<s> import sys , os <EOL> sys . path . insert ( <NUM_LIT:0> , os . path . join ( os . path . dirname ( __file__ ) , "<STR_LIT:..>" , "<STR_LIT:..>" ) ) <EOL> import splunklib . client as client <EOL> import splunklib . results as results <EOL> try : <EOL> import utils <EOL> except ImportError : <EOL> raise Exception ( "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> __all__ = [ <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" <EOL> ] <EOL> ANALYTICS_INDEX_NAME = "<STR_LIT>" <EOL> ANALYTICS_SOURCETYPE = "<STR_LIT>" <EOL> APPLICATION_KEY = "<STR_LIT>" <EOL> EVENT_KEY = "<STR_LIT>" <EOL> DISTINCT_KEY = "<STR_LIT>" <EOL> EVENT_TERMINATOR = "<STR_LIT>" <EOL> PROPERTY_PREFIX = "<STR_LIT>" <EOL> class TimeRange : <EOL> DAY = "<STR_LIT>" <EOL> WEEK = "<STR_LIT>" <EOL> MONTH = "<STR_LIT>" <EOL> def counts ( job , result_key ) : <EOL> applications = [ ] <EOL> reader = results . ResultsReader ( job . results ( ) ) <EOL> for result in reader : <EOL> if isinstance ( result , dict ) : <EOL> applications . append ( { <EOL> "<STR_LIT:name>" : result [ result_key ] , <EOL> "<STR_LIT:count>" : int ( result [ "<STR_LIT:count>" ] or <NUM_LIT:0> ) <EOL> } ) <EOL> return applications <EOL> class AnalyticsRetriever : <EOL> def __init__ ( self , application_name , splunk_info , index = ANALYTICS_INDEX_NAME ) : <EOL> self . application_name = application_name <EOL> self . splunk = client . connect ( ** splunk_info ) <EOL> self . index = index <EOL> def applications ( self ) : <EOL> query = "<STR_LIT>" % ( self . index ) <EOL> job = self . splunk . jobs . create ( query , exec_mode = "<STR_LIT>" ) <EOL> return counts ( job , "<STR_LIT>" ) <EOL> def events ( self ) : <EOL> query = "<STR_LIT>" % ( self . index , self . application_name ) <EOL> job = self . splunk . jobs . create ( query , exec_mode = "<STR_LIT>" ) <EOL> return counts ( job , "<STR_LIT>" ) <EOL> def properties ( self , event_name ) : <EOL> query = '<STR_LIT>' % ( <EOL> self . index , self . application_name , event_name , PROPERTY_PREFIX <EOL> ) <EOL> job = self . splunk . jobs . create ( query , exec_mode = "<STR_LIT>" ) <EOL> properties = [ ] <EOL> reader = results . ResultsReader ( job . results ( ) ) <EOL> for result in reader : <EOL> if not isinstance ( result , dict ) : <EOL> continue <EOL> for field , count in result . iteritems ( ) : <EOL> if field . startswith ( "<STR_LIT:$>" ) : <EOL> continue <EOL> properties . append ( { <EOL> "<STR_LIT:name>" : field , <EOL> "<STR_LIT:count>" : int ( count or <NUM_LIT:0> ) <EOL> } ) <EOL> return properties <EOL> def property_values ( self , event_name , property ) : <EOL> query = '<STR_LIT>' % ( <EOL> self . index , self . application_name , event_name , <EOL> PROPERTY_PREFIX + property , <EOL> PROPERTY_PREFIX + property , property <EOL> ) <EOL> job = self . splunk . jobs . create ( query , exec_mode = "<STR_LIT>" ) <EOL> values = [ ] <EOL> reader = results . ResultsReader ( job . results ( ) ) <EOL> for result in reader : <EOL> if isinstance ( result , dict ) : <EOL> if result [ property ] : <EOL> values . append ( { <EOL> "<STR_LIT:name>" : result [ property ] , <EOL> "<STR_LIT:count>" : int ( result [ "<STR_LIT:count>" ] or <NUM_LIT:0> ) <EOL> } ) <EOL> return values <EOL> def events_over_time ( self , event_name = "<STR_LIT>" , time_range = TimeRange . MONTH , property = "<STR_LIT>" ) : <EOL> query = '<STR_LIT>' % ( <EOL> self . index , self . application_name , ( event_name or "<STR_LIT:*>" ) , <EOL> time_range , <EOL> ( PROPERTY_PREFIX + property ) if property else "<STR_LIT>" , <EOL> ) <EOL> job = self . splunk . jobs . create ( query , exec_mode = "<STR_LIT>" ) <EOL> over_time = { } <EOL> reader = results . ResultsReader ( job . results ( ) ) <EOL> for result in reader : <EOL> if isinstance ( result , dict ) : <EOL> time = result [ "<STR_LIT>" ] <EOL> del result [ "<STR_LIT>" ] <EOL> for key , count in result . iteritems ( ) : <EOL> if key . startswith ( "<STR_LIT:$>" ) : <EOL> continue <EOL> entry = over_time . get ( key , [ ] ) <EOL> entry . append ( { <EOL> "<STR_LIT:count>" : int ( count or <NUM_LIT:0> ) , <EOL> "<STR_LIT:time>" : time , <EOL> } ) <EOL> over_time [ key ] = entry <EOL> return over_time <EOL> def main ( ) : <EOL> usage = "<STR_LIT>" <EOL> argv = sys . argv [ <NUM_LIT:1> : ] <EOL> opts = utils . parse ( argv , { } , "<STR_LIT>" , usage = usage ) <EOL> retriever = AnalyticsRetriever ( opts . args [ <NUM_LIT:0> ] , opts . kwargs ) <EOL> if __name__ == "<STR_LIT:__main__>" : <EOL> main ( ) </s>
