+ For further API reference and developer documentation, see the + Spring + Integration reference documentation. + That documentation contains more detailed, developer-targeted + descriptions, with conceptual overviews, definitions of terms, + workarounds, and working code examples. +
+ ++ If you are interested in commercial training, consultancy, and + support for Spring Integration, please visit + http://www.springsource.com +
+
+ * {@code
+ * {
+
+ T getTarget();
+
+ void close();
+
+ boolean isOpen();
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/ConnectionFactory.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/ConnectionFactory.java
new file mode 100644
index 0000000..d69ccdc
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/ConnectionFactory.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.core;
+
+/**
+ * Factory pattern to create Connection
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public interface ConnectionFactory {
+
+ Connection getConnection() throws Exception;
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataReader.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataReader.java
new file mode 100644
index 0000000..aef7b68
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataReader.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.core;
+
+import java.util.List;
+
+import org.springframework.integration.splunk.entity.SplunkData;
+
+/**
+ * Data reader to read Splunk data from the service.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ */
+public interface DataReader {
+
+ List search() throws Exception;
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataWriter.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataWriter.java
new file mode 100644
index 0000000..69154b5
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/DataWriter.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.core;
+
+import org.springframework.integration.splunk.entity.SplunkData;
+
+/**
+ * Data writer to write Splunk data into Splunk
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public interface DataWriter {
+
+ void write(SplunkData data) throws Exception;
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/package-info.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/package-info.java
new file mode 100644
index 0000000..158ac78
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/core/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Provides core classes of the Splunk module.
+ */
+package org.springframework.integration.splunk.core;
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java
new file mode 100644
index 0000000..782f806
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java
@@ -0,0 +1,2274 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.entity;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.Map;
+
+import org.apache.commons.lang.time.FastDateFormat;
+
+/**
+ * Splunk data entity
+ *
+ * @author Jarred Li
+ * @author Damien Dallimore damien@dtdsoftware.com
+ * @since 1.0
+ *
+ */
+public class SplunkData implements Serializable {
+
+ private static final long serialVersionUID = -7369254824093658523L;
+
+
+ private Map eventData;
+
+ /**
+ * Contents of the event message
+ */
+ private StringBuffer eventMessage;
+
+ /**
+ * Whether or not to put quotes around values
+ */
+ private boolean quoteValues = true;
+
+ /**
+ * Whether or not to add a date to the event string
+ */
+ private boolean useInternalDate = true;
+
+ /**
+ * default key value delimiter
+ */
+ private static final String KVDELIM = "=";
+ /**
+ * default pair delimiter
+ */
+ private static final String PAIRDELIM = " ";
+ /**
+ * default quote char
+ */
+ private static final char QUOTE = '"';
+ /**
+ * default date format is using internal generated date
+ */
+ private static final String DATEFORMATPATTERN = "yyyy-MM-dd HH:mm:ss:SSSZ";
+ /**
+ * Date Formatter instance
+ */
+ private static FastDateFormat DATEFORMATTER = FastDateFormat.getInstance(DATEFORMATPATTERN);
+
+ /**
+ * Event prefix fields
+ */
+ private static final String PREFIX_NAME = "name";
+ private static final String PREFIX_EVENT_ID = "event_id";
+
+ /**
+ * Java Throwable type fields
+ */
+ private static final String THROWABLE_CLASS = "throwable_class";
+ private static final String THROWABLE_MESSAGE = "throwable_message";
+ private static final String THROWABLE_STACKTRACE_ELEMENTS = "stacktrace_elements";
+
+ /**
+ * Splunk Common Information Model(CIM) Fields
+ */
+
+ // ------------------
+ // Account management
+ // ------------------
+
+ /**
+ * The domain containing the user that is affected by the account management
+ * event.
+ */
+ public static String AC_MANAGEMENT_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * Description of the account management change performed.
+ */
+ public static String AC_MANAGEMENT_SIGNATURE = "signature";
+ /**
+ * The NT source of the destination. In the case of an account management
+ * event, this is the domain that contains the user that generated the
+ * event.
+ */
+ public static String AC_MANAGEMENT_SRC_NT_DOMAIN = "src_nt_domain";
+
+ // ----------------------------------
+ // Authentication - Access protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource. success, failure
+ */
+ public static String AUTH_ACTION = "action";
+ /**
+ * The application involved in the event (such as ssh, spunk, win:local).
+ */
+ public static String AUTH_APP = "app";
+ /**
+ * The target involved in the authentication. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String AUTH_DEST = "dest";
+ /**
+ * The source involved in the authentication. In the case of endpoint
+ * protection authentication the src is the client. If your field is named
+ * src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src to
+ * make it CIM-compliant.. It is required for all events dealing with
+ * endpoint protection (Authentication, change analysis, malware, system
+ * center, and update). Note: Do not confuse this with the event source or
+ * sourcetype fields.
+ */
+ public static String AUTH_SRC = "src";
+ /**
+ * In privilege escalation events, src_user represents the user who
+ * initiated the privilege escalation.
+ */
+ public static String AUTH_SRC_USER = "src_user";
+ /**
+ * The name of the user involved in the event, or who initiated the event.
+ * For authentication privilege escalation events this should represent the
+ * user targeted by the escalation.
+ */
+ public static String AUTH_USER = "user";
+
+ // ----------------------------------
+ // Change analysis - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_ACTION = "action";
+ /**
+ * The type of change discovered in the change analysis event.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE = "change_type";
+ /**
+ * The host that was affected by the change. If your field is named
+ * dest_host,dest_ip,dest_ipv6, or dest_nt_host you can alias it as dest to
+ * make it CIM-compliant.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_DEST = "dest";
+ /**
+ * The hash signature of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_HASH = "hash";
+ /**
+ * The group ID of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_GID = "gid";
+ /**
+ * Indicates whether or not the modified resource is a directory.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_ISDR = "isdr";
+ /**
+ * The permissions mode of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_MODE = "mode";
+ /**
+ * The modification time of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_MODTIME = "modtime";
+ /**
+ * The file path of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_PATH = "path";
+ /**
+ * The size of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_SIZE = "size";
+ /**
+ * The user ID of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_UID = "uid";
+
+ // ----------------------------------
+ // Change analysis - Network protection
+ // ----------------------------------
+
+ /**
+ * The type of change observed.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_ACTION = "action";
+ /**
+ * The command that initiated the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_COMMAND = "command";
+ /**
+ * The device that is directly affected by the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_DVC = "dvc";
+ /**
+ * The user that initiated the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_USER = "user";
+
+ // ----------------------------------
+ // Common event fields
+ // ----------------------------------
+
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public static String COMMON_CATEGORY = "category";
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public static String COMMON_COUNT = "count";
+ /**
+ * The free-form description of a particular event.
+ */
+ public static String COMMON_DESC = "desc";
+ /**
+ * The name of a given DHCP pool on a DHCP server.
+ */
+ public static String COMMON_DHCP_POOL = "dhcp_pool";
+ /**
+ * The amount of time the event lasted.
+ */
+ public static String COMMON_DURATION = "duration";
+ /**
+ * The fully qualified domain name of the device transmitting or recording
+ * the log record.
+ */
+ public static String COMMON_DVC_HOST = "dvc_host";
+ /**
+ * The IPv4 address of the device reporting the event.
+ */
+ public static String COMMON_DVC_IP = "dvc_ip";
+ /**
+ * The IPv6 address of the device reporting the event.
+ */
+ public static String COMMON_DVC_IP6 = "dvc_ip6";
+ /**
+ * The free-form description of the device's physical location.
+ */
+ public static String COMMON_DVC_LOCATION = "dvc_location";
+ /**
+ * The MAC (layer 2) address of the device reporting the event.
+ */
+ public static String COMMON_DVC_MAC = "dvc_mac";
+ /**
+ * The Windows NT domain of the device recording or transmitting the event.
+ */
+ public static String COMMON_DVC_NT_DOMAIN = "dvc_nt_domain";
+ /**
+ * The Windows NT host name of the device recording or transmitting the
+ * event.
+ */
+ public static String COMMON_DVC_NT_HOST = "dvc_nt_host";
+ /**
+ * Time at which the device recorded the event.
+ */
+ public static String COMMON_DVC_TIME = "dvc_time";
+ /**
+ * The event's specified end time.
+ */
+ public static String COMMON_END_TIME = "end_time";
+ /**
+ * A unique identifier that identifies the event. This is unique to the
+ * reporting device.
+ */
+ public static String COMMON_EVENT_ID = "event_id";
+ /**
+ * The length of the datagram, event, message, or packet.
+ */
+ public static String COMMON_LENGTH = "length";
+ /**
+ * The log-level that was set on the device and recorded in the event.
+ */
+ public static String COMMON_LOG_LEVEL = "log_level";
+ /**
+ * The name of the event as reported by the device. The name should not
+ * contain information that's already being parsed into other fields from
+ * the event, such as IP addresses.
+ */
+ public static String COMMON_NAME = "name";
+ /**
+ * An integer assigned by the device operating system to the process
+ * creating the record.
+ */
+ public static String COMMON_PID = "pid";
+ /**
+ * An environment-specific assessment of the event's importance, based on
+ * elements such as event severity, business function of the affected
+ * system, or other locally defined variables.
+ */
+ public static String COMMON_PRIORITY = "priority";
+ /**
+ * The product that generated the event.
+ */
+ public static String COMMON_PRODUCT = "product";
+ /**
+ * The version of the product that generated the event.
+ */
+ public static String COMMON_PRODUCT_VERSION = "product_version";
+ /**
+ * The result root cause, such as connection refused, timeout, crash, and so
+ * on.
+ */
+ public static String COMMON_REASON = "reason";
+ /**
+ * The action result. Often is a binary choice: succeeded and failed,
+ * allowed and denied, and so on.
+ */
+ public static String COMMON_RESULT = "result";
+ /**
+ * The severity (or priority) of an event as reported by the originating
+ * device.
+ */
+ public static String COMMON_SEVERITY = "severity";
+ /**
+ * The event's specified start time.
+ */
+ public static String COMMON_START_TIME = "start_time";
+ /**
+ * The transaction identifier.
+ */
+ public static String COMMON_TRANSACTION_ID = "transaction_id";
+ /**
+ * A uniform record locator (a web address, in other words) included in a
+ * record.
+ */
+ public static String COMMON_URL = "url";
+ /**
+ * The vendor who made the product that generated the event.
+ */
+ public static String COMMON_VENDOR = "vendor";
+
+ // ----------------------------------
+ // DNS protocol
+ // ----------------------------------
+
+ /**
+ * The DNS domain that has been queried.
+ */
+ public static String DNS_DEST_DOMAIN = "dest_domain";
+ /**
+ * The remote DNS resource record being acted upon.
+ */
+ public static String DNS_DEST_RECORD = "dest_record";
+ /**
+ * The DNS zone that is being received by the slave as part of a zone
+ * transfer.
+ */
+ public static String DNS_DEST_ZONE = "dest_zone";
+ /**
+ * The DNS resource record class.
+ */
+ public static String DNS_RECORD_CLASS = "record_class";
+ /**
+ * The DNS resource record type.
+ *
+ * @see see
+ * this Wikipedia article on DNS record types
+ */
+ public static String DNS_RECORD_TYPE = "record_type";
+ /**
+ * The local DNS domain that is being queried.
+ */
+ public static String DNS_SRC_DOMAIN = "src_domain";
+ /**
+ * The local DNS resource record being acted upon.
+ */
+ public static String DNS_SRC_RECORD = "src_record";
+ /**
+ * The DNS zone that is being transferred by the master as part of a zone
+ * transfer.
+ */
+ public static String DNS_SRC_ZONE = "src_zone";
+
+ // ----------------------------------
+ // Email tracking
+ // ----------------------------------
+
+ /**
+ * The person to whom an email is sent.
+ */
+ public static String EMAIL_RECIPIENT = "recipient";
+ /**
+ * The person responsible for sending an email.
+ */
+ public static String EMAIL_SENDER = "sender";
+ /**
+ * The email subject line.
+ */
+ public static String EMAIL_SUBJECT = "subject";
+
+ // ----------------------------------
+ // File management
+ // ----------------------------------
+
+ /**
+ * The time the file (the object of the event) was accessed.
+ */
+ public static String FILE_ACCESS_TIME = "file_access_time";
+ /**
+ * The time the file (the object of the event) was created.
+ */
+ public static String FILE_CREATE_TIME = "file_create_time";
+ /**
+ * A cryptographic identifier assigned to the file object affected by the
+ * event.
+ */
+ public static String FILE_HASH = "file_hash";
+ /**
+ * The time the file (the object of the event) was altered.
+ */
+ public static String FILE_MODIFY_TIME = "file_modify_time";
+ /**
+ * The name of the file that is the object of the event (without location
+ * information related to local file or directory structure).
+ */
+ public static String FILE_NAME = "file_name";
+ /**
+ * The location of the file that is the object of the event, in terms of
+ * local file and directory structure.
+ */
+ public static String FILE_PATH = "file_path";
+ /**
+ * Access controls associated with the file affected by the event.
+ */
+ public static String FILE_PERMISSION = "file_permission";
+ /**
+ * The size of the file that is the object of the event. Indicate whether
+ * Bytes, KB, MB, GB.
+ */
+ public static String FILE_SIZE = "file_size";
+
+ // ----------------------------------
+ // Intrusion detection
+ // ----------------------------------
+
+ /**
+ * The category of the triggered signature.
+ */
+ public static String INTRUSION_DETECTION_CATEGORY = "category";
+ /**
+ * The destination of the attack detected by the intrusion detection system
+ * (IDS). If your field is named dest_host, dest_ip, dest_ipv6, or
+ * dest_nt_host you can alias it as dest to make it CIM-compliant.
+ */
+ public static String INTRUSION_DETECTION_DEST = "dest";
+ /**
+ * The device that detected the intrusion event.
+ */
+ public static String INTRUSION_DETECTION_DVC = "dvc";
+ /**
+ * The type of IDS that generated the event.
+ */
+ public static String INTRUSION_DETECTION_IDS_TYPE = "ids_type";
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String INTRUSION_DETECTION_PRODUCT = "product";
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public static String INTRUSION_DETECTION_SEVERITY = "severity";
+ /**
+ * The name of the intrusion detected on the client (the src), such as
+ * PlugAndPlay_BO and JavaScript_Obfuscation_Fre.
+ */
+ public static String INTRUSION_DETECTION_SIGNATURE = "signature";
+ /**
+ * The source involved in the attack detected by the IDS. If your field is
+ * named src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src
+ * to make it CIM-compliant.
+ */
+ public static String INTRUSION_DETECTION_SRC = "src";
+ /**
+ * The user involved with the intrusion detection event.
+ */
+ public static String INTRUSION_DETECTION_USER = "user";
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String INTRUSION_DETECTION_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Malware - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The outcome of the infection
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_ACTION = "action";
+ /**
+ * The NT domain of the destination (the dest_bestmatch).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * The cryptographic hash of the file associated with the malware event
+ * (such as the malicious or infected file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_HASH = "file_hash";
+ /**
+ * The name of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_NAME = "file_name";
+ /**
+ * The path of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_PATH = "file_path";
+ /**
+ * The product name of the vendor technology (the vendor field) that is
+ * generating malware data (such as Antivirus or EPO).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT = "product";
+ /**
+ * The product version number of the vendor technology installed on the
+ * client (such as 10.4.3 or 11.0.2).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION = "product_version";
+ /**
+ * The name of the malware infection detected on the client (the src), such
+ * as Trojan.Vundo,Spyware.Gaobot,W32.Nimbda).
