run_main

    Search Splunk

def run_main():
    """run_main

    Search Splunk
    """

    parser = argparse.ArgumentParser(
        description=(
            'Search Splunk'))
    parser.add_argument(
        '-u',
        help='username',
        required=False,
        dest='user')
    parser.add_argument(
        '-p',
        help='user password',
        required=False,
        dest='password')
    parser.add_argument(
        '-f',
        help='splunk-ready request in a json file',
        required=False,
        dest='datafile')
    parser.add_argument(
        '-i',
        help='index to search',
        required=False,
        dest='index_name')
    parser.add_argument(
        '-a',
        help='host address: <fqdn:port>',
        required=False,
        dest='address')
    parser.add_argument(
        '-e',
        help='(Optional) earliest_time minutes back',
        required=False,
        dest='earliest_time_minutes')
    parser.add_argument(
        '-l',
        help='(Optional) latest_time minutes back',
        required=False,
        dest='latest_time_minutes')
    parser.add_argument(
        '-q',
        '--queryargs',
        nargs='*',
        help=(
            'query string for searching splunk: '
            'search index="antinex" AND levelname="ERROR"'),
        required=False,
        dest='query_args')
    parser.add_argument(
        '-j',
        help='(Optional) view as json dictionary logs',
        required=False,
        dest='json_view',
        action='store_true')
    parser.add_argument(
        '-t',
        help=(
            '(Optional) pre-existing Splunk token '
            'which can be set using export '
            'SPLUNK_TOKEN=<token>  - if provided '
            'the user (-u) and password (-p) '
            'arguments are not required'),
        required=False,
        dest='token')
    parser.add_argument(
        '-m',
        help='(Optional) verbose message when getting logs',
        required=False,
        dest='message_details',
        action='store_true')
    parser.add_argument(
        '-v',
        help='(Optional) verify certs - disabled by default',
        required=False,
        dest='verify',
        action='store_true')
    parser.add_argument(
        '-b',
        help='verbose',
        required=False,
        dest='verbose',
        action='store_true')
    args = parser.parse_args()

    user = SPLUNK_USER
    password = SPLUNK_PASSWORD
    token = SPLUNK_TOKEN
    address = SPLUNK_API_ADDRESS
    index_name = SPLUNK_INDEX
    verbose = SPLUNK_VERBOSE
    show_message_details = bool(str(ev(
        'MESSAGE_DETAILS',
        '0')).lower() == '1')
    earliest_time_minutes = None
    latest_time_minutes = None
    verify = False
    code_view = True
    json_view = False
    datafile = None

    if args.user:
        user = args.user
    if args.password:
        password = args.password
    if args.address:
        address = args.address
    if args.datafile:
        datafile = args.datafile
    if args.index_name:
        index_name = args.index_name
    if args.verify:
        verify = args.verify
    if args.earliest_time_minutes:
        earliest_time_minutes = int(args.earliest_time_minutes)
    if args.latest_time_minutes:
        latest_time_minutes = int(args.latest_time_minutes)
    if args.verbose:
        verbose = True
    if args.message_details:
        show_message_details = args.message_details
    if args.token:
        token = args.token
    if args.json_view:
        json_view = True
        code_view = False

    default_search_query = 'index="{}" | head 10 | reverse'.format(
        index_name)
    search_query = ev(
        'SPLUNK_QUERY',
        default_search_query)
    if args.query_args:
        search_query = ' '.join(
            args.query_args)

