Source

pyohio_talk / pysp / splunk_examples.py

Full commit
import sys
from splunk import search as splunk_search
from splunk import auth as splunk_auth


class SplunkExamples(object):

    def __init__(self):
        self._key = splunk_auth.getSessionKey('admin', 'changeme')

    def tail_syslog(self, number=10):
        """Tail the last 'n' events"""

        args = {'search': 'search sourcetype="syslog"',
                'max_count': '%d' % number,
                'latest_time': 'rt',
                'status_buckets': '300',
                'earliest_time': 'rt'}

        search_job = splunk_search.dispatch(**args)

        for index, event in enumerate(search_job.events):
            yield event

        search_job.cancel()

    def report_from_syslog(self):
        """Create basic report from syslog data"""
        pass

    def alert_from_syslog(self):
        """Create alert for nagios from syslog data"""
        pass