+ *
+ * Note: This field is a string. Please use a signature_id field for
+ * signature ID fields that are integer data types.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE = "signature";
+ /**
+ * The current signature definition set running on the client, such as
+ * 11hsvx)
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION = "signature_version";
+ /**
+ * The target affected or infected by the malware. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST = "dest";
+ /**
+ * The NT domain of the source (the src).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN = "src_nt_domain";
+ /**
+ * The name of the user involved in the malware event.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_USER = "user";
+ /**
+ * The name of the vendor technology generating malware data, such as
+ * Symantec or McAfee.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Malware - Network protection
+ // ----------------------------------
+
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String MALWARE_NETWORK_PROTECTION_PRODUCT = "product";
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public static String MALWARE_NETWORK_PROTECTION_SEVERITY = "severity";
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String MALWARE_NETWORK_PROTECTION_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Network traffic - ESS
+ // ----------------------------------
+
+ /**
+ * The action of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_ACTION = "action";
+ /**
+ * The destination port of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_DEST_PORT = "dest_port";
+ /**
+ * The product name of the vendor technology generating NetworkProtection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String NETWORK_TRAFFIC_ESS_PRODUCT = "product";
+ /**
+ * The source port of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_SRC_PORT = "src_port";
+ /**
+ * The vendor technology used to generate NetworkProtection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String NETWORK_TRAFFIC_ESS_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Network traffic - Generic
+ // ----------------------------------
+
+ /**
+ * The ISO layer 7 (application layer) protocol, such as HTTP, HTTPS, SSH,
+ * and IMAP.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_APP_LAYER = "app_layer";
+ /**
+ * How many bytes this device/interface received.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_IN = "bytes_in";
+ /**
+ * How many bytes this device/interface transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_OUT = "bytes_out";
+ /**
+ * 802.11 channel number used by a wireless network.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_CHANNEL = "channel";
+ /**
+ * The Common Vulnerabilities and Exposures (CVE) reference value.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_CVE = "cve";
+ /**
+ * The destination application being targeted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_APP = "dest_app";
+ /**
+ * The destination command and control service channel.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL = "dest_cnc_channel";
+ /**
+ * The destination command and control service name.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME = "dest_cnc_name";
+ /**
+ * The destination command and control service port.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT = "dest_cnc_port";
+ /**
+ * The country associated with a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY = "dest_country";
+ /**
+ * The fully qualified host name of a packet's recipient. For HTTP sessions,
+ * this is the host header.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_HOST = "dest_host";
+ /**
+ * The interface that is listening remotely or receiving packets locally.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_INT = "dest_int";
+ /**
+ * The IPv4 address of a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IP = "dest_ip";
+ /**
+ * The IPv6 address of a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IPV6 = "dest_ipv6";
+ /**
+ * The (physical) latitude of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LAT = "dest_lat";
+ /**
+ * The (physical) longitude of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LONG = "dest_long";
+ /**
+ * The destination TCP/IP layer 2 Media Access Control (MAC) address of a
+ * packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_MAC = "dest_mac";
+ /**
+ * The Windows NT domain containing a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * The Windows NT host name of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST = "dest_nt_host";
+ /**
+ * TCP/IP port to which a packet is being sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_PORT = "dest_port";
+ /**
+ * The NATed IPv4 address to which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP = "dest_translated_ip";
+ /**
+ * The NATed port to which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT = "dest_translated_port";
+ /**
+ * The numbered Internet Protocol version.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_IP_VERSION = "ip_version";
+ /**
+ * The network interface through which a packet was transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE = "outbound_interface";
+ /**
+ * How many packets this device/interface received.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_IN = "packets_in";
+ /**
+ * How many packets this device/interface transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_OUT = "packets_out";
+ /**
+ * The OSI layer 3 (Network Layer) protocol, such as IPv4/IPv6, ICMP, IPsec,
+ * IGMP or RIP.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PROTO = "proto";
+ /**
+ * The session identifier. Multiple transactions build a session.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SESSION_ID = "session_id";
+ /**
+ * The 802.11 service set identifier (ssid) assigned to a wireless session.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SSID = "ssid";
+ /**
+ * The country from which the packet was sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY = "src_country";
+ /**
+ * The fully qualified host name of the system that transmitted the packet.
+ * For Web logs, this is the HTTP client.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_HOST = "src_host";
+ /**
+ * The interface that is listening locally or sending packets remotely.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_INT = "src_int";
+ /**
+ * The IPv4 address of the packet's source. For Web logs, this is the http
+ * client.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IP = "src_ip";
+ /**
+ * The IPv6 address of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IPV6 = "src_ipv6";
+ /**
+ * The (physical) latitude of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LAT = "src_lat";
+ /**
+ * The (physical) longitude of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LONG = "src_long";
+ /**
+ * The Media Access Control (MAC) address from which a packet was
+ * transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_MAC = "src_mac";
+ /**
+ * The Windows NT domain containing the machines that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN = "src_nt_domain";
+ /**
+ * The Windows NT hostname of the system that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST = "src_nt_host";
+ /**
+ * The network port from which a packet originated.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_PORT = "src_port";
+ /**
+ * The NATed IPv4 address from which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP = "src_translated_ip";
+ /**
+ * The NATed network port from which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT = "src_translated_port";
+ /**
+ * The application, process, or OS subsystem that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_ID = "syslog_id";
+ /**
+ * The criticality of an event, as recorded by UNIX syslog.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY = "syslog_priority";
+ /**
+ * The TCP flag(s) specified in the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TCP_FLAG = "tcp_flag";
+ /**
+ * The hex bit that specifies TCP 'type of service'
+ *
+ * @see Type of
+ * Service
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TOS = "tos";
+ /**
+ * The transport protocol.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TRANSPORT = "transport";
+ /**
+ * The "time to live" of a packet or datagram.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TTL = "ttl";
+ /**
+ * The numeric identifier assigned to the virtual local area network (VLAN)
+ * specified in the record.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_ID = "vlan_id";
+ /**
+ * The name assigned to the virtual local area network (VLAN) specified in
+ * the record.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_NAME = "vlan_name";
+
+ // ----------------------------------
+ // Packet filtering
+ // ----------------------------------
+
+ /**
+ * The action the filtering device (the dvc_bestmatch field) performed on
+ * the communication.
+ */
+ public static String PACKET_FILTERING_ACTION = "action";
+ /**
+ * The IP port of the packet's destination, such as 22.
+ */
+ public static String PACKET_FILTERING_DEST_PORT = "dest_port";
+ /**
+ * The direction the packet is traveling.
+ */
+ public static String PACKET_FILTERING_DIRECTION = "direction";
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public static String PACKET_FILTERING_DVC = "dvc";
+ /**
+ * The rule which took action on the packet, such as 143.
+ */
+ public static String PACKET_FILTERING_RULE = "rule";
+ /**
+ * The IP port of the packet's source, such as 34541.
+ */
+ public static String PACKET_FILTERING_SVC_PORT = "svc_port";
+
+ // ----------------------------------
+ // Proxy
+ // ----------------------------------
+
+ /**
+ * The action taken by the proxy.
+ */
+ public static String PROXY_ACTION = "action";
+ /**
+ * The destination of the network traffic (the remote host).
+ */
+ public static String PROXY_DEST = "dest";
+ /**
+ * The content-type of the requested HTTP resource.
+ */
+ public static String PROXY_HTTP_CONTENT_TYPE = "http_content_type";
+ /**
+ * The HTTP method used to request the resource.
+ */
+ public static String PROXY_HTTP_METHOD = "http_method";
+ /**
+ * The HTTP referrer used to request the HTTP resource.
+ */
+ public static String PROXY_HTTP_REFER = "http_refer";
+ /**
+ * The HTTP response code.
+ */
+ public static String PROXY_HTTP_RESPONSE = "http_response";
+ /**
+ * The user agent used to request the HTTP resource.
+ */
+ public static String PROXY_HTTP_USER_AGENT = "http_user_agent";
+ /**
+ * The product name of the vendor technology generating Network Protection
+ * data, such as IDP, Providentia, and ASA.
+ */
+ public static String PROXY_PRODUCT = "product";
+ /**
+ * The source of the network traffic (the client requesting the connection).
+ */
+ public static String PROXY_SRC = "src";
+ /**
+ * The HTTP response code indicating the status of the proxy request.
+ */
+ public static String PROXY_STATUS = "status";
+ /**
+ * The user that requested the HTTP resource.
+ */
+ public static String PROXY_USER = "user";
+ /**
+ * The URL of the requested HTTP resource.
+ */
+ public static String PROXY_URL = "url";
+ /**
+ * The vendor technology generating Network Protection data, such as IDP,
+ * Providentia, and ASA.
+ */
+ public static String PROXY_VENDOR = "vendor";
+
+ // ----------------------------------
+ // System center
+ // ----------------------------------
+
+ /**
+ * The running application or service on the system (the src field), such as
+ * explorer.exe or sshd.
+ */
+ public static String SYSTEM_CENTER_APP = "app";
+ /**
+ * The amount of disk space available per drive or mount (the mount field)
+ * on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_FREEMBYTES = "FreeMBytes";
+ /**
+ * The version of operating system installed on the host (the src field),
+ * such as 6.0.1.4 or 2.6.27.30-170.2.82.fc10.x86_64.
+ */
+ public static String SYSTEM_CENTER_KERNEL_RELEASE = "kernel_release";
+ /**
+ * Human-readable version of the SystemUptime value.
+ */
+ public static String SYSTEM_CENTER_LABEL = "label";
+ /**
+ * The drive or mount reporting available disk space (the FreeMBytes field)
+ * on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_MOUNT = "mount";
+ /**
+ * The name of the operating system installed on the host (the src), such as
+ * Microsoft Windows Server 2003 or GNU/Linux).
+ */
+ public static String SYSTEM_CENTER_OS = "os";
+ /**
+ * The percentage of processor utilization.
+ */
+ public static String SYSTEM_CENTER_PERCENTPROCESSORTIME = "PercentProcessorTime";
+ /**
+ * The setlocaldefs setting from the SE Linux configuration.
+ */
+ public static String SYSTEM_CENTER_SETLOCALDEFS = "setlocaldefs";
+ /**
+ * Values from the SE Linux configuration file.
+ */
+ public static String SYSTEM_CENTER_SELINUX = "selinux";
+ /**
+ * The SE Linux type (such as targeted).
+ */
+ public static String SYSTEM_CENTER_SELINUXTYPE = "selinuxtype";
+ /**
+ * The shell provided to the User Account (the user field) upon logging into
+ * the system (the src field).
+ */
+ public static String SYSTEM_CENTER_SHELL = "shell";
+ /**
+ * The TCP/UDP source port on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_SRC_PORT = "src_port";
+ /**
+ * The sshd protocol version.
+ */
+ public static String SYSTEM_CENTER_SSHD_PROTOCOL = "sshd_protocol";
+ /**
+ * The start mode of the given service.
+ */
+ public static String SYSTEM_CENTER_STARTMODE = "Startmode";
+ /**
+ * The number of seconds since the system (the src) has been "up."
+ */
+ public static String SYSTEM_CENTER_SYSTEMUPTIME = "SystemUptime";
+ /**
+ * The total amount of available memory on the system (the src).
+ */
+ public static String SYSTEM_CENTER_TOTALMBYTES = "TotalMBytes";
+ /**
+ * The amount of used memory on the system (the src).
+ */
+ public static String SYSTEM_CENTER_USEDMBYTES = "UsedMBytes";
+ /**
+ * The User Account present on the system (the src).
+ */
+ public static String SYSTEM_CENTER_USER = "user";
+ /**
+ * The number of updates the system (the src) is missing.
+ */
+ public static String SYSTEM_CENTER_UPDATES = "updates";
+
+ // ----------------------------------
+ // Traffic
+ // ----------------------------------
+
+ /**
+ * The destination of the network traffic. If your field is named dest_host,
+ * dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest to make it
+ * CIM-compliant.
+ */
+ public static String TRAFFIC_DEST = "dest";
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public static String TRAFFIC_DVC = "dvc";
+ /**
+ * The source of the network traffic. If your field is named src_host,
+ * src_ip, src_ipv6, or src_nt_host you can alias it as src to make it
+ * CIM-compliant.
+ */
+ public static String TRAFFIC_SRC = "src";
+
+ // ----------------------------------
+ // Update
+ // ----------------------------------
+
+ /**
+ * The name of the installed update.
+ */
+ public static String UPDATE_PACKAGE = "package";
+
+ // ----------------------------------
+ // User information updates
+ // ----------------------------------
+
+ /**
+ * A user that has been affected by a change. For example, user fflanda
+ * changed the name of user rhallen, so affected_user=rhallen.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER = "affected_user";
+ /**
+ * The user group affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP = "affected_user_group";
+ /**
+ * The identifier of the user group affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID = "affected_user_group_id";
+ /**
+ * The identifier of the user affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_ID = "affected_user_id";
+ /**
+ * The security context associated with the user affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE = "affected_user_privilege";
+ /**
+ * The name of the user affected by the recorded event.
+ */
+ public static String USER_INFO_UPDATES_USER = "user";
+ /**
+ * A user group that is the object of an event, expressed in human-readable
+ * terms.
+ */
+ public static String USER_INFO_UPDATES_USER_GROUP = "user_group";
+ /**
+ * The numeric identifier assigned to the user group event object.
+ */
+ public static String USER_INFO_UPDATES_USER_GROUP_ID = "user_group_id";
+ /**
+ * The system-assigned identifier for the user affected by an event.
+ */
+ public static String USER_INFO_UPDATES_USER_ID = "user_id";
+ /**
+ * The security context associated with the object of an event (the affected
+ * user).
+ */
+ public static String USER_INFO_UPDATES_USER_PRIVILEGE = "user_privilege";
+ /**
+ * The name of the user that is the subject of an event--the user executing
+ * the action, in other words.
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT = "user_subject";
+ /**
+ * The ID number of the user that is the subject of an event.
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT_ID = "user_subject_id";
+ /**
+ * The security context associated with the subject of an event (the user
+ * causing a change).
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE = "user_subject_privilege";
+
+ // ----------------------------------
+ // Vulnerability
+ // ----------------------------------
+
+ /**
+ * The category of the discovered vulnerability.
+ */
+ public static String VULNERABILITY_CATEGORY = "category";
+ /**
+ * The host with the discovered vulnerability. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String VULNERABILITY_DEST = "dest";
+ /**
+ * The operating system of the host containing the vulnerability detected on
+ * the client (the src field), such as SuSE Security Update, or cups
+ * security update.
+ */
+ public static String VULNERABILITY_OS = "os";
+ /**
+ * The severity of the discovered vulnerability.
+ */
+ public static String VULNERABILITY_SEVERITY = "severity";
+ /**
+ * The name of the vulnerability detected on the client (the src field),
+ * such as SuSE Security Update, or cups security update.
+ */
+ public static String VULNERABILITY_SIGNATURE = "signature";
+
+ // ----------------------------------
+ // Windows administration
+ // ----------------------------------
+
+ /**
+ * The object name (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_NAME = "object_name";
+ /**
+ * The object type (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_TYPE = "object_type";
+ /**
+ * The object handle (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_HANDLE = "object_handle";
+
+
+ public SplunkData(Map data) {
+ this.eventMessage = new StringBuffer();
+ this.eventData = data;
+ for (String key : data.keySet()) {
+ this.addPair(key, data.get(key));
+ }
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param eventName
+ * the event name
+ * @param eventID
+ * the event id
+ * @param useInternalDate
+ * Whether or not to add a date to the event string
+ * @param quoteValues
+ * Whether or not to put quotes around values
+ */
+ public SplunkData(String eventName, String eventID, boolean useInternalDate, boolean quoteValues) {
+
+ this.eventMessage = new StringBuffer();
+ this.quoteValues = quoteValues;
+ this.useInternalDate = useInternalDate;
+
+ addPair(PREFIX_NAME, eventName);
+ addPair(PREFIX_EVENT_ID, eventID);
+ }
+
+ /**
+ * Constructor.Will add internally generated date and put quotes around
+ * values.