    valid = True
    if not user or user == 'user-not-set':
        log.critical('missing user')
        valid = False
    if not password or password == 'password-not-set':
        log.critical('missing password')
        valid = False
    if not index_name:
        log.critical('missing splunk index')
        valid = False
    if token:
        # if the token is present,
        # then the user and the password are not required
        if not valid and index_name:
            valid = True
    if not valid:
        log.critical(
            'Please run with the following arguments:\n')
        log.error(
            '-u <username> -p <password> '
            '-i <index> -t <token if user and password not set> '
            '-a <host address as: fqdn:port>')
        log.critical(
            '\n'
            'Or you can export the following '
            'environment variables and retry the command: '
            '\n')
        log.error(
            'export SPLUNK_ADDRESS="splunkenterprise:8088"\n'
            'export SPLUNK_API_ADDRESS="splunkenterprise:8089"\n'
            'export SPLUNK_PASSWORD="123321"\n'
            'export SPLUNK_USER="trex"\n'
            'export SPLUNK_INDEX="antinex"\n'
            'export SPLUNK_TOKEN="<Optional pre-existing Splunk token>"\n')
        sys.exit(1)

    if verbose:
        log.info((
            'creating client user={} address={}').format(
                user,
                address))

    last_msg = ''
    host = ''
    port = -1
    try:
        last_msg = (
            'Invalid address={}').format(
                address)
        address_split = address.split(':')
        last_msg = (
            'Failed finding host in address={} '
            '- please use: -a <fqdn:port>').format(
                address)
        host = address_split[0]
        last_msg = (
            'Failed finding integer port in address={} '
            '- please use: -a <fqdn:port>').format(
                address)
        port = int(address_split[1])
    except Exception as e:
        log.error((
            'Failed to parse -a {} for the '
            'splunk host address: {} which threw an '
            'ex={}').format(
                address,
                last_msg,
                e))
        sys.exit(1)
    # end of try ex

    if verbose:
        log.info((
            'connecting {}@{}:{}').format(
                user,
                host,
                port))

    req_body = None
    if datafile:
        if verbose:
            log.info((
                'loading request in datafile={}').format(
                    datafile))

        with open(datafile, 'r') as f:
            req_body = json.loads(f.read())

    earliest_time = None
    latest_time = None
    now = datetime.datetime.now()
    if earliest_time_minutes:
        min_15_ago = now - datetime.timedelta(
            minutes=earliest_time_minutes)
        earliest_time = min_15_ago.strftime(
            '%Y-%m-%dT%H:%M:%S.000-00:00')
    if latest_time_minutes:
        latest_time = (now - datetime.timedelta(
            minutes=latest_time_minutes)).strftime(
                '%Y-%m-%dT%H:%M:%S.000-00:00')

    # Step 2: Create a search job
    if not search_query.startswith('search'):
        search_query = 'search {}'.format(
            search_query)

    search_data = req_body
    if not search_data:
        search_data = {
            'search': search_query
        }
        if earliest_time:
            search_data['earliest_time'] = earliest_time
        if latest_time:
            search_data['latest_time'] = latest_time

    res = sp.search(
        user=user,
        password=password,
        address=address,
        token=token,
        query_dict=search_data,
        verify=verify)

    if res['status'] == SUCCESS:
        result_list = []
        try:
            result_list = res['record'].get(
                'results',
                result_list)
            if len(result_list) == 0:
                log.info((
                    'No matches for search={} '
                    'response={}').format(
                        ppj(search_data),
                        ppj(res['record'])))
        except Exception as e:
            result_list = []
            log.error((
                'Failed to find results for the query={} '
                'with ex={}').format(
                    ppj(search_data),
                    e))

        for ridx, log_record in enumerate(result_list):
            log_raw = log_record.get(
                '_raw',
                None)
            if log_raw:
                show_search_results(
                    log_rec=log_raw,
                    code_view=code_view,
                    json_view=json_view,
                    show_message_details=show_message_details)
            else:
                show_non_search_results(
                    log_rec=log_record,
                    code_view=code_view,
                    json_view=json_view,
                    show_message_details=show_message_details)
            # end of handling log record presentation as a view
        # end for all log records
    else:
        log.error((
            'Failed searching splunk with status={} and '
            'error: {}').format(
                res['status'],
                res['err']))
    # end of if job_id

    if verbose:
        log.info('done')