

    if r.status_code == 200:
        sis.outputResults(results)
    else:
        err_msg = ("Error sending results to slack, reason: {r}, {t}".format( 
                    r=r.reason, t=r.text))
        sis.generateErrorResults(err_msg)

try:
    main()
except Exception, e:
    import traceback
    stack =  traceback.format_exc()
    sis.generateErrorResults("Error '{e}'. {s}".format(e=e, s=stack))