+ *
+ * @param eventName
+ * the event name
+ * @param eventID
+ * the event ID
+ */
+ public SplunkData(String eventName, String eventID) {
+
+ this(eventName, eventID, true, true);
+ }
+
+ /**
+ * Default constructor
+ */
+ public SplunkData() {
+ this.eventMessage = new StringBuffer();
+ }
+
+ /**
+ * Simple shallow cloning method
+ */
+ public SplunkData clone() {
+ SplunkData clone = new SplunkData();
+ clone.quoteValues = this.quoteValues;
+ clone.useInternalDate = this.useInternalDate;
+ clone.eventMessage.append(this.eventMessage);
+
+ return clone;
+ }
+
+
+ public Map getEventData() {
+ return eventData;
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, char value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, boolean value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, double value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, long value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, int value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, Object value) {
+ addPair(key, value.toString());
+ }
+
+ /**
+ * Utility method for formatting Throwable,Error,Exception objects in a more
+ * linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ */
+ public void addThrowable(Throwable throwable) {
+
+ addThrowableObject(throwable, -1);
+ }
+
+ /**
+ * Utility method for formatting Throwable,Error,Exception objects in a more
+ * linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ * @param stackTraceDepth
+ * maximum number of stacktrace elements to log
+ */
+ public void addThrowable(Throwable throwable, int stackTraceDepth) {
+
+ addThrowableObject(throwable, stackTraceDepth);
+ }
+
+ /**
+ * Internal private method for formatting Throwable,Error,Exception objects
+ * in a more linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ * @param stackTraceDepth
+ * maximum number of stacktrace elements to log, -1 for all
+ */
+
+ private void addThrowableObject(Throwable throwable, int stackTraceDepth) {
+
+ addPair(THROWABLE_CLASS, throwable.getClass().getCanonicalName());
+ addPair(THROWABLE_MESSAGE, throwable.getMessage());
+ StackTraceElement[] elements = throwable.getStackTrace();
+ StringBuffer sb = new StringBuffer();
+ int depth = 0;
+ for (StackTraceElement element : elements) {
+ depth++;
+ if (stackTraceDepth == -1 || stackTraceDepth >= depth)
+ sb.append(element.toString()).append(",");
+ else
+ break;
+
+ }
+ addPair(THROWABLE_STACKTRACE_ELEMENTS, sb.toString());
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, String value) {
+
+ if (quoteValues)
+ this.eventMessage.append(key).append(KVDELIM).append(QUOTE).append(value).append(QUOTE).append(PAIRDELIM);
+ else
+ this.eventMessage.append(key).append(KVDELIM).append(value).append(PAIRDELIM);
+
+ }
+
+ @Override
+ /**
+ * return the completed event message
+ */
+ public String toString() {
+
+ String event = "";
+
+ if (useInternalDate) {
+ StringBuffer clonedMessage = new StringBuffer();
+ clonedMessage.append(DATEFORMATTER.format(new Date())).append(PAIRDELIM).append(this.eventMessage);
+ event = clonedMessage.toString();
+ }
+ else
+ event = eventMessage.toString();
+ // trim off trailing pair delim char(s)
+ return event.substring(0, event.length() - PAIRDELIM.length());
+ }
+
+ public void setAcManagementDestNtDomain(String acManagementDestNtDomain) {
+ addPair(AC_MANAGEMENT_DEST_NT_DOMAIN, acManagementDestNtDomain);
+ }
+
+ public void setAcManagementSignature(String acManagementSignature) {
+ addPair(AC_MANAGEMENT_SIGNATURE, acManagementSignature);
+ }
+
+ public void setAcManagementSrcNtDomain(String acManagementSrcNtDomain) {
+ addPair(AC_MANAGEMENT_SRC_NT_DOMAIN, acManagementSrcNtDomain);
+ }
+
+ public void setAuthAction(String authAction) {
+ addPair(AUTH_ACTION, authAction);
+ }
+
+ public void setAuthApp(String authApp) {
+ addPair(AUTH_APP, authApp);
+ }
+
+ public void setAuthDest(String authDest) {
+ addPair(AUTH_DEST, authDest);
+ }
+
+ public void setAuthSrc(String authSrc) {
+ addPair(AUTH_SRC, authSrc);
+ }
+
+ public void setAuthSrcUser(String authSrcUser) {
+ addPair(AUTH_SRC_USER, authSrcUser);
+ }
+
+ public void setAuthUser(String authUser) {
+ addPair(AUTH_USER, authUser);
+ }
+
+ public void setChangeEndpointProtectionAction(String changeEndpointProtectionAction) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_ACTION, changeEndpointProtectionAction);
+ }
+
+ public void setChangeEndpointProtectionChangeType(String changeEndpointProtectionChangeType) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE, changeEndpointProtectionChangeType);
+ }
+
+ public void setChangeEndpointProtectionDest(String changeEndpointProtectionDest) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_DEST, changeEndpointProtectionDest);
+ }
+
+ public void setChangeEndpointProtectionHash(String changeEndpointProtectionHash) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_HASH, changeEndpointProtectionHash);
+ }
+
+ public void setChangeEndpointProtectionGid(long changeEndpointProtectionGid) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_GID, changeEndpointProtectionGid);
+ }
+
+ public void setChangeEndpointProtectionIsdr(boolean changeEndpointProtectionIsdr) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_ISDR, changeEndpointProtectionIsdr);
+ }
+
+ public void setChangeEndpointProtectionMode(long changeEndpointProtectionMode) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_MODE, changeEndpointProtectionMode);
+ }
+
+ public void setChangeEndpointProtectionModtime(String changeEndpointProtectionModtime) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_MODTIME, changeEndpointProtectionModtime);
+ }
+
+ public void setChangeEndpointProtectionPath(String changeEndpointProtectionPath) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_PATH, changeEndpointProtectionPath);
+ }
+
+ public void setChangeEndpointProtectionSize(long changeEndpointProtectionSize) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_SIZE, changeEndpointProtectionSize);
+ }
+
+ public void setChangeEndpointProtectionUid(long changeEndpointProtectionUid) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_UID, changeEndpointProtectionUid);
+ }
+
+ public void setChangeNetworkProtectionAction(String changeNetworkProtectionAction) {
+ addPair(CHANGE_NETWORK_PROTECTION_ACTION, changeNetworkProtectionAction);
+ }
+
+ public void setChangeNetworkProtectionCommand(String changeNetworkProtectionCommand) {
+ addPair(CHANGE_NETWORK_PROTECTION_COMMAND, changeNetworkProtectionCommand);
+ }
+
+ public void setChangeNetworkProtectionDvc(String changeNetworkProtectionDvc) {
+ addPair(CHANGE_NETWORK_PROTECTION_DVC, changeNetworkProtectionDvc);
+ }
+
+ public void setChangeNetworkProtectionUser(String changeNetworkProtectionUser) {
+ addPair(CHANGE_NETWORK_PROTECTION_USER, changeNetworkProtectionUser);
+ }
+
+ public void setCommonCategory(String commonCategory) {
+ addPair(COMMON_CATEGORY, commonCategory);
+ }
+
+ public void setCommonCount(String commonCount) {
+ addPair(COMMON_COUNT, commonCount);
+ }
+
+ public void setCommonDesc(String commonDesc) {
+ addPair(COMMON_DESC, commonDesc);
+ }
+
+ public void setCommonDhcpPool(String commonDhcpPool) {
+ addPair(COMMON_DHCP_POOL, commonDhcpPool);
+ }
+
+ public void setCommonDuration(long commonDuration) {
+ addPair(COMMON_DURATION, commonDuration);
+ }
+
+ public void setCommonDvcHost(String commonDvcHost) {
+ addPair(COMMON_DVC_HOST, commonDvcHost);
+ }
+
+ public void setCommonDvcIp(String commonDvcIp) {
+ addPair(COMMON_DVC_IP, commonDvcIp);
+ }
+
+ public void setCommonDvcIp6(String commonDvcIp6) {
+ addPair(COMMON_DVC_IP6, commonDvcIp6);
+ }
+
+ public void setCommonDvcLocation(String commonDvcLocation) {
+ addPair(COMMON_DVC_LOCATION, commonDvcLocation);
+ }
+
+ public void setCommonDvcMac(String commonDvcMac) {
+ addPair(COMMON_DVC_MAC, commonDvcMac);
+ }
+
+ public void setCommonDvcNtDomain(String commonDvcNtDomain) {
+ addPair(COMMON_DVC_NT_DOMAIN, commonDvcNtDomain);
+ }
+
+ public void setCommonDvcNtHost(String commonDvcNtHost) {
+ addPair(COMMON_DVC_NT_HOST, commonDvcNtHost);
+ }
+
+ public void setCommonDvcTime(long commonDvcTime) {
+ addPair(COMMON_DVC_TIME, commonDvcTime);
+ }
+
+ public void setCommonEndTime(long commonEndTime) {
+ addPair(COMMON_END_TIME, commonEndTime);
+ }
+
+ public void setCommonEventId(long commonEventId) {
+ addPair(COMMON_EVENT_ID, commonEventId);
+ }
+
+ public void setCommonLength(long commonLength) {
+ addPair(COMMON_LENGTH, commonLength);
+ }
+
+ public void setCommonLogLevel(String commonLogLevel) {
+ addPair(COMMON_LOG_LEVEL, commonLogLevel);
+ }
+
+ public void setCommonName(String commonName) {
+ addPair(COMMON_NAME, commonName);
+ }
+
+ public void setCommonPid(long commonPid) {
+ addPair(COMMON_PID, commonPid);
+ }
+
+ public void setCommonPriority(long commonPriority) {
+ addPair(COMMON_PRIORITY, commonPriority);
+ }
+
+ public void setCommonProduct(String commonProduct) {
+ addPair(COMMON_PRODUCT, commonProduct);
+ }
+
+ public void setCommonProductVersion(long commonProductVersion) {
+ addPair(COMMON_PRODUCT_VERSION, commonProductVersion);
+ }
+
+ public void setCommonReason(String commonReason) {
+ addPair(COMMON_REASON, commonReason);
+ }
+
+ public void setCommonResult(String commonResult) {
+ addPair(COMMON_RESULT, commonResult);
+ }
+
+ public void setCommonSeverity(String commonSeverity) {
+ addPair(COMMON_SEVERITY, commonSeverity);
+ }
+
+ public void setCommonStartTime(long commonStartTime) {
+ addPair(COMMON_START_TIME, commonStartTime);
+ }
+
+ public void setCommonTransactionId(String commonTransactionId) {
+ addPair(COMMON_TRANSACTION_ID, commonTransactionId);
+ }
+
+ public void setCommonUrl(String commonUrl) {
+ addPair(COMMON_URL, commonUrl);
+ }
+
+ public void setCommonVendor(String commonVendor) {
+ addPair(COMMON_VENDOR, commonVendor);
+ }
+
+ public void setDnsDestDomain(String dnsDestDomain) {
+ addPair(DNS_DEST_DOMAIN, dnsDestDomain);
+ }
+
+ public void setDnsDestRecord(String dnsDestRecord) {
+ addPair(DNS_DEST_RECORD, dnsDestRecord);
+ }
+
+ public void setDnsDestZone(String dnsDestZone) {
+ addPair(DNS_DEST_ZONE, dnsDestZone);
+ }
+
+ public void setDnsRecordClass(String dnsRecordClass) {
+ addPair(DNS_RECORD_CLASS, dnsRecordClass);
+ }
+
+ public void setDnsRecordType(String dnsRecordType) {
+ addPair(DNS_RECORD_TYPE, dnsRecordType);
+ }
+
+ public void setDnsSrcDomain(String dnsSrcDomain) {
+ addPair(DNS_SRC_DOMAIN, dnsSrcDomain);
+ }
+
+ public void setDnsSrcRecord(String dnsSrcRecord) {
+ addPair(DNS_SRC_RECORD, dnsSrcRecord);
+ }
+
+ public void setDnsSrcZone(String dnsSrcZone) {
+ addPair(DNS_SRC_ZONE, dnsSrcZone);
+ }
+
+ public void setEmailRecipient(String emailRecipient) {
+ addPair(EMAIL_RECIPIENT, emailRecipient);
+ }
+
+ public void setEmailSender(String emailSender) {
+ addPair(EMAIL_SENDER, emailSender);
+ }
+
+ public void setEmailSubject(String emailSubject) {
+ addPair(EMAIL_SUBJECT, emailSubject);
+ }
+
+ public void setFileAccessTime(long fileAccessTime) {
+ addPair(FILE_ACCESS_TIME, fileAccessTime);
+ }
+
+ public void setFileCreateTime(long fileCreateTime) {
+ addPair(FILE_CREATE_TIME, fileCreateTime);
+ }
+
+ public void setFileHash(String fileHash) {
+ addPair(FILE_HASH, fileHash);
+ }
+
+ public void setFileModifyTime(long fileModifyTime) {
+ addPair(FILE_MODIFY_TIME, fileModifyTime);
+ }
+
+ public void setFileName(String fileName) {
+ addPair(FILE_NAME, fileName);
+ }
+
+ public void setFilePath(String filePath) {
+ addPair(FILE_PATH, filePath);
+ }
+
+ public void setFilePermission(String filePermission) {
+ addPair(FILE_PERMISSION, filePermission);
+ }
+
+ public void setFileSize(long fileSize) {
+ addPair(FILE_SIZE, fileSize);
+ }
+
+ public void setIntrusionDetectionCategory(String intrusionDetectionCategory) {
+ addPair(INTRUSION_DETECTION_CATEGORY, intrusionDetectionCategory);
+ }
+
+ public void setIntrusionDetectionDest(String intrusionDetectionDest) {
+ addPair(INTRUSION_DETECTION_DEST, intrusionDetectionDest);
+ }
+
+ public void setIntrusionDetectionDvc(String intrusionDetectionDvc) {
+ addPair(INTRUSION_DETECTION_DVC, intrusionDetectionDvc);
+ }
+
+ public void setIntrusionDetectionIdsType(String intrusionDetectionIdsType) {
+ addPair(INTRUSION_DETECTION_IDS_TYPE, intrusionDetectionIdsType);
+ }
+
+ public void setIntrusionDetectionProduct(String intrusionDetectionProduct) {
+ addPair(INTRUSION_DETECTION_PRODUCT, intrusionDetectionProduct);
+ }
+
+ public void setIntrusionDetectionSeverity(String intrusionDetectionSeverity) {
+ addPair(INTRUSION_DETECTION_SEVERITY, intrusionDetectionSeverity);
+ }
+
+ public void setIntrusionDetectionSignature(String intrusionDetectionSignature) {
+ addPair(INTRUSION_DETECTION_SIGNATURE, intrusionDetectionSignature);
+ }
+
+ public void setIntrusionDetectionSrc(String intrusionDetectionSrc) {
+ addPair(INTRUSION_DETECTION_SRC, intrusionDetectionSrc);
+ }
+
+ public void setIntrusionDetectionUser(String intrusionDetectionUser) {
+ addPair(INTRUSION_DETECTION_USER, intrusionDetectionUser);
+ }
+
+ public void setIntrusionDetectionVendor(String intrusionDetectionVendor) {
+ addPair(INTRUSION_DETECTION_VENDOR, intrusionDetectionVendor);
+ }
+
+ public void setMalwareEndpointProtectionAction(String malwareEndpointProtectionAction) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_ACTION, malwareEndpointProtectionAction);
+ }
+
+ public void setMalwareEndpointProtectionDestNtDomain(String malwareEndpointProtectionDestNtDomain) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN, malwareEndpointProtectionDestNtDomain);
+ }
+
+ public void setMalwareEndpointProtectionFileHash(String malwareEndpointProtectionFileHash) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_HASH, malwareEndpointProtectionFileHash);
+ }
+
+ public void setMalwareEndpointProtectionFileName(String malwareEndpointProtectionFileName) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_NAME, malwareEndpointProtectionFileName);
+ }
+
+ public void setMalwareEndpointProtectionFilePath(String malwareEndpointProtectionFilePath) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_PATH, malwareEndpointProtectionFilePath);
+ }
+
+ public void setMalwareEndpointProtectionProduct(String malwareEndpointProtectionProduct) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT, malwareEndpointProtectionProduct);
+ }
+
+ public void setMalwareEndpointProtectionProductVersion(String malwareEndpointProtectionProductVersion) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION, malwareEndpointProtectionProductVersion);
+ }
+
+ public void setMalwareEndpointProtectionSignature(String malwareEndpointProtectionSignature) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE, malwareEndpointProtectionSignature);
+ }
+
+ public void setMalwareEndpointProtectionSignatureVersion(String malwareEndpointProtectionSignatureVersion) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION, malwareEndpointProtectionSignatureVersion);
+ }
+
+ public void setMalwareEndpointProtectionDest(String malwareEndpointProtectionDest) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_DEST, malwareEndpointProtectionDest);
+ }
+
+ public void setMalwareEndpointProtectionSrcNtDomain(String malwareEndpointProtectionSrcNtDomain) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN, malwareEndpointProtectionSrcNtDomain);
+ }
+
+ public void setMalwareEndpointProtectionUser(String malwareEndpointProtectionUser) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_USER, malwareEndpointProtectionUser);
+ }
+
+ public void setMalwareEndpointProtectionVendor(String malwareEndpointProtectionVendor) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_VENDOR, malwareEndpointProtectionVendor);
+ }
+
+ public void setMalwareNetworkProtectionProduct(String malwareNetworkProtectionProduct) {
+ addPair(MALWARE_NETWORK_PROTECTION_PRODUCT, malwareNetworkProtectionProduct);
+ }
+
+ public void setMalwareNetworkProtectionSeverity(String malwareNetworkProtectionSeverity) {
+ addPair(MALWARE_NETWORK_PROTECTION_SEVERITY, malwareNetworkProtectionSeverity);
+ }
+
+ public void setMalwareNetworkProtectionVendor(String malwareNetworkProtectionVendor) {
+ addPair(MALWARE_NETWORK_PROTECTION_VENDOR, malwareNetworkProtectionVendor);
+ }
+
+ public void setNetworkTrafficEssAction(String networkTrafficEssAction) {
+ addPair(NETWORK_TRAFFIC_ESS_ACTION, networkTrafficEssAction);
+ }
+
+ public void setNetworkTrafficEssDestPort(int networkTrafficEssDestPort) {
+ addPair(NETWORK_TRAFFIC_ESS_DEST_PORT, networkTrafficEssDestPort);
+ }
+
+ public void setNetworkTrafficEssProduct(String networkTrafficEssProduct) {
+ addPair(NETWORK_TRAFFIC_ESS_PRODUCT, networkTrafficEssProduct);
+ }
+
+ public void setNetworkTrafficEssSrcPort(int networkTrafficEssSrcPort) {
+ addPair(NETWORK_TRAFFIC_ESS_SRC_PORT, networkTrafficEssSrcPort);
+ }
+
+ public void setNetworkTrafficEssVendor(String networkTrafficEssVendor) {
+ addPair(NETWORK_TRAFFIC_ESS_VENDOR, networkTrafficEssVendor);
+ }
+
+ public void setNetworkTrafficGenericAppLayer(String networkTrafficGenericAppLayer) {
+ addPair(NETWORK_TRAFFIC_GENERIC_APP_LAYER, networkTrafficGenericAppLayer);
+ }
+
+ public void setNetworkTrafficGenericBytesIn(long networkTrafficGenericBytesIn) {
+ addPair(NETWORK_TRAFFIC_GENERIC_BYTES_IN, networkTrafficGenericBytesIn);
+ }
+
+ public void setNetworkTrafficGenericBytesOut(long networkTrafficGenericBytesOut) {
+ addPair(NETWORK_TRAFFIC_GENERIC_BYTES_OUT, networkTrafficGenericBytesOut);
+ }
+
+ public void setNetworkTrafficGenericChannel(String networkTrafficGenericChannel) {
+ addPair(NETWORK_TRAFFIC_GENERIC_CHANNEL, networkTrafficGenericChannel);
+ }
+
+ public void setNetworkTrafficGenericCve(String networkTrafficGenericCve) {
+ addPair(NETWORK_TRAFFIC_GENERIC_CVE, networkTrafficGenericCve);
+ }
+
+ public void setNetworkTrafficGenericDestApp(String networkTrafficGenericDestApp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_APP, networkTrafficGenericDestApp);
+ }
+
+ public void setNetworkTrafficGenericDestCncChannel(String networkTrafficGenericDestCncChannel) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL, networkTrafficGenericDestCncChannel);
+ }
+
+ public void setNetworkTrafficGenericDestCncName(String networkTrafficGenericDestCncName) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME, networkTrafficGenericDestCncName);
+ }
+
+ public void setNetworkTrafficGenericDestCncPort(String networkTrafficGenericDestCncPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT, networkTrafficGenericDestCncPort);
