spring-integration-splunk icon indicating copy to clipboard operation
spring-integration-splunk copied to clipboard

INTEXT-72: Implement realtime search

Open artembilan opened this issue 11 years ago • 8 comments

JIRA: https://jira.spring.io/browse/INTEXT-72

An initial polishing commit.

There is no yet real implementation

artembilan avatar Dec 04 '14 14:12 artembilan

@dturanski , would you mind answering or at least helpping who can? The Splunk Job has states: isDone(), isFailed(), isFinalized(), isPaused(). How are they related to each other? The Job JavaDocs don't provide good info and I can't find an answer in the Internet.

In most cases we do:

while (!job.isDone()) {
    Thread.sleep(2000);
}

However I think we may don't get isDone status, if job has been falied or finalized manually from Splunk. WDYT?

When I will have had an answer, I'll know how to go ahead with realtime search correctly. Because this type of Job is never done and it is normal: http://dev.splunk.com/view/java-sdk/SP-CAAAEHQ.

artembilan avatar Dec 04 '14 14:12 artembilan

Pushed the implementation for realtime search.

Pay attention, please, to the SplunkDataReader#isJobInvalid() method. Testing with real Splunk Enterprise shows that finalized and failed states impact to the done one and we always get true for those cases as well. However there is a case when we get an Exception from Job.refresh(), e.g. when we manually remove the Job from Splunk Enterprise - SID isn't valid. For all other searches it is OK. We end up with an Exception which is propagated as an ErrorMessage to the error-channel from the <poller> and the next poll initiates a new Job. For the realtime search we always should have only the single long-living Job. Hance we should schedule a new one, when we get an exception from Splunk Service.

Hope I am clear.

artembilan avatar Dec 05 '14 09:12 artembilan

Since RT search Job is long-living but we can start/stop adapter at runtime, consider to finish() Splunk Job on adapter stop(). See https://jira.spring.io/browse/INT-3571

artembilan avatar Dec 05 '14 16:12 artembilan

Pushed Lifecycle for RT search Jobs based on the latests SI 4.0.6 changes

artembilan avatar Dec 06 '14 17:12 artembilan

Pushed isFalied() check

artembilan avatar Dec 12 '14 11:12 artembilan

Pushed upgrade commit

artembilan avatar Feb 28 '15 11:02 artembilan

Pushed upgrade and IO-2.0 compatibility.

CC @wilkinsona

artembilan avatar Jul 08 '15 15:07 artembilan

Thanks for taking care of the plugin upgrade, @artembilan. One less PR for me to do :)

wilkinsona avatar Jul 09 '15 06:07 wilkinsona