Skip to content

Commit 8844d30

Browse files
author
David Noble
committed
DVPL-3421: splunklib.searchcommands | Support configuring search-assistant via searchbnf.conf
plus documentation update for examples/searchcommands_app. In a future release we will generate the searchbnf.conf file from source comments. Signed-off-by: David Noble <dnoble@splunk.com>
1 parent 09e9eab commit 8844d30

File tree

5 files changed

+99
-31
lines changed

5 files changed

+99
-31
lines changed

examples/searchcommands_app/bin/countmatches.py

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ class CountMatchesCommand(StreamingCommand):
2727
2828
##Syntax
2929
30-
countmatches fieldname=**<field-name>** pattern=**<regular-expression>**
31-
**<field-name>**...
30+
.. code-block::
31+
countmatches fieldname=<field> pattern=<regular_expression> <field-list>
3232
3333
##Description
3434
@@ -39,14 +39,14 @@ class CountMatchesCommand(StreamingCommand):
3939
Event records are otherwise passed through to the next pipeline processor
4040
unmodified.
4141
42-
## Example
42+
##Example
4343
44-
```
45-
| inputcsv tweets.csv | countmatches fieldname=word_count pattern="\\w+" text
46-
```
44+
Count the number of words in the `text` of each tweet in tweets.csv and
45+
store the result in `word_count`.
4746
48-
Counts the number of words in `some_text_field` and stores the result in
49-
`word_count`.
47+
.. code-block::
48+
| inputcsv tweets.csv | countmatches fieldname=word_count
49+
pattern="\\w+" text
5050
5151
"""
5252
fieldname = Option(

examples/searchcommands_app/bin/simulate.py

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -30,31 +30,32 @@ class SimulateCommand(GeneratingCommand):
3030
3131
##Syntax
3232
33-
simulate csv=<path> rate=<expected-event-count> interval=<sampling-period>
34-
duration=<execution-period> [seed=<string>]
33+
.. code-block::
34+
simulate csv=<path> rate=<expected_event_count>
35+
interval=<sampling_period> duration=<execution_period> [seed=<string>]
3536
3637
##Description
3738
38-
The `simulate` command uses repeated random samples of the event records
39-
in `csv` for the execution period of `duration`. Samples sizes are
40-
determined for each time `interval` in `duration` using a Poisson
41-
distribution with an average `rate` specifying the expected event count
42-
during `interval`.
39+
The :code:`simulate` command uses repeated random samples of the event
40+
records in :code:`csv` for the execution period of :code:`duration`. Sample
41+
sizes are determined for each time :code:`interval` in :code:`duration`
42+
using a Poisson distribution with an average :code:`rate` specifying the
43+
expected event count during :code:`interval`.
4344
4445
##Example
4546
46-
```
47-
| simulate csv=population.csv rate=50 interval=00:00:01 duration=00:00:01 |
48-
countmatches fieldname=word_count pattern="\\w+" text |
49-
stats mean(word_count) stdev(word_count)
50-
```
47+
.. code-block::
48+
| simulate csv=population.csv rate=50 interval=00:00:01
49+
duration=00:00:05 | countmatches fieldname=word_count
50+
pattern="\\w+" text | stats mean(word_count) stdev(word_count)
5151
5252
This example generates events drawn from repeated random sampling of events
53-
from `tweets.csv`. Events are drawn at an average rate of 200 events per
54-
second for a duration of 30 seconds. Events are piped to the example
55-
`countmatches` command which adds a `word_count` field containing the number
56-
of words in the `text` field of each event. The mean and standard deviation
57-
of the `word_count` are then computed by the builtin `stats` command.
53+
from :code:`tweets.csv`. Events are drawn at an average rate of 50 per
54+
second for a duration of 5 seconds. Events are piped to the example
55+
:code:`countmatches` command which adds a :code:`word_count` field
56+
containing the number of words in the :code:`text` field of each event. The
57+
mean and standard deviation of the :code:`word_count` are then computed by
58+
the builtin :code:`stats` command.
5859
5960
6061
"""

examples/searchcommands_app/bin/sum.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,12 @@
2222