+ }
+
+ public void setNetworkTrafficGenericDestCountry(String networkTrafficGenericDestCountry) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY, networkTrafficGenericDestCountry);
+ }
+
+ public void setNetworkTrafficGenericDestHost(String networkTrafficGenericDestHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_HOST, networkTrafficGenericDestHost);
+ }
+
+ public void setNetworkTrafficGenericDestInt(String networkTrafficGenericDestInt) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_INT, networkTrafficGenericDestInt);
+ }
+
+ public void setNetworkTrafficGenericDestIp(String networkTrafficGenericDestIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_IP, networkTrafficGenericDestIp);
+ }
+
+ public void setNetworkTrafficGenericDestIpv6(String networkTrafficGenericDestIpv6) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_IPV6, networkTrafficGenericDestIpv6);
+ }
+
+ public void setNetworkTrafficGenericDestLat(int networkTrafficGenericDestLat) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_LAT, networkTrafficGenericDestLat);
+ }
+
+ public void setNetworkTrafficGenericDestLong(int networkTrafficGenericDestLong) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_LONG, networkTrafficGenericDestLong);
+ }
+
+ public void setNetworkTrafficGenericDestMac(String networkTrafficGenericDestMac) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_MAC, networkTrafficGenericDestMac);
+ }
+
+ public void setNetworkTrafficGenericDestNtDomain(String networkTrafficGenericDestNtDomain) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN, networkTrafficGenericDestNtDomain);
+ }
+
+ public void setNetworkTrafficGenericDestNtHost(String networkTrafficGenericDestNtHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST, networkTrafficGenericDestNtHost);
+ }
+
+ public void setNetworkTrafficGenericDestPort(int networkTrafficGenericDestPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_PORT, networkTrafficGenericDestPort);
+ }
+
+ public void setNetworkTrafficGenericDestTranslatedIp(String networkTrafficGenericDestTranslatedIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP, networkTrafficGenericDestTranslatedIp);
+ }
+
+ public void setNetworkTrafficGenericDestTranslatedPort(int networkTrafficGenericDestTranslatedPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT, networkTrafficGenericDestTranslatedPort);
+ }
+
+ public void setNetworkTrafficGenericIpVersion(int networkTrafficGenericIpVersion) {
+ addPair(NETWORK_TRAFFIC_GENERIC_IP_VERSION, networkTrafficGenericIpVersion);
+ }
+
+ public void setNetworkTrafficGenericOutboundInterface(String networkTrafficGenericOutboundInterface) {
+ addPair(NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE, networkTrafficGenericOutboundInterface);
+ }
+
+ public void setNetworkTrafficGenericPacketsIn(long networkTrafficGenericPacketsIn) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_IN, networkTrafficGenericPacketsIn);
+ }
+
+ public void setNetworkTrafficGenericPacketsOut(long networkTrafficGenericPacketsOut) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_OUT, networkTrafficGenericPacketsOut);
+ }
+
+ public void setNetworkTrafficGenericProto(String networkTrafficGenericProto) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PROTO, networkTrafficGenericProto);
+ }
+
+ public void setNetworkTrafficGenericSessionId(String networkTrafficGenericSessionId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SESSION_ID, networkTrafficGenericSessionId);
+ }
+
+ public void setNetworkTrafficGenericSsid(String networkTrafficGenericSsid) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SSID, networkTrafficGenericSsid);
+ }
+
+ public void setNetworkTrafficGenericSrcCountry(String networkTrafficGenericSrcCountry) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY, networkTrafficGenericSrcCountry);
+ }
+
+ public void setNetworkTrafficGenericSrcHost(String networkTrafficGenericSrcHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_HOST, networkTrafficGenericSrcHost);
+ }
+
+ public void setNetworkTrafficGenericSrcInt(String networkTrafficGenericSrcInt) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_INT, networkTrafficGenericSrcInt);
+ }
+
+ public void setNetworkTrafficGenericSrcIp(String networkTrafficGenericSrcIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_IP, networkTrafficGenericSrcIp);
+ }
+
+ public void setNetworkTrafficGenericSrcIpv6(String networkTrafficGenericSrcIpv6) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_IPV6, networkTrafficGenericSrcIpv6);
+ }
+
+ public void setNetworkTrafficGenericSrcLat(int networkTrafficGenericSrcLat) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_LAT, networkTrafficGenericSrcLat);
+ }
+
+ public void setNetworkTrafficGenericSrcLong(int networkTrafficGenericSrcLong) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_LONG, networkTrafficGenericSrcLong);
+ }
+
+ public void setNetworkTrafficGenericSrcMac(String networkTrafficGenericSrcMac) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_MAC, networkTrafficGenericSrcMac);
+ }
+
+ public void setNetworkTrafficGenericSrcNtDomain(String networkTrafficGenericSrcNtDomain) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN, networkTrafficGenericSrcNtDomain);
+ }
+
+ public void setNetworkTrafficGenericSrcNtHost(String networkTrafficGenericSrcNtHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST, networkTrafficGenericSrcNtHost);
+ }
+
+ public void setNetworkTrafficGenericSrcPort(int networkTrafficGenericSrcPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_PORT, networkTrafficGenericSrcPort);
+ }
+
+ public void setNetworkTrafficGenericSrcTranslatedIp(String networkTrafficGenericSrcTranslatedIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP, networkTrafficGenericSrcTranslatedIp);
+ }
+
+ public void setNetworkTrafficGenericSrcTranslatedPort(int networkTrafficGenericSrcTranslatedPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT, networkTrafficGenericSrcTranslatedPort);
+ }
+
+ public void setNetworkTrafficGenericSyslogId(String networkTrafficGenericSyslogId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_ID, networkTrafficGenericSyslogId);
+ }
+
+ public void setNetworkTrafficGenericSyslogPriority(String networkTrafficGenericSyslogPriority) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY, networkTrafficGenericSyslogPriority);
+ }
+
+ public void setNetworkTrafficGenericTcpFlag(String networkTrafficGenericTcpFlag) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TCP_FLAG, networkTrafficGenericTcpFlag);
+ }
+
+ public void setNetworkTrafficGenericTos(String networkTrafficGenericTos) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TOS, networkTrafficGenericTos);
+ }
+
+ public void setNetworkTrafficGenericTransport(String networkTrafficGenericTransport) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TRANSPORT, networkTrafficGenericTransport);
+ }
+
+ public void setNetworkTrafficGenericTtl(int networkTrafficGenericTtl) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TTL, networkTrafficGenericTtl);
+ }
+
+ public void setNetworkTrafficGenericVlanId(long networkTrafficGenericVlanId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_VLAN_ID, networkTrafficGenericVlanId);
+ }
+
+ public void setNetworkTrafficGenericVlanName(String networkTrafficGenericVlanName) {
+ addPair(NETWORK_TRAFFIC_GENERIC_VLAN_NAME, networkTrafficGenericVlanName);
+ }
+
+ public void setPacketFilteringAction(String packetFilteringAction) {
+ addPair(PACKET_FILTERING_ACTION, packetFilteringAction);
+ }
+
+ public void setPacketFilteringDestPort(int packetFilteringDestPort) {
+ addPair(PACKET_FILTERING_DEST_PORT, packetFilteringDestPort);
+ }
+
+ public void setPacketFilteringDirection(String packetFilteringDirection) {
+ addPair(PACKET_FILTERING_DIRECTION, packetFilteringDirection);
+ }
+
+ public void setPacketFilteringDvc(String packetFilteringDvc) {
+ addPair(PACKET_FILTERING_DVC, packetFilteringDvc);
+ }
+
+ public void setPacketFilteringRule(String packetFilteringRule) {
+ addPair(PACKET_FILTERING_RULE, packetFilteringRule);
+ }
+
+ public void setPacketFilteringSvcPort(int packetFilteringSvcPort) {
+ addPair(PACKET_FILTERING_SVC_PORT, packetFilteringSvcPort);
+ }
+
+ public void setProxyAction(String proxyAction) {
+ addPair(PROXY_ACTION, proxyAction);
+ }
+
+ public void setProxyDest(String proxyDest) {
+ addPair(PROXY_DEST, proxyDest);
+ }
+
+ public void setProxyHttpContentType(String proxyHttpContentType) {
+ addPair(PROXY_HTTP_CONTENT_TYPE, proxyHttpContentType);
+ }
+
+ public void setProxyHttpMethod(String proxyHttpMethod) {
+ addPair(PROXY_HTTP_METHOD, proxyHttpMethod);
+ }
+
+ public void setProxyHttpRefer(String proxyHttpRefer) {
+ addPair(PROXY_HTTP_REFER, proxyHttpRefer);
+ }
+
+ public void setProxyHttpResponse(int proxyHttpResponse) {
+ addPair(PROXY_HTTP_RESPONSE, proxyHttpResponse);
+ }
+
+ public void setProxyHttpUserAgent(String proxyHttpUserAgent) {
+ addPair(PROXY_HTTP_USER_AGENT, proxyHttpUserAgent);
+ }
+
+ public void setProxyProduct(String proxyProduct) {
+ addPair(PROXY_PRODUCT, proxyProduct);
+ }
+
+ public void setProxySrc(String proxySrc) {
+ addPair(PROXY_SRC, proxySrc);
+ }
+
+ public void setProxyStatus(int proxyStatus) {
+ addPair(PROXY_STATUS, proxyStatus);
+ }
+
+ public void setProxyUser(String proxyUser) {
+ addPair(PROXY_USER, proxyUser);
+ }
+
+ public void setProxyUrl(String proxyUrl) {
+ addPair(PROXY_URL, proxyUrl);
+ }
+
+ public void setProxyVendor(String proxyVendor) {
+ addPair(PROXY_VENDOR, proxyVendor);
+ }
+
+ public void setSystemCenterApp(String systemCenterApp) {
+ addPair(SYSTEM_CENTER_APP, systemCenterApp);
+ }
+
+ public void setSystemCenterFreembytes(long systemCenterFreembytes) {
+ addPair(SYSTEM_CENTER_FREEMBYTES, systemCenterFreembytes);
+ }
+
+ public void setSystemCenterKernelRelease(String systemCenterKernelRelease) {
+ addPair(SYSTEM_CENTER_KERNEL_RELEASE, systemCenterKernelRelease);
+ }
+
+ public void setSystemCenterLabel(String systemCenterLabel) {
+ addPair(SYSTEM_CENTER_LABEL, systemCenterLabel);
+ }
+
+ public void setSystemCenterMount(String systemCenterMount) {
+ addPair(SYSTEM_CENTER_MOUNT, systemCenterMount);
+ }
+
+ public void setSystemCenterOs(String systemCenterOs) {
+ addPair(SYSTEM_CENTER_OS, systemCenterOs);
+ }
+
+ public void setSystemCenterPercentprocessortime(int systemCenterPercentprocessortime) {
+ addPair(SYSTEM_CENTER_PERCENTPROCESSORTIME, systemCenterPercentprocessortime);
+ }
+
+ public void setSystemCenterSetlocaldefs(int systemCenterSetlocaldefs) {
+ addPair(SYSTEM_CENTER_SETLOCALDEFS, systemCenterSetlocaldefs);
+ }
+
+ public void setSystemCenterSelinux(String systemCenterSelinux) {
+ addPair(SYSTEM_CENTER_SELINUX, systemCenterSelinux);
+ }
+
+ public void setSystemCenterSelinuxtype(String systemCenterSelinuxtype) {
+ addPair(SYSTEM_CENTER_SELINUXTYPE, systemCenterSelinuxtype);
+ }
+
+ public void setSystemCenterShell(String systemCenterShell) {
+ addPair(SYSTEM_CENTER_SHELL, systemCenterShell);
+ }
+
+ public void setSystemCenterSrcPort(int systemCenterSrcPort) {
+ addPair(SYSTEM_CENTER_SRC_PORT, systemCenterSrcPort);
+ }
+
+ public void setSystemCenterSshdProtocol(String systemCenterSshdProtocol) {
+ addPair(SYSTEM_CENTER_SSHD_PROTOCOL, systemCenterSshdProtocol);
+ }
+
+ public void setSystemCenterStartmode(String systemCenterStartmode) {
+ addPair(SYSTEM_CENTER_STARTMODE, systemCenterStartmode);
+ }
+
+ public void setSystemCenterSystemuptime(long systemCenterSystemuptime) {
+ addPair(SYSTEM_CENTER_SYSTEMUPTIME, systemCenterSystemuptime);
+ }
+
+ public void setSystemCenterTotalmbytes(long systemCenterTotalmbytes) {
+ addPair(SYSTEM_CENTER_TOTALMBYTES, systemCenterTotalmbytes);
+ }
+
+ public void setSystemCenterUsedmbytes(long systemCenterUsedmbytes) {
+ addPair(SYSTEM_CENTER_USEDMBYTES, systemCenterUsedmbytes);
+ }
+
+ public void setSystemCenterUser(String systemCenterUser) {
+ addPair(SYSTEM_CENTER_USER, systemCenterUser);
+ }
+
+ public void setSystemCenterUpdates(long systemCenterUpdates) {
+ addPair(SYSTEM_CENTER_UPDATES, systemCenterUpdates);
+ }
+
+ public void setTrafficDest(String trafficDest) {
+ addPair(TRAFFIC_DEST, trafficDest);
+ }
+
+ public void setTrafficDvc(String trafficDvc) {
+ addPair(TRAFFIC_DVC, trafficDvc);
+ }
+
+ public void setTrafficSrc(String trafficSrc) {
+ addPair(TRAFFIC_SRC, trafficSrc);
+ }
+
+ public void setUpdatePackage(String updatePackage) {
+ addPair(UPDATE_PACKAGE, updatePackage);
+ }
+
+ public void setUserInfoUpdatesAffectedUser(String userInfoUpdatesAffectedUser) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER, userInfoUpdatesAffectedUser);
+ }
+
+ public void setUserInfoUpdatesAffectedUserGroup(String userInfoUpdatesAffectedUserGroup) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP, userInfoUpdatesAffectedUserGroup);
+ }
+
+ public void setUserInfoUpdatesAffectedUserGroupId(int userInfoUpdatesAffectedUserGroupId) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID, userInfoUpdatesAffectedUserGroupId);
+ }
+
+ public void setUserInfoUpdatesAffectedUserId(int userInfoUpdatesAffectedUserId) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_ID, userInfoUpdatesAffectedUserId);
+ }
+
+ public void setUserInfoUpdatesAffectedUserPrivilege(String userInfoUpdatesAffectedUserPrivilege) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE, userInfoUpdatesAffectedUserPrivilege);
+ }
+
+ public void setUserInfoUpdatesUser(String userInfoUpdatesUser) {
+ addPair(USER_INFO_UPDATES_USER, userInfoUpdatesUser);
+ }
+
+ public void setUserInfoUpdatesUserGroup(String userInfoUpdatesUserGroup) {
+ addPair(USER_INFO_UPDATES_USER_GROUP, userInfoUpdatesUserGroup);
+ }
+
+ public void setUserInfoUpdatesUserGroupId(int userInfoUpdatesUserGroupId) {
+ addPair(USER_INFO_UPDATES_USER_GROUP_ID, userInfoUpdatesUserGroupId);
+ }
+
+ public void setUserInfoUpdatesUserId(int userInfoUpdatesUserId) {
+ addPair(USER_INFO_UPDATES_USER_ID, userInfoUpdatesUserId);
+ }
+
+ public void setUserInfoUpdatesUserPrivilege(String userInfoUpdatesUserPrivilege) {
+ addPair(USER_INFO_UPDATES_USER_PRIVILEGE, userInfoUpdatesUserPrivilege);
+ }
+
+ public void setUserInfoUpdatesUserSubject(String userInfoUpdatesUserSubject) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT, userInfoUpdatesUserSubject);
+ }
+
+ public void setUserInfoUpdatesUserSubjectId(int userInfoUpdatesUserSubjectId) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT_ID, userInfoUpdatesUserSubjectId);
+ }
+
+ public void setUserInfoUpdatesUserSubjectPrivilege(String userInfoUpdatesUserSubjectPrivilege) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE, userInfoUpdatesUserSubjectPrivilege);
+ }
+
+ public void setVulnerabilityCategory(String vulnerabilityCategory) {
+ addPair(VULNERABILITY_CATEGORY, vulnerabilityCategory);
+ }
+
+ public void setVulnerabilityDest(String vulnerabilityDest) {
+ addPair(VULNERABILITY_DEST, vulnerabilityDest);
+ }
+
+ public void setVulnerabilityOs(String vulnerabilityOs) {
+ addPair(VULNERABILITY_OS, vulnerabilityOs);
+ }
+
+ public void setVulnerabilitySeverity(String vulnerabilitySeverity) {
+ addPair(VULNERABILITY_SEVERITY, vulnerabilitySeverity);
+ }
+
+ public void setVulnerabilitySignature(String vulnerabilitySignature) {
+ addPair(VULNERABILITY_SIGNATURE, vulnerabilitySignature);
+ }
+
+ public void setWindowsAdminObjectName(String windowsAdminObjectName) {
+ addPair(WINDOWS_ADMIN_OBJECT_NAME, windowsAdminObjectName);
+ }
+
+ public void setWindowsAdminObjectType(String windowsAdminObjectType) {
+ addPair(WINDOWS_ADMIN_OBJECT_TYPE, windowsAdminObjectType);
+ }
+
+ public void setWindowsAdminObjectHandle(String windowsAdminObjectHandle) {
+ addPair(WINDOWS_ADMIN_OBJECT_HANDLE, windowsAdminObjectHandle);
+ }
+
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java
new file mode 100644
index 0000000..b8b703b
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java
@@ -0,0 +1,117 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.entity;
+
+/**
+ * Splunk server entity
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkServer {
+
+ private String host;
+ private int port;
+ private String scheme;
+ private String app;
+ private String owner;
+ private String userName;
+ private String password;
+
+ /**
+ * @return the host
+ */
+ public String getHost() {
+ return host;
+ }
+
+ /**
+ * @param host the host to set
+ */
+ public void setHost(String host) {
+ this.host = host;
+ }
+
+ /**
+ * @return the port
+ */
+ public int getPort() {
+ return port;
+ }
+
+ /**
+ * @param port the port to set
+ */
+ public void setPort(int port) {
+ this.port = port;
+ }
+
+ public String getScheme() {
+ return scheme;
+ }
+
+ public void setScheme(String scheme) {
+ this.scheme = scheme;
+ }
+
+ public String getApp() {
+ return app;
+ }
+
+ public void setApp(String app) {
+ this.app = app;
+ }
+
+ public String getOwner() {
+ return owner;
+ }
+
+ public void setOwner(String owner) {
+ this.owner = owner;
+ }
+
+ /**
+ * @return the userName
+ */
+ public String getUserName() {
+ return userName;
+ }
+
+ /**
+ * @param userName the userName to set
+ */
+ public void setUserName(String userName) {
+ this.userName = userName;
+ }
+
+ /**
+ * @return the password
+ */
+ public String getPassword() {
+ return password;
+ }
+
+ /**
+ * @param password the password to set
+ */
+ public void setPassword(String password) {
+ this.password = password;
+ }
+
+
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java
new file mode 100644
index 0000000..c99ed67
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2002-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.inbound;
+
+import java.util.List;
+
+import org.springframework.integration.Message;
+import org.springframework.integration.context.IntegrationObjectSupport;
+import org.springframework.integration.core.MessageSource;
+import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.support.SplunkExecutor;
+import org.springframework.integration.support.MessageBuilder;
+import org.springframework.util.Assert;
+
+/**
+ * Polling data from Splunk to generate Message
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkPollingChannelAdapter extends IntegrationObjectSupport implements MessageSource> {
+
+ private final SplunkExecutor splunkExecutor;
+
+ /**
+ * Constructor taking a {@link SplunkExecutor} that provide all required Splunk
+ * functionality.
+ *
+ * @param splunkExecutor Must not be null.
+ */
+ public SplunkPollingChannelAdapter(SplunkExecutor splunkExecutor) {
+ super();
+ Assert.notNull(splunkExecutor, "splunkExecutor must not be null.");
+ this.splunkExecutor = splunkExecutor;
+ }
+
+ /**
+ * Check for mandatory attributes
+ */
+ @Override
+ protected void onInit() throws Exception {
+ super.onInit();
+ }
+
+ /**
+ * Uses {@link SplunkExecutor#poll()} to executes the Splunk operation.
+ *
+ * If {@link SplunkExecutor#poll()} returns null, this method will return
+ * null. Otherwise, a new {@link Message} is constructed and returned.
+ */
+ public Message> receive() {
+ List payload = splunkExecutor.poll();
+ if (payload == null) {
+ return null;
+ }
+ return MessageBuilder.withPayload(payload).build();
+ }
+
+ @Override
+ public String getComponentType() {
+ return "splunk:inbound-channel-adapter";
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/package-info.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/package-info.java
new file mode 100644
index 0000000..f72820a
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/inbound/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Provides inbound Spring Integration Splunk components.
+ */
+package org.springframework.integration.splunk.inbound;
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapter.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapter.java
new file mode 100644
index 0000000..3c78da0
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapter.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2002-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.splunk.outbound;
+
+import org.springframework.integration.Message;
+import org.springframework.integration.handler.AbstractReplyProducingMessageHandler;
+import org.springframework.integration.splunk.support.SplunkExecutor;
+import org.springframework.integration.support.MessageBuilder;
+import org.springframework.util.Assert;
+
+
+/**
+ * Handle message and write data into Splunk
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkOutboundChannelAdapter extends AbstractReplyProducingMessageHandler {
+
+ private final SplunkExecutor splunkExecutor;
+ private boolean producesReply = true; //false for outbound-channel-adapter, true for outbound-gateway
+
+ /**
+ * Constructor taking an {@link SplunkExecutor} that wraps common
+ * Splunk Operations.
+ *
+ * @param splunkExecutor Must not be null
+ *
+ */
+ public SplunkOutboundChannelAdapter(SplunkExecutor splunkExecutor) {
+ Assert.notNull(splunkExecutor, "splunkExecutor must not be null.");
+ this.splunkExecutor = splunkExecutor;
+ }
+
+ /**
+ *
+ */
+ @Override
+ protected void onInit() {
+ super.onInit();
+ }
+
+ @Override
+ protected Object handleRequestMessage(Message requestMessage) {
+ final Object result;
+ result = this.splunkExecutor.executeOutboundOperation(requestMessage);
+ if (result == null || !producesReply) {
+ return null;
+ }
+ return MessageBuilder.withPayload(result).copyHeaders(requestMessage.getHeaders()).build();
+
+ }
+
+ /**
+ * If set to 'false', this component will act as an Outbound Channel Adapter.
+ * If not explicitly set this property will default to 'true'.
+ *
+ * @param producesReply Defaults to 'true'.
+ *
+ */
+ public void setProducesReply(boolean producesReply) {
+ this.producesReply = producesReply;
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/package-info.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/package-info.java
new file mode 100644
index 0000000..0ce1585
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/outbound/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Provides Spring Integration components for doing outbound operations.
+ */
+package org.springframework.integration.splunk.outbound;
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBean.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBean.java
new file mode 100644
index 0000000..a5c1204
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBean.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+
+/**
+ * Factory bean to create ConnectionFactory.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class ConnectionFactoryFactoryBean implements FactoryBean> {
+
+ private final ConnectionFactory connectionFactory;
+
+ public ConnectionFactoryFactoryBean(ConnectionFactory cf, boolean usePool) {
+ if (usePool) {
+ this.connectionFactory = new PoolingConnectionFactory(cf);
+ }
+ else {
+ this.connectionFactory = cf;
+ }
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#getObject()
+ */
+ public ConnectionFactory getObject() throws Exception {
+ return this.connectionFactory;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#getObjectType()
+ */
+ public Class getObjectType() {
+ return connectionFactory.getClass();
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#isSingleton()
+ */
+ public boolean isSingleton() {
+ return true;
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/IngestType.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/IngestType.java
new file mode 100644
index 0000000..a03f505
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/IngestType.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+/**
+ * Method of pushing data into Splunk.
+ *
+ * Stream: Establish a connection, keep it open, and stream events until the connection is closed.Better for high volume input.
+ * Tcp: Create raw socket and send event data into the socket
+ * Submit: Send event data into Splunk with HTTP REST api
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public enum IngestType {
+ stream("stream"), tcp("tcp"), submit("submit");
+
+ private String type;
+
+ IngestType(String ingestType) {
+ this.type = ingestType;
+ }
+
+ public String getIngestType() {
+ return type;
+ }
+}
\ No newline at end of file
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/PoolingConnectionFactory.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/PoolingConnectionFactory.java
new file mode 100644
index 0000000..2bf6efe
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/PoolingConnectionFactory.java
@@ -0,0 +1,134 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.apache.commons.pool.BasePoolableObjectFactory;
+import org.apache.commons.pool.ObjectPool;
+import org.apache.commons.pool.impl.GenericObjectPool;
+import org.springframework.beans.factory.DisposableBean;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+
+/**
+ * Pooling ConnectionFactory to pool Connection with Apache Commons Pool.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class PoolingConnectionFactory implements ConnectionFactory, DisposableBean {
+
+ private final Log log = LogFactory.getLog(this.getClass());
+
+ private final ConnectionFactory connectionFactory;
+
+ private ObjectPool> pool;
+
+ public PoolingConnectionFactory(ConnectionFactory f) {
+ this.connectionFactory = f;
+ this.pool = new GenericObjectPool>(new ConnectionPoolableObjectFactory());
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.ServiceFactory#getService()
+ */
+ public Connection getConnection() throws Exception {
+ return new PooledConnection(this.pool.borrowObject());
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.DisposableBean#destroy()
+ */
+ public void destroy() throws Exception {
+ pool.clear();
+ pool.close();
+ }
+
+ class ConnectionPoolableObjectFactory extends BasePoolableObjectFactory> {
+
+ /* (non-Javadoc)
+ * @see org.apache.commons.pool.BasePoolableObjectFactory#makeObject()
+ */
+ @Override
+ public Connection makeObject() throws Exception {
+ return connectionFactory.getConnection();
+ }
+
+ @Override
+ public void destroyObject(Connection obj) throws Exception {
+ obj.close();
+ }
+
+ /**
+ * Whether the object is valid or not.
+ *
+ * @param obj object to be validated
+ * @return true
+ */
+ public boolean validateObject(Connection obj) {
+ return obj.isOpen();
+ }
+
+ /**
+ * activate the object
+ *
+ * @param obj ignored
+ */
+ public void activateObject(Connection obj) throws Exception {
+ obj.isOpen();
+ }
+
+
+ }
+
+ class PooledConnection implements Connection {
+
+ private Connection connection;
+
+ public PooledConnection(Connection con) {
+ this.connection = con;
+ }
+
+ /* (non-Javadoc)l
+ * @see org.springframework.integration.splunk.core.IService#close()
+ */
+ public void close() {
+ try {
+ pool.returnObject(connection);
+ } catch (Exception e) {
+ log.warn("failed to return pooled object", e);
+ }
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.IService#isOpen()
+ */
+ public boolean isOpen() {
+ return connection.isOpen();
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.IService#getService()
+ */
+ public T getTarget() {
+ return connection.getTarget();
+ }
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SearchMode.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SearchMode.java
new file mode 100644
index 0000000..3d4c62a
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SearchMode.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+/**
+ * Search mode supported by Splunk.
+ *
+ * Blocking: Run synchronous search API
+ * Normal: Run asynchronous search API
+ * Realtime: Run the searches which are over a defined real time window
+ * Export: Run synchronously in your code , best way for bulk exports of events from Splunk
+ * Saved: Run predefined searches/parameters that are saved in Splunk in a namespace and you can execute them by name
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public enum SearchMode {
+ blocking, normal, realtime, export, saved;
+}
\ No newline at end of file
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java
new file mode 100644
index 0000000..233fcc0
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.entity.SplunkServer;
+
+import com.splunk.Service;
+
+/**
+ * Connection to Splunk service
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkConnection implements Connection {
+
+ private Service service;
+
+ public SplunkConnection(SplunkServer splunkServer) {
+ Map args = new HashMap();
+ if (splunkServer.getHost() != null) {
+ args.put("host", splunkServer.getHost());
+ }
+ if (splunkServer.getPort() != 0) {
+ args.put("port", splunkServer.getPort());
+ }
+ if (splunkServer.getScheme() != null) {
+ args.put("scheme", splunkServer.getScheme());
+ }
+ if (splunkServer.getApp() != null) {
+ args.put("app", splunkServer.getApp());
+ }
+ if (splunkServer.getOwner() != null) {
+ args.put("owner", splunkServer.getOwner());
+ }
+
+ args.put("username", splunkServer.getUserName());
+ args.put("password", splunkServer.getPassword());
+ service = Service.connect(args);
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.IService#close()
+ */
+ public void close() {
+ service.logout();
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.IService#isOpen()
+ */
+ public boolean isOpen() {
+ boolean result = true;
+ try {
+ service.getApplications();
+ } catch (Throwable t) {
+ result = false;
+ }
+ return result;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.IService#getService()
+ */
+ public Service getTarget() {
+ return service;
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java
new file mode 100644
index 0000000..5eba652
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.entity.SplunkServer;
+
+import com.splunk.Service;
+
+/**
+ * Factory to create Splunk connection.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkConnectionFactory implements ConnectionFactory {
+
+ private SplunkServer splunkServer;
+
+ public SplunkConnectionFactory(SplunkServer server) {
+ this.splunkServer = server;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.ServiceFactory#getService()
+ */
+ public Connection getConnection() throws Exception {
+ return new SplunkConnection(splunkServer);
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java
new file mode 100644
index 0000000..b0fce88
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java
@@ -0,0 +1,470 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.InputStream;
+import java.text.DateFormat;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.core.DataReader;
+import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
+import com.splunk.Args;
+import com.splunk.Job;
+import com.splunk.ResultsReader;
+import com.splunk.ResultsReaderXml;
+import com.splunk.SavedSearch;
+import com.splunk.SavedSearchCollection;
+import com.splunk.Service;
+
+/**
+ * Data reader to search data from Splunk.
+ *
+ * There are 5 ways to search data provided by Splunk SDK: saved search, blocking search,
+ * non blocking search, realtime search, export search.
+ *
+ * Splunk search also supports time range search with earliestTime and latestTime.
+ * For the first time start, initEarliestTime is used as earliestTime.