2323
@Configuration(clear_required_fields=True, requires_preop=True)
2424
class SumCommand(ReportingCommand):
25-
""" Computes the sum of a set of fields
25+
""" Computes the sum of a set of fields.
2626
2727
##Syntax
2828
29-
sum total=*<fieldname>* [*<fieldname>*]...
29+
.. code-block::
30+
sum total=<field> <field-list>
3031
3132
##Description:
3233
@@ -35,12 +36,11 @@ class SumCommand(ReportingCommand):
3536
3637
##Example
3738
38-
```
39-
index = _internal | head 200 | sum total=lines linecount
40-
```
39+
..code-block::
40+
index = _internal | head 200 | sum total=lines linecount
4141
4242
This example computes the total linecount in the first 200 records in the
43-
_internal index.
43+
:code:`_internal index`.
4444
4545
"""
4646
total = Option(

examples/searchcommands_app/default/commands.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,22 @@
55
filename = countmatches.py
66
supports_getinfo = true
77
supports_rawargs = true
8+
89
outputheader = true
10+
requires_srinfo = true
911

1012
[simulate]
1113
filename = simulate.py
1214
supports_getinfo = true
1315
supports_rawargs = true
16+
1417
outputheader = true
18+
requires_srinfo = true
1519

1620
[sum]
1721
filename = sum.py
1822
supports_getinfo = true
1923
supports_rawargs = true
24+
2025
outputheader = true
26+
requires_srinfo = true
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# [searchbnf.conf](http://docs.splunk.com/Documentation/Splunk/latest/Admin/Searchbnfconf)
2+
3+
[countmatches-command]
4+
syntax = countmatches fieldname=<field> pattern=<regular_expression> \
5+
<field-list>
6+
alias =
7+
shortdesc = Counts the number of non-overlapping matches to a regular \
8+
expression in a search result.
9+
description = A count of the number of non-overlapping matches to the regular \
10+
expression specified by pattern is computed for each record processed.
11+
The result is stored in the field specified by fieldname. If fieldname \
12+
exists, its value is replaced. If fieldname does not exist, it is \
13+
created. Results are otherwise passed through to the next pipeline \
14+
processor unmodified.
15+
comment1 = Count the number of words in the text of each tweet in tweets.csv \
16+
and put the result in word_count.
17+
example1 = | inputcsv tweets.csv | countmatches fieldname=word_count \
18+
pattern="\\w+" text
19+
category = fields::add
20+
appears-in = 5.0
21+
maintainer = dnoble
22+
usage = public
23+
related = stats
24+
tags = searchcommands_app
25+
26+
[simulate-command]
27+
syntax = simulate csv=<path> rate=<expected_event_count> \
28+
interval=<sampling_period> duration=<execution_period> (seed=<string>)?
29+
alias =
30+
shortdesc = Generates a sequence of events drawn from a csv file using \
31+
repeated random sampling.
32+
description = The simulate command uses repeated random samples of the event \
33+
records in csv for the execution period of duration. Sample sizes are \
34+
determined for each time interval in duration using a Poisson distribution \
35+
with an average rate specifying the expected event count during interval.
36+
comment1 = Generate events drawn by repeated random sampling of events in \
37+
tweets.csv.
38+
example1 = | simulate csv=population.csv rate=50 interval=00:00:01 \
39+
duration=00:00:05
40+
category = results::generate
41+
appears-in = 5.0
42+
maintainer = dnoble
43+
usage = public
44+
related = inputcsv
45+
tags = searchcommands_app
46+
47+
[sum-command]
48+
syntax = sum total=<field> <field-list>
49+
alias =
50+
shortdesc = Computes the sum of a set of fields.
51+
description = The total produced is sum(sum(fieldname, 1, n), 1, N) where n = \
52+
number of fields, N = number of records.
53+
comment1 = This example computes the total linecount in the first 200 records \
54+
in the _internal index.
55+
example1 = index = _internal | head 200 | sum total=lines linecount
56+
category = reporting
57+
appears-in = 5.0
58+
maintainer = dnoble
59+
usage = public
60+
related = stats
61+
tags = searchcommands_app

0 commit comments

Comments
 (0)