+ * If user does not specify earliestTime and latestTime, latestTime is "now"
+ * earliestTime is the time that last polling is run.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkDataReader implements DataReader, InitializingBean {
+
+ private static final String DATE_FORMAT = "MM/dd/yy HH:mm:ss:SSS";
+
+ private static final String SPLUNK_TIME_FORMAT = "%m/%d/%y %H:%M:%S:%3N";
+
+ private static final Log logger = LogFactory.getLog(SplunkDataReader.class);
+
+ private ConnectionFactory connectionFactory;
+
+ private SearchMode mode;
+
+ private int count = 0;
+
+ private String fieldList;
+
+ private String search;
+
+ private String earliestTime;
+
+ private String latestTime;
+
+ private String savedSearch;
+
+ private String owner;
+
+ private String app;
+
+ private String initEarliestTime;
+
+ private transient Calendar lastSuccessfulReadTime;
+
+ public SplunkDataReader(ConnectionFactory f) {
+ this.connectionFactory = f;
+ }
+
+ public void setSearch(String searchStr) {
+ Assert.hasText(searchStr, "search must be neither null nor empty");
+ this.search = searchStr;
+ }
+
+ public void setEarliestTime(String earliestTime) {
+ this.earliestTime = earliestTime;
+ }
+
+ public void setLatestTime(String latestTime) {
+ this.latestTime = latestTime;
+ }
+
+ public void setSavedSearch(String savedSearch) {
+ this.savedSearch = savedSearch;
+ }
+
+ public void setMode(SearchMode mode) {
+ Assert.notNull(mode, "mode must be set");
+ this.mode = mode;
+ }
+
+ public void setCount(int count) {
+ this.count = count;
+ }
+
+ public void setFieldList(String fieldList) {
+ this.fieldList = fieldList;
+ }
+
+ public void setOwner(String owner) {
+ this.owner = owner;
+ }
+
+ public void setApp(String app) {
+ this.app = app;
+ }
+
+ public void setInitEarliestTime(String initEarliestTime) {
+ Assert.notNull(initEarliestTime, "initial earliest time can not be null");
+ this.initEarliestTime = initEarliestTime;
+ }
+
+ public SearchMode getMode() {
+ return mode;
+ }
+
+ public int getCount() {
+ return count;
+ }
+
+ public String getFieldList() {
+ return fieldList;
+ }
+
+ public String getSearch() {
+ return search;
+ }
+
+ public String getEarliestTime() {
+ return earliestTime;
+ }
+
+ public String getLatestTime() {
+ return latestTime;
+ }
+
+ public String getSavedSearch() {
+ return savedSearch;
+ }
+
+ public String getOwner() {
+ return owner;
+ }
+
+ public String getInitEarliestTime() {
+ return initEarliestTime;
+ }
+
+ public String getApp() {
+ return app;
+ }
+
+ public List search() throws Exception {
+ logger.debug("mode:" + mode);
+ switch (mode) {
+ case saved: {
+ return savedSearch();
+ }
+ case blocking: {
+ return blockingSearch();
+ }
+ case normal: {
+ return nonBlockingSearch();
+ }
+ case export: {
+ return exportSearch();
+ }
+ case realtime: {
+ return realtimeSearch();
+ }
+ }
+ return null;
+ }
+
+ /**
+ * Get the earliestTime of range search.
+ *
+ * @param startTime the time where search start
+ * @param realtime if this is realtime search
+ *
+ * @return The time of last successful read if not realtime;
+ * Time difference between last successful read and start time;
+ */
+ private String calculateEarliestTime(Calendar startTime, boolean realtime) {
+ String result = null;
+ if (realtime) {
+ result = calculateEarliestTimeForRealTime(startTime);
+ }
+ DateFormat df = new SimpleDateFormat(DATE_FORMAT);
+ result = df.format(lastSuccessfulReadTime.getTime());
+ return result;
+ }
+
+
+ /**
+ * get earliest time for realtime search
+ *
+ * @param startTime
+ * @return
+ */
+ private String calculateEarliestTimeForRealTime(Calendar startTime) {
+ String result = null;
+ long diff = startTime.getTimeInMillis() - lastSuccessfulReadTime.getTimeInMillis();
+ result = "-" + diff / 1000 + "s";
+ return result;
+ }
+
+ private void populateArgs(Args queryArgs, Calendar startTime, boolean realtime) {
+ String earliestTime = getEarliestTime(startTime, realtime);
+ if (StringUtils.hasText(earliestTime)) {
+ queryArgs.put("earliest_time", earliestTime);
+ }
+
+ String latestTime = getLatestTime(startTime, realtime);
+ if (StringUtils.hasText(latestTime)) {
+ queryArgs.put("latest_time", latestTime);
+ }
+
+ queryArgs.put("time_format", SPLUNK_TIME_FORMAT);
+
+ if (StringUtils.hasText(fieldList)) {
+ queryArgs.put("field_list", fieldList);
+ }
+ }
+
+ private String getLatestTime(Calendar startTime, boolean realtime) {
+ String lTime = null;
+ if (StringUtils.hasText(latestTime)) {
+ lTime = latestTime;
+ }
+ else {
+ if (realtime) {
+ lTime = "rt";
+ }
+ else {
+ DateFormat df = new SimpleDateFormat(DATE_FORMAT);
+ lTime = df.format(startTime.getTime());
+ }
+ }
+ return lTime;
+ }
+
+ private String getEarliestTime(Calendar startTime, boolean realtime) {
+ String eTime = null;
+
+ if (lastSuccessfulReadTime == null) {
+ eTime = initEarliestTime;
+ }
+ else {
+ if (StringUtils.hasText(earliestTime)) {
+ eTime = earliestTime;
+ }
+ else {
+ String calculatedEarliestTime = calculateEarliestTime(startTime, realtime);
+ if (calculatedEarliestTime != null) {
+ if (realtime) {
+ eTime = "rt" + calculatedEarliestTime;
+ }
+ else {
+ eTime = calculatedEarliestTime;
+ }
+ }
+ }
+ }
+ return eTime;
+ }
+
+
+ private List runQuery(Args queryArgs) throws Exception {
+ Connection connection = connectionFactory.getConnection();
+ try {
+ Job job = connection.getTarget().getJobs().create(search, queryArgs);
+ while (!job.isDone()) {
+ Thread.sleep(2000);
+ }
+ return extractData(job);
+ } finally {
+ connection.close();
+ }
+ }
+
+ private List blockingSearch() throws Exception {
+ logger.debug("block search start");
+
+ Args queryArgs = new Args();
+ queryArgs.put("exec_mode", "blocking");
+ Calendar startTime = Calendar.getInstance();
+ populateArgs(queryArgs, startTime, false);
+ List data = runQuery(queryArgs);
+ lastSuccessfulReadTime = startTime;
+ return data;
+ }
+
+
+ private List nonBlockingSearch() throws Exception {
+ logger.debug("non block search start");
+
+ Args queryArgs = new Args();
+ queryArgs.put("exec_mode", "normal");
+ Calendar startTime = Calendar.getInstance();
+ populateArgs(queryArgs, startTime, false);
+
+ List data = runQuery(queryArgs);
+ lastSuccessfulReadTime = startTime;
+ return data;
+ }
+
+
+ /**
+ * @return
+ * @throws Exception
+ */
+ private List realtimeSearch() throws Exception {
+ logger.debug("realtime search start");
+
+ Args queryArgs = new Args();
+ queryArgs.put("search_mode", "realtime");
+ Calendar startTime = Calendar.getInstance();
+ populateArgs(queryArgs, startTime, true);
+
+ List data = runQuery(queryArgs);
+ lastSuccessfulReadTime = startTime;
+ return data;
+ }
+
+ /**
+ * @throws Exception
+ *
+ */
+ private List exportSearch() throws Exception {
+ logger.debug("export start");
+ List result = new ArrayList();
+ HashMap data;
+ SplunkData splunkData;
+
+ Args queryArgs = new Args();
+ Calendar startTime = Calendar.getInstance();
+ populateArgs(queryArgs, startTime, false);
+ queryArgs.put("output_mode", "xml");
+
+ Connection connection = connectionFactory.getConnection();
+ try {
+ InputStream os = connection.getTarget().export(search, queryArgs);
+ ResultsReaderXml resultsReader = new ResultsReaderXml(os);
+ while ((data = resultsReader.getNextEvent()) != null) {
+ splunkData = new SplunkData(data);
+ result.add(splunkData);
+ }
+ return result;
+ } finally {
+ connection.close();
+ }
+ }
+
+
+ private List savedSearch() throws Exception {
+ logger.debug("saved search start");
+
+ Args queryArgs = new Args();
+ queryArgs.put("app", "search");
+ if (owner != null && owner.length() > 0) {
+ queryArgs.put("owner", owner);
+ }
+ if (app != null && app.length() > 0) {
+ queryArgs.put("app", app);
+ }
+
+ Calendar startTime = Calendar.getInstance();
+ Connection connection = connectionFactory.getConnection();
+ try {
+ SavedSearch search = null;
+ Job job = null;
+ String latestTime = getLatestTime(startTime, false);
+ String earliestTime = getEarliestTime(startTime, false);
+ SavedSearchCollection savedSearches = connection.getTarget().getSavedSearches(queryArgs);
+ for (SavedSearch s : savedSearches.values()) {
+ if (s.getName().equals(savedSearch)) {
+ search = s;
+ }
+ }
+ if (search != null) {
+ Map args = new HashMap();
+ args.put("force_dispatch", "true");
+ args.put("dispatch.earliest_time", earliestTime);
+ args.put("dispatch.latest_time", latestTime);
+ job = search.dispatch(args);
+ }
+ while (!job.isDone()) {
+ Thread.sleep(2000);
+ }
+ List data = extractData(job);
+ this.lastSuccessfulReadTime = startTime;
+ return data;
+ } finally {
+ connection.close();
+ }
+ }
+
+ private List extractData(Job job) throws Exception {
+ List result = new ArrayList();
+ HashMap data;
+ SplunkData splunkData;
+ ResultsReader resultsReader;
+ int total = job.getResultCount();
+
+ if (count == 0 || total < count) {
+ InputStream stream = null;
+ Args outputArgs = new Args();
+ outputArgs.put("output_mode", "xml");
+ stream = job.getResults(outputArgs);
+
+ resultsReader = new ResultsReaderXml(stream);
+ while ((data = resultsReader.getNextEvent()) != null) {
+ splunkData = new SplunkData(data);
+ result.add(splunkData);
+ }
+ }
+ else {
+ int offset = 0;
+ while (offset < total) {
+ InputStream stream = null;
+ Args outputArgs = new Args();
+ outputArgs.put("output_mode", "xml");
+ outputArgs.put("count", count);
+ outputArgs.put("offset", offset);
+ stream = job.getResults(outputArgs);
+ resultsReader = new ResultsReaderXml(stream);
+ while ((data = resultsReader.getNextEvent()) != null) {
+ splunkData = new SplunkData(data);
+ result.add(splunkData);
+ }
+ offset += count;
+ }
+ }
+ return result;
+ }
+
+ public void afterPropertiesSet() throws Exception {
+ Assert.notNull(initEarliestTime, "initial earliest time can not be null");
+ }
+
+
+
+}
\ No newline at end of file
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java
new file mode 100644
index 0000000..15a53fe
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java
@@ -0,0 +1,202 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Writer;
+import java.net.Socket;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.DataWriter;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.util.Assert;
+
+import com.splunk.Args;
+import com.splunk.Index;
+import com.splunk.Receiver;
+import com.splunk.Service;
+
+/**
+ * Data writer to write data into Splunk. There are 3 ways to write data:
+ * REST submit, TCP socket and HTTP stream.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkDataWriter implements DataWriter, InitializingBean {
+
+ private static final Log logger = LogFactory.getLog(SplunkDataWriter.class);
+
+ private ConnectionFactory connectionFactory;
+
+ private String sourceType;
+
+ private String source;
+
+ private String index;
+
+ private IngestType ingest = IngestType.stream; //tcp, stream, submit
+
+ private int tcpPort;
+
+ private String host;
+
+ private String hostRegex;
+
+ public SplunkDataWriter(ConnectionFactory f) {
+ this.connectionFactory = f;
+ }
+
+ public void write(SplunkData data) throws Exception {
+ logger.debug("write message to splunk:" + data);
+
+ Connection connection = connectionFactory.getConnection();
+ Service service = connection.getTarget();
+ Index indexObject = null;
+ Receiver receiver = null;
+ OutputStream ostream;
+ Socket socket;
+ Writer writer = null;
+
+ Args args = new Args();
+ if (sourceType != null) {
+ args.put("sourcetype", sourceType);
+ }
+ if (source != null) {
+ args.put("source", source);
+ }
+
+ if (host != null) {
+ args.put("host", host);
+ }
+
+ if (hostRegex != null) {
+ args.put("host_regex", hostRegex);
+ }
+
+ try {
+ if (index != null) {
+ indexObject = service.getIndexes().get(index);
+ }
+ else {
+ receiver = service.getReceiver();
+ }
+
+ if ((ingest.equals(IngestType.stream) || ingest.equals(IngestType.tcp))) {
+ if (ingest.equals("stream")) {
+ if (indexObject != null)
+ socket = indexObject.attach(args);
+ else
+ socket = receiver.attach(args);
+ }
+ else {
+ socket = service.open(tcpPort);
+ }
+ ostream = socket.getOutputStream();
+ writer = new OutputStreamWriter(ostream, "UTF8");
+ }
+
+ if ((ingest.equals(IngestType.stream) || ingest.equals(IngestType.tcp))) {
+ writer.write(data.toString());
+ writer.flush();
+ writer.close();
+ }
+ else {
+ if (index != null) {
+ indexObject.submit(args, data.toString());
+ }
+ else {
+ receiver.submit(args, data.toString());
+ }
+ }
+ } finally {
+ connection.close();
+ }
+
+ }
+
+
+ public void setSourceType(String sourceType) {
+ this.sourceType = sourceType;
+ }
+
+ public void setSource(String source) {
+ this.source = source;
+ }
+
+ public void setIndex(String index) {
+ this.index = index;
+ }
+
+ public void setIngest(IngestType ingest) {
+ this.ingest = ingest;
+ }
+
+ public void setTcpPort(int tcpPort) {
+ this.tcpPort = tcpPort;
+ }
+
+ public void setHost(String host) {
+ this.host = host;
+ }
+
+ public void setHostRegex(String hostRegex) {
+ this.hostRegex = hostRegex;
+ }
+
+
+ public String getSourceType() {
+ return sourceType;
+ }
+
+ public String getSource() {
+ return source;
+ }
+
+ public String getIndex() {
+ return index;
+ }
+
+ public IngestType getIngest() {
+ return ingest;
+ }
+
+ public int getTcpPort() {
+ return tcpPort;
+ }
+
+ public String getHost() {
+ return host;
+ }
+
+ public String getHostRegex() {
+ return hostRegex;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
+ */
+ public void afterPropertiesSet() throws Exception {
+ Assert.notNull(ingest, "You must specify ingest type");
+ }
+
+}
diff --git a/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java
new file mode 100644
index 0000000..0dd1b5d
--- /dev/null
+++ b/spring-integration-splunk/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2002-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.util.List;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.integration.Message;
+import org.springframework.integration.MessageHandlingException;
+import org.springframework.integration.MessagingException;
+import org.springframework.integration.splunk.core.DataReader;
+import org.springframework.integration.splunk.core.DataWriter;
+import org.springframework.integration.splunk.entity.SplunkData;
+
+/**
+ * Bundles common core logic for the Splunk components.
+ *
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkExecutor implements InitializingBean {
+
+ private static final Log logger = LogFactory.getLog(SplunkExecutor.class);
+
+ private DataReader reader;
+ private DataWriter writer;
+
+ public SplunkExecutor() {
+ }
+
+ /**
+ * Verifies and sets the parameters. E.g. initializes the to be used
+ */
+ public void afterPropertiesSet() {
+
+ }
+
+ /**
+ * Executes the outbound Splunk Operation.
+ *
+ */
+ public Object executeOutboundOperation(final Message message) {
+ try {
+ SplunkData payload = (SplunkData) message.getPayload();
+ writer.write(payload);
+ } catch (Exception e) {
+ String errorMsg = "error in writing data into Splunk";
+ logger.warn(errorMsg, e);
+ throw new MessageHandlingException(message, errorMsg, e);
+ }
+ return null;
+ }
+
+ public void handleMessage(final Message message) {
+ executeOutboundOperation(message);
+ }
+
+ /**
+ * Execute the Splunk operation.
+ */
+ public List poll() {
+ logger.debug("poll start:");
+ List queryData = null;
+ try {
+ queryData = reader.search();
+ } catch (Exception e) {
+ String errorMsg = "search Splunk data failed";
+ logger.warn(errorMsg, e);
+ throw new MessagingException(errorMsg, e);
+ }
+ return queryData;
+ }
+
+ public void setReader(DataReader reader) {
+ this.reader = reader;
+ }
+
+ public void setWriter(DataWriter writer) {
+ this.writer = writer;
+ }
+
+
+}
diff --git a/spring-integration-splunk/src/main/resources/META-INF/spring.handlers b/spring-integration-splunk/src/main/resources/META-INF/spring.handlers
new file mode 100644
index 0000000..4d4111e
--- /dev/null
+++ b/spring-integration-splunk/src/main/resources/META-INF/spring.handlers
@@ -0,0 +1 @@
+http\://www.springframework.org/schema/integration/splunk=org.springframework.integration.splunk.config.xml.SplunkNamespaceHandler
diff --git a/spring-integration-splunk/src/main/resources/META-INF/spring.schemas b/spring-integration-splunk/src/main/resources/META-INF/spring.schemas
new file mode 100644
index 0000000..cc8649e
--- /dev/null
+++ b/spring-integration-splunk/src/main/resources/META-INF/spring.schemas
@@ -0,0 +1,2 @@
+http\://www.springframework.org/schema/integration/splunk/spring-integration-splunk-1.0.xsd=org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
+http\://www.springframework.org/schema/integration/splunk/spring-integration-splunk.xsd=org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
diff --git a/spring-integration-splunk/src/main/resources/META-INF/spring.tooling b/spring-integration-splunk/src/main/resources/META-INF/spring.tooling
new file mode 100644
index 0000000..cf031eb
--- /dev/null
+++ b/spring-integration-splunk/src/main/resources/META-INF/spring.tooling
@@ -0,0 +1,4 @@
+# Tooling related information for the integration Splunk namespace
+http\://www.springframework.org/schema/integration/splunk@name=integration Splunk Namespace
+http\://www.springframework.org/schema/integration/splunk@prefix=int-splunk
+http\://www.springframework.org/schema/integration/splunk@icon=org/springframework/integration/splunk/config/xml/spring-integration-splunk.gif
diff --git a/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd b/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
new file mode 100644
index 0000000..c452f4f
--- /dev/null
+++ b/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
@@ -0,0 +1,364 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The definition for the Spring Integration Splunk
+ Inbound Channel Adapter.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Search mode: normal, blocking, realtime, export, saved
+
+
+
+
+
+
+ The maximum number of event record to be return
+
+
+
+
+
+
+ A comma-separated list of the fields to return
+
+
+
+
+
+
+ Search String following Splunk syntax.
+
+
+
+
+
+
+ Time modifier for the start of the time window.
+
+
+
+
+
+
+ Time modifier for the end of the time window.
+
+
+
+
+
+
+ Time modifier for the start of the time window for the first search.
+
+
+
+
+
+
+ Saved search.
+
+
+
+
+
+
+ Owner of the saved search.
+
+
+
+
+
+
+ App of the saved search.
+
+
+
+
+
+
+
+
+
+ Defines an outbound Channel Adapter.
+
+
+
+
+
+
+
+
+
+ Channel from which messages will be output.
+ When a message is sent to this channel it will
+ cause the query
+ to
+ be executed.
+
+
+
+
+
+
+
+
+
+ Specifies the order for invocation when this
+ endpoint is connected as a
+ subscriber to a SubscribableChannel.
+
+
+
+
+
+
+ Splunk event source
+
+
+
+
+
+
+ Splunk event source type
+
+
+
+
+
+
+ Splunk index name
+
+
+
+
+
+
+ Splunk ingest method: tcp, streaming, submit. Default stream.
+
+
+
+
+
+
+ Splunk ingest method: tcp, streaming, submit. Default stream.
+
+
+
+
+
+
+ Host where the event occurred
+
+
+
+
+
+
+ Host regex can be provided so Splunk can dynamically extract the host value from the log event
+
+
+
+
+
+
+
+
+
+
+ Identifies the underlying Spring bean definition,
+ which is an
+ instance of either 'EventDrivenConsumer' or
+ 'PollingConsumer',
+ depending on whether the component's input
+ channel is a
+ 'SubscribableChannel' or 'PollableChannel'.
+
+
+
+
+
+
+ Flag to indicate that the component should start
+ automatically
+ on startup (default true).
+
+
+
+
+
+
+
+
+ Splunk Server Bean Name
+
+
+
+
+
+
+ Whether pool the Splunk connection.
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk.gif b/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk.gif
new file mode 100644
index 0000000..41b369f
Binary files /dev/null and b/spring-integration-splunk/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk.gif differ
diff --git a/spring-integration-splunk/src/reference/docbook/history.xml b/spring-integration-splunk/src/reference/docbook/history.xml
new file mode 100644
index 0000000..d8fde4b
--- /dev/null
+++ b/spring-integration-splunk/src/reference/docbook/history.xml
@@ -0,0 +1,20 @@
+
+
+ Change History
+
+
+ Release
+ Date
+ Changes
+
+
+
+ 0.5.0
+ 2012.9.28
+ Initial release
+
+
+
+
diff --git a/spring-integration-splunk/src/reference/docbook/images/logo.png b/spring-integration-splunk/src/reference/docbook/images/logo.png
new file mode 100644
index 0000000..8c71c13
Binary files /dev/null and b/spring-integration-splunk/src/reference/docbook/images/logo.png differ
diff --git a/spring-integration-splunk/src/reference/docbook/index.xml b/spring-integration-splunk/src/reference/docbook/index.xml
new file mode 100644
index 0000000..516b920
--- /dev/null
+++ b/spring-integration-splunk/src/reference/docbook/index.xml
@@ -0,0 +1,64 @@
+
+
+
+ Spring Integration Splunk Adapter
+ Splunk Adapter ${version}
+ Spring Integration
+ ${version}
+
+
+
+
+
+
+
+
+
+
+
+ Jarred Li Mark Pollack Damien Dallimore
+
+ © SpringSource Inc., 2012
+
+
+
+
+ What's new?
+
+
+ If you are interested in the changes and features, that were introduced in
+ earlier versions, please take a look at chapter:
+
+
+
+
+
+
+ Integration Adapters
+
+
+ Spring Integration adapter for Splunk includes inbound channel adapter to
+ read data from Splunk and outbound channel adapter to write data into
+ Splunk.
+
+
+
+
+ Appendices
+
+
diff --git a/spring-integration-splunk/src/reference/docbook/resources.xml b/spring-integration-splunk/src/reference/docbook/resources.xml
new file mode 100644
index 0000000..c3ffb46
--- /dev/null
+++ b/spring-integration-splunk/src/reference/docbook/resources.xml
@@ -0,0 +1,27 @@
+
+
+ Additional Resources
+
+
+ Spring Integration Home
+
+ The definitive source of information about Spring Integration is the
+ Spring Integration Home at
+ http://www.springsource.org . That site serves as a hub of
+ information and is the best place to find up-to-date announcements about the project as well as links to
+ articles, blogs, and new sample applications.
+
+
+
+
+ Splunk Home
+
+ You can get more information on Splunk from Splunk Home .
+
+
+ Splunk SDK API is in Splunk Dev .
+
+
+
+
diff --git a/spring-integration-splunk/src/reference/docbook/splunk.xml b/spring-integration-splunk/src/reference/docbook/splunk.xml
new file mode 100644
index 0000000..10da20e
--- /dev/null
+++ b/spring-integration-splunk/src/reference/docbook/splunk.xml
@@ -0,0 +1,218 @@
+
+
+ Splunk Adapter
+
+ The Spring Integration Splunk Adapter provides outbound and inbound channel adapters:
+
+
+
+
+
+ Outbound Channel adapter
+
+
+
+
+
+
+ Inbound Channel Adapter
+
+
+
+
+
+
+ To use Spring Integration adapter for Splunk, you have to import the XML namespace. For example, you can
+ have following XML:
+
+
+
+
+ ]]>
+
+
+ Meanwhile, you have to define your Splunk server information. For example
+ you can define server as following:
+
+
+
+ ...
+ ]]>
+
+
+ Outbound Channel Adapter
+
+ Outbound channel adapter is used to put data into Splunk from
+ channels in Spring Integration.
+ There are 3 kinds of method to put data:
+
+
+
+ Submit (HTTP REST)
+ Stream
+ Tcp
+
+
+
+ The main difference between using the REST inputs vs plain TCP/UDP inputs is really
+ in the Splunk event handling pipeline.
+
+
+
+ With REST , you have to declare your event meta data (index, source, source type…)
+ in the HTTP request at the source. You can't really transform the log event anymore
+ after you have created and sent it to Splunk.Typically though, for people using REST,
+ this is fine because they are well formatting their log events before sending them
+ anyway ie: no further processing/transforming and manipulation is required.
+ You can however still do dynamic search time transforms/filtering on the
+ data when later searching over it in Splunk.
+
+
+ To use outbound channel adapter with submit, you can define the adapter as following:
+
+
+]]>
+
+
+ With TCP inputs , you can manipulate and transform the event data in Splunk before
+ it gets indexed (using entrys in props.conf/transforms.conf). The event meta data
+ (index, source, source type…) gets declared on the Splunk side when you establish
+ the TCP/UDP input and can also be dynamically created, so essentially you have
+ a lot more control over the indexing of the event data.This is generally more
+ important when you don't control the format of the data at the source and it needs
+ manipulating/filtering ie: network devices syslogging etc…
+
+
+
+ To use outbound channel adapter with tcp, you can define the adapter as following:
+
+
+]]>
+
+
+ To use outbound channel adapter with stream, you can define the adapter as following:
+
+
+
+]]>
+
+
+
+
+ Inbound Channel Adapter
+
+ Inbound channel adapter is used to get data out of Splunk and put
+ into Spring Integration's channel.
+ There are 5 ways to get data out of Splunk:
+
+
+
+ Blocking
+ Non blocking
+ Saved search
+ Realtime
+ Export
+
+
+
+ For more information on the difference, please refer
+ Splunk SDK
+
+
+
+ To use bloking inbound channel adapter, you can define the adapter as following:
+
+
+
+
+
+ To use non blocking inbound channel adapter, you can define the adapter as following:
+
+
+
+
+
+ To use saved search inbound channel adapter, you can define the adapter as following:
+
+
+
+
+
+ To use realtime search inbound channel adapter, you can define the adapter as following:
+
+
+
+
+ To use export inbound channel adapter, you can define the adapter as following:
+
+
+
+
+
+ As Splunk support range search, you can specify the search rage by using
+ "latestTime", "earliestTime", "initEarliestTime".
+
+
+ "initEarliestTime" is the value for "earliestTime" when the application first start.
+ If you specify "earliestTime" and "latestTime", the poller will only search data
+ in that range. Otherwise, the range will move forward as time goes. That means, the
+ "latestTime" is equal to the time where the polling trigger, the "earliestTime" is
+ equal to the time where the last polling is run.
+
+
+ You can get more information on the rage search from
+
+ Splunk .
+
+
+
diff --git a/spring-integration-splunk/src/reference/docbook/whats-new.xml b/spring-integration-splunk/src/reference/docbook/whats-new.xml
new file mode 100644
index 0000000..cd9d2cd
--- /dev/null
+++ b/spring-integration-splunk/src/reference/docbook/whats-new.xml
@@ -0,0 +1,17 @@
+
+
+ What's new?
+
+ The Spring Integration adapter for Splunk includes two adapters:
+
+
+
+ Inbound Channel Adapter to search data from Splunk.
+
+
+ Outbound Channel Adapter to push event data into Splunk.
+
+
+
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java
new file mode 100644
index 0000000..ba6756a
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.config.xml;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.endpoint.SourcePollingChannelAdapter;
+import org.springframework.integration.splunk.support.SearchMode;
+import org.springframework.integration.splunk.support.SplunkDataReader;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class SplunkInboundChannelAdapterParserSavedSearchTests {
+
+ @Autowired
+ private ApplicationContext appContext;
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.config.xml.SplunkInboundChannelAdapterParser#parseSource(org.w3c.dom.Element, org.springframework.beans.factory.xml.ParserContext)}.
+ */
+ @Test
+ public void testParseSourceElementParserContext() {
+ SourcePollingChannelAdapter adapter = appContext.getBean("splunkInboundChannelAdapter",
+ SourcePollingChannelAdapter.class);
+ Assert.assertNotNull(adapter);
+
+ SplunkDataReader reader = appContext.getBean("splunkInboundChannelAdapter.splunkExecutor.reader",
+ SplunkDataReader.class);
+ Assert.assertNotNull(reader);
+
+ SearchMode mode = SearchMode.saved;
+ Assert.assertEquals(mode, reader.getMode());
+
+ String savedSearch = "savedSearch";
+ Assert.assertEquals(savedSearch, reader.getSavedSearch());
+
+ String owner = "admin";
+ Assert.assertEquals(owner, reader.getOwner());
+
+ String app = "search";
+ Assert.assertEquals(app, reader.getApp());
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests.java
new file mode 100644
index 0000000..e3a8f8b
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.config.xml;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.endpoint.SourcePollingChannelAdapter;
+import org.springframework.integration.splunk.support.SearchMode;
+import org.springframework.integration.splunk.support.SplunkDataReader;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class SplunkInboundChannelAdapterParserTests {
+
+ @Autowired
+ private ApplicationContext appContext;
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.config.xml.SplunkInboundChannelAdapterParser#parseSource(org.w3c.dom.Element, org.springframework.beans.factory.xml.ParserContext)}.
+ */
+ @Test
+ //@Ignore
+ public void testParseSourceElementParserContext() {
+ SourcePollingChannelAdapter adapter = appContext.getBean("splunkInboundChannelAdapter",
+ SourcePollingChannelAdapter.class);
+ Assert.assertNotNull(adapter);
+ Assert.assertFalse(adapter.isAutoStartup());
+
+ SplunkDataReader reader = appContext.getBean("splunkInboundChannelAdapter.splunkExecutor.reader",
+ SplunkDataReader.class);
+ Assert.assertNotNull(reader);
+
+ String searchString = "search spring:example";
+ Assert.assertEquals(searchString, reader.getSearch());
+
+ SearchMode mode = SearchMode.blocking;
+ Assert.assertEquals(mode, reader.getMode());
+
+ String earliestTime = "-1d";
+ Assert.assertEquals(earliestTime, reader.getEarliestTime());
+
+ String latestTime = "now";
+ Assert.assertEquals(latestTime, reader.getLatestTime());
+
+ String initEarliestTime = "-1d";
+ Assert.assertEquals(initEarliestTime, reader.getInitEarliestTime());
+
+ String fieldList = "field1, field2";
+ Assert.assertEquals(fieldList, reader.getFieldList());
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java
new file mode 100644
index 0000000..5b70423
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.config.xml;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.splunk.support.IngestType;
+import org.springframework.integration.splunk.support.SplunkDataWriter;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class SplunkOutboundChannelAdapterParserStreamTests {
+
+ @Autowired
+ private ApplicationContext appContext;
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.config.xml.SplunkOutboundChannelAdapterParser#parseConsumer(org.w3c.dom.Element, org.springframework.beans.factory.xml.ParserContext)}.
+ */
+ @Test
+ public void testParseConsumerElementParserContext() {
+ Object adapter = appContext.getBean("splunkOutboundChannelAdapter");
+ Assert.assertNotNull(adapter);
+
+ SplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
+ SplunkDataWriter.class);
+ Assert.assertNotNull(writer);
+
+ IngestType ingest = IngestType.stream;
+ Assert.assertEquals(ingest, writer.getIngest());
+
+ String host = "test.host";
+ Assert.assertEquals(host, writer.getHost());
+
+ String hostRegex = "test.host.*";
+ Assert.assertEquals(hostRegex, writer.getHostRegex());
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java
new file mode 100644
index 0000000..99dd49b
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.config.xml;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.splunk.support.IngestType;
+import org.springframework.integration.splunk.support.SplunkDataWriter;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class SplunkOutboundChannelAdapterParserTests {
+
+ @Autowired
+ private ApplicationContext appContext;
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.config.xml.SplunkOutboundChannelAdapterParser#parseConsumer(org.w3c.dom.Element, org.springframework.beans.factory.xml.ParserContext)}.
+ */
+ @Test
+ public void testParseConsumerElementParserContext() {
+ Object adapter = appContext.getBean("splunkOutboundChannelAdapter");
+ Assert.assertNotNull(adapter);
+
+ SplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
+ SplunkDataWriter.class);
+ Assert.assertNotNull(writer);
+
+ String sourceType = "spring-integration";
+ Assert.assertEquals(sourceType, writer.getSourceType());
+
+ String source = "example5";
+ Assert.assertEquals(source, writer.getSource());
+
+ IngestType ingest = IngestType.submit;
+ Assert.assertEquals(ingest, writer.getIngest());
+
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java
new file mode 100644
index 0000000..50c26bf
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.config.xml;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.splunk.entity.SplunkServer;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class SplunkServerParserTests {
+
+ @Autowired
+ private ApplicationContext appContext;
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.config.xml.SplunkServerParser#doParse(org.w3c.dom.Element, org.springframework.beans.factory.xml.ParserContext, org.springframework.beans.factory.support.BeanDefinitionBuilder)}.
+ */
+ @Test
+ public void testDoParseElementParserContextBeanDefinitionBuilder() {
+ SplunkServer server = appContext.getBean("splunkServer", SplunkServer.class);
+
+ Assert.assertEquals("test.splunk.server", server.getHost());
+ Assert.assertEquals(8089, server.getPort());
+ Assert.assertEquals("admin", server.getUserName());
+ Assert.assertEquals("password", server.getPassword());
+ Assert.assertEquals("https", server.getScheme());
+ Assert.assertEquals("admin", server.getOwner());
+ Assert.assertEquals("search", server.getApp());
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java
new file mode 100644
index 0000000..b32b685
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.inbound;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import junit.framework.Assert;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.support.SplunkExecutor;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkPollingChannelAdapterTests {
+
+ private SplunkPollingChannelAdapter inboundAdapter;
+
+ private SplunkExecutor executor;
+
+ @Before
+ public void init() {
+ executor = mock(SplunkExecutor.class);
+ inboundAdapter = new SplunkPollingChannelAdapter(executor);
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.inbound.SplunkPollingChannelAdapter#receive()}.
+ */
+ @Test
+ public void testReceive() {
+ List data = new ArrayList();
+ SplunkData sd = new SplunkData("spring", "spring:example");
+ sd.setCommonDesc("description");
+ data.add(sd);
+ when(executor.poll()).thenReturn(data);
+
+ List received = inboundAdapter.receive().getPayload();
+ Assert.assertEquals(1, received.size());
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.inbound.SplunkPollingChannelAdapter#getComponentType()}.
+ */
+ @Test
+ public void testGetComponentType() {
+ Assert.assertEquals("splunk:inbound-channel-adapter", inboundAdapter.getComponentType());
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapterTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapterTests.java
new file mode 100644
index 0000000..dc4fbff
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/outbound/SplunkOutboundChannelAdapterTests.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.outbound;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import junit.framework.Assert;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.integration.Message;
+import org.springframework.integration.splunk.support.SplunkExecutor;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkOutboundChannelAdapterTests {
+
+ private SplunkOutboundChannelAdapter outboundAdapter;
+
+ private SplunkExecutor executor;
+
+ @Before
+ public void init() {
+ executor = mock(SplunkExecutor.class);
+ outboundAdapter = new SplunkOutboundChannelAdapter(executor);
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.outbound.SplunkOutboundChannelAdapter#handleRequestMessage(org.springframework.integration.Message)}.
+ */
+ @Test
+ public void testHandleRequestMessage() {
+ Message message = null;
+ when(executor.executeOutboundOperation(message)).thenReturn(null);
+
+ Object ret = outboundAdapter.handleRequestMessage(message);
+ Assert.assertNull(ret);
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.outbound.SplunkOutboundChannelAdapter#setProducesReply(boolean)}.
+ */
+ @Test
+ public void testSetProducesReply() {
+ outboundAdapter.setProducesReply(false);
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java
new file mode 100644
index 0000000..9036d79
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import junit.framework.Assert;
+
+import org.junit.Test;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.entity.SplunkServer;
+
+import com.splunk.Service;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class ConnectionFactoryFactoryBeanTests {
+
+ private ConnectionFactoryFactoryBean factoryBean;
+
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.ConnectionFactoryFactoryBean#ConnectionFactoryFactoryBean(org.springframework.integration.splunk.core.ConnectionFactory, boolean)}.
+ * @throws Exception
+ */
+ @Test
+ public void testConnectionFactoryFactoryBean() throws Exception {
+ SplunkServer server = new SplunkServer();
+ SplunkConnectionFactory factory = new SplunkConnectionFactory(server);
+ factoryBean = new ConnectionFactoryFactoryBean(factory, false);
+
+ ConnectionFactory generatedByFactoryBean = factoryBean.getObject();
+ Assert.assertTrue(generatedByFactoryBean instanceof SplunkConnectionFactory);
+
+ }
+
+ @Test
+ public void testConnectionFactoryFactoryBean_withPoll() throws Exception {
+ SplunkServer server = new SplunkServer();
+ SplunkConnectionFactory factory = new SplunkConnectionFactory(server);
+ factoryBean = new ConnectionFactoryFactoryBean(factory, true);
+
+ ConnectionFactory generatedByFactoryBean = factoryBean.getObject();
+ Assert.assertTrue(generatedByFactoryBean instanceof PoolingConnectionFactory);
+
+ }
+
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.ConnectionFactoryFactoryBean#getObjectType()}.
+ */
+ @Test
+ public void testGetObjectType() {
+ SplunkServer server = new SplunkServer();
+ SplunkConnectionFactory factory = new SplunkConnectionFactory(server);
+ factoryBean = new ConnectionFactoryFactoryBean(factory, true);
+
+ Class clazz = factoryBean.getObjectType();
+ Assert.assertEquals(PoolingConnectionFactory.class, clazz);
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.ConnectionFactoryFactoryBean#isSingleton()}.
+ */
+ @Test
+ public void testIsSingleton() {
+ SplunkServer server = new SplunkServer();
+ SplunkConnectionFactory factory = new SplunkConnectionFactory(server);
+ factoryBean = new ConnectionFactoryFactoryBean(factory, false);
+
+ Assert.assertTrue(factoryBean.isSingleton());
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/PoolingConnectionFactoryTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/PoolingConnectionFactoryTests.java
new file mode 100644
index 0000000..328be7e
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/PoolingConnectionFactoryTests.java
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import static org.junit.Assert.fail;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import junit.framework.Assert;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class PoolingConnectionFactoryTests {
+
+ private ConnectionFactory conFactory;
+
+ private PoolingConnectionFactory poolConFactory;
+
+ @SuppressWarnings("unchecked")
+ @Before
+ public void before() {
+ conFactory = mock(ConnectionFactory.class);
+ poolConFactory = new PoolingConnectionFactory(conFactory);
+ }
+
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.PoolingConnectionFactory#getConnection()}.
+ * @throws Exception
+ */
+ @Test
+ public void testGetConnection() throws Exception {
+ @SuppressWarnings("unchecked")
+ Connection con = mock(Connection.class);
+
+ when(con.getTarget()).thenReturn(new TestEntity("entity1"));
+ when(conFactory.getConnection()).thenReturn(con);
+ Connection returnCon = poolConFactory.getConnection();
+ TestEntity obj1 = returnCon.getTarget();
+ Assert.assertNotNull(obj1);
+ Assert.assertEquals("entity1", obj1.getName());
+
+ when(con.getTarget()).thenReturn(new TestEntity("entity2"));
+ when(conFactory.getConnection()).thenReturn(con);
+ returnCon = poolConFactory.getConnection();
+ TestEntity obj2 = returnCon.getTarget();
+ Assert.assertNotNull(obj2);
+ Assert.assertEquals("entity2", obj2.getName());
+
+ when(con.getTarget()).thenReturn(new TestEntity("entity3"));
+ when(conFactory.getConnection()).thenReturn(con);
+ returnCon = poolConFactory.getConnection();
+ TestEntity obj3 = returnCon.getTarget();
+ Assert.assertNotNull(obj3);
+ Assert.assertEquals("entity3", obj3.getName());
+
+
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.PoolingConnectionFactory#destroy()}.
+ * @throws Exception
+ */
+ @Test(expected = IllegalStateException.class)
+ public void testDestroy() throws Exception {
+ try {
+ poolConFactory.destroy();
+ } catch (Exception e) {
+ fail("exception when destoying pool connection factory");
+ }
+ poolConFactory.getConnection();
+ }
+
+ public static class TestEntity {
+ private String name;
+
+ public TestEntity(String n) {
+ this.name = n;
+ }
+
+ public String getName() {
+ return name;
+ }
+
+ public void setName(String name) {
+ this.name = name;
+ }
+ }
+
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java
new file mode 100644
index 0000000..7fcde9e
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import static org.mockito.Matchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+
+import junit.framework.Assert;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.entity.SplunkData;
+
+import com.splunk.Job;
+import com.splunk.JobCollection;
+import com.splunk.Service;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkDataReaderTests {
+
+ private SplunkDataReader reader;
+
+ @Before
+ public void before() {
+ reader = new SplunkDataReader(new TestConnectioniFactory());
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.SplunkDataReader#search()}.
+ * @throws Exception
+ */
+ @Test
+ public void testBlockingSearch() throws Exception {
+ reader.setMode(SearchMode.blocking);
+ reader.setSearch("search spring:example");
+ List data = reader.search();
+ Assert.assertNotNull(data);
+ Assert.assertEquals(5, data.size());
+ }
+
+ @Test
+ public void testNonBlockingSearch() throws Exception {
+ reader.setMode(SearchMode.normal);
+ reader.setSearch("search spring:example");
+ List data = reader.search();
+ Assert.assertNotNull(data);
+ Assert.assertEquals(5, data.size());
+ }
+
+
+ @Test
+ public void testRealtimeSearch() throws Exception {
+ reader.setMode(SearchMode.realtime);
+ reader.setSearch("search spring:example");
+ List data = reader.search();
+ Assert.assertNotNull(data);
+ Assert.assertEquals(5, data.size());
+ }
+
+ public static class TestConnectioniFactory implements ConnectionFactory {
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.ConnectionFactory#getConnection()
+ */
+ public Connection getConnection() throws Exception {
+ return new TestConnection();
+ }
+ }
+
+ public static class TestConnection implements Connection {
+
+ private Service service = mock(Service.class);
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#getTarget()
+ */
+ public Service getTarget() {
+ InputStream is = null;
+
+ try {
+ is = new ClassPathResource("splunk-data.xml").getInputStream();
+ } catch (FileNotFoundException e) {
+ Assert.fail("can not read splunk data file");
+ } catch (IOException e) {
+ Assert.fail("can not read splunk data file");
+ }
+
+
+ service.setToken("token");
+ JobCollection jobCollection = mock(JobCollection.class);
+ Job blockingJob = mock(Job.class);
+ when(blockingJob.isDone()).thenReturn(true);
+ when(blockingJob.getResultCount()).thenReturn(5);
+ when(blockingJob.getResults(any(Map.class))).thenReturn(is);
+ when(jobCollection.create(any(String.class), any(Map.class))).thenReturn(blockingJob);
+ when(service.getJobs()).thenReturn(jobCollection);
+ return service;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#close()
+ */
+ public void close() {
+
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#isOpen()
+ */
+ public boolean isOpen() {
+ return true;
+ }
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java
new file mode 100644
index 0000000..7fea6b8
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import static org.mockito.Matchers.*;
+import static org.mockito.Mockito.*;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.entity.SplunkData;
+
+import com.splunk.Args;
+import com.splunk.Receiver;
+import com.splunk.Service;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkDataWriterTests {
+
+ private SplunkDataWriter writer;
+
+ private static Receiver receiver = mock(Receiver.class);
+
+ @Before
+ public void before() {
+ writer = new SplunkDataWriter(new TestConnectioniFactory());
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.SplunkDataWriter#write(org.springframework.integration.splunk.entity.SplunkData)}.
+ * @throws Exception
+ */
+ @Test
+ public void testWrite() throws Exception {
+ writer.setIngest(IngestType.submit);
+
+ SplunkData sd = new SplunkData("spring", "spring:example");
+ sd.setCommonDesc("description");
+ writer.write(sd);
+ Args args = new Args();
+ verify(receiver).submit(eq(args), matches(".*spring:example.*"));
+ }
+
+ public static class TestConnectioniFactory implements ConnectionFactory {
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.ConnectionFactory#getConnection()
+ */
+ public Connection getConnection() throws Exception {
+ return new TestConnection();
+ }
+ }
+
+ public static class TestConnection implements Connection {
+
+ private Service service = mock(Service.class);
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#getTarget()
+ */
+ public Service getTarget() {
+ service.setToken("token");
+ when(service.getReceiver()).thenReturn(receiver);
+ return service;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#close()
+ */
+ public void close() {
+
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.core.Connection#isOpen()
+ */
+ public boolean isOpen() {
+ return true;
+ }
+
+ }
+}
diff --git a/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java
new file mode 100644
index 0000000..9163964
--- /dev/null
+++ b/spring-integration-splunk/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import junit.framework.Assert;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.integration.Message;
+import org.springframework.integration.splunk.core.DataReader;
+import org.springframework.integration.splunk.core.DataWriter;
+import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.support.MessageBuilder;
+
+/**
+ * @author Jarred Li
+ * @since 1.0
+ *
+ */
+public class SplunkExecutorTests {
+
+ private SplunkExecutor executor;
+
+ private DataReader reader = mock(DataReader.class);
+
+ private DataWriter writer = mock(DataWriter.class);
+
+ @Before
+ public void before() {
+ executor = new SplunkExecutor();
+ executor.setReader(reader);
+ executor.setWriter(writer);
+ }
+
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.SplunkExecutor#handleMessage(org.springframework.integration.Message)}.
+ * @throws Exception
+ */
+ @Test
+ public void testHandleMessage() throws Exception {
+ SplunkData sd = new SplunkData("spring", "spring:example");
+ sd.setCommonDesc("description");
+ Message message = MessageBuilder.withPayload(sd).build();
+ executor.handleMessage(message);
+ verify(writer).write(sd);
+ }
+
+ /**
+ * Test method for {@link org.springframework.integration.splunk.support.SplunkExecutor#poll()}.
+ * @throws Exception
+ */
+ @Test
+ public void testPoll() throws Exception {
+ List data = new ArrayList();
+ SplunkData sd = new SplunkData("spring", "spring:example");
+ sd.setCommonDesc("description");
+ data.add(sd);
+
+ sd = new SplunkData("spring", "spring:example");
+ sd.setCommonDesc("description");
+ data.add(sd);
+ when(reader.search()).thenReturn(data);
+
+ List result = executor.poll();
+ Assert.assertEquals(2, result.size());
+
+ }
+
+}
diff --git a/spring-integration-splunk/src/test/resources/log4j.properties b/spring-integration-splunk/src/test/resources/log4j.properties
new file mode 100644
index 0000000..6142a0d
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/log4j.properties
@@ -0,0 +1,5 @@
+log4j.rootCategory=INFO, stdout
+
+log4j.appender.stdout=org.apache.log4j.ConsoleAppender
+log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
+log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss.SSS} %-5p [%t][%c] %m%n
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml
new file mode 100644
index 0000000..4cdbdf3
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml
@@ -0,0 +1,19 @@
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserCommon-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserCommon-context.xml
new file mode 100644
index 0000000..7bf4b88
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserCommon-context.xml
@@ -0,0 +1,21 @@
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml
new file mode 100644
index 0000000..8a0ab3f
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml
@@ -0,0 +1,25 @@
+
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml
new file mode 100644
index 0000000..0bd2da1
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml
new file mode 100644
index 0000000..3462ff6
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml
new file mode 100644
index 0000000..57ec361
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml
new file mode 100644
index 0000000..e263634
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml
@@ -0,0 +1,17 @@
+
+
+
+
diff --git a/spring-integration-splunk/src/test/resources/splunk-data.xml b/spring-integration-splunk/src/test/resources/splunk-data.xml
new file mode 100644
index 0000000..c492d7e
--- /dev/null
+++ b/spring-integration-splunk/src/test/resources/splunk-data.xml
@@ -0,0 +1,236 @@
+
+
+
+
+_cd
+_indextime
+_raw
+_serial
+_si
+_sourcetype
+_subsecond
+_time
+host
+index
+linecount
+source
+sourcetype
+splunk_server
+
+
+
+
+ 9:30
+
+ 1348478076
+ 2012-09-24 17:19:43:792+0800 name="spring" event_id="spring:example " desc="description"
+ 0
+
+ jarred-virtual-machine main
+
+ spring-integration
+
+ .792
+
+ 2012-09-24T17:19:43.792+08:00
+
+ test.host
+
+ main
+
+ 1
+
+ example5
+
+ spring-integration
+
+ jarred-virtual-machine
+
+
+
+ 9:26
+
+ 1348478076
+ 2012-09-24 17:19:43:756+0800 name="spring" event_id="spring:example " desc="description"
+ 1
+
+ jarred-virtual-machine main
+
+ spring-integration
+
+ .756
+
+ 2012-09-24T17:19:43.756+08:00
+
+ test.host
+
+ main
+
+ 1
+
+ example5
+
+ spring-integration
+
+ jarred-virtual-machine
+
+
+
+ 9:21
+
+ 1348464748
+ 2012-09-24 13:37:34:860+0800 name="spring" event_id="spring:example " desc="description"
+ 2
+
+ jarred-virtual-machine main
+
+ spring-integration
+
+ .860
+
+ 2012-09-24T13:37:34.860+08:00
+
+ test.host
+
+ main
+
+ 1
+
+ example5
+
+ spring-integration
+
+ jarred-virtual-machine
+
+
+
+ 9:17
+
+ 1348464748
+ 2012-09-24 13:37:34:789+0800 name="spring" event_id="spring:example " desc="description"
+ 3
+
+ jarred-virtual-machine main
+
+ spring-integration
+
+ .789
+
+ 2012-09-24T13:37:34.789+08:00
+
+ test.host
+
+ main
+
+ 1
+
+ example5
+
+ spring-integration
+
+ jarred-virtual-machine
+
+
+
+ 9:12
+
+ 1348464606
+ 2012-09-24 13:35:13:621+0800 name="spring" event_id="spring:example " desc="description"
+ 4
+
+ jarred-virtual-machine main
+
+ spring-integration
+
+ .621
+
+ 2012-09-24T13:35:13.621+08:00
+
+ test.host
+
+ main
+
+ 1
+
+ example5
+
+ spring-integration
+
+ jarred-virtual-machine
+
+
\ No newline at end of file