org.apache.drill.exec.store.splunk

Class SplunkQueryBuilder

java.lang.Object

org.apache.drill.exec.store.splunk.SplunkQueryBuilder

public class SplunkQueryBuilder
extends Object

Field Summary

Fields

Modifier and Type	Field and Description
static String	EQUAL_OPERATOR
static String	GREATER_THAN
static String	GREATER_THAN_EQ
static String	LESS_THAN
static String	LESS_THAN_EQ
static String	NOT_EQUAL_OPERATOR

Constructor Summary

Constructors

Constructor and Description
SplunkQueryBuilder(String index)

Method Summary

Modifier and Type	Method and Description
boolean	addField(String field) Adds a field name to a Splunk query.
void	addFilter(String left, String right, String operator) Adds a filter to the Splunk query.
void	addFilters(Map<String,ExprNode.ColRelOpConstNode> filters) Processes the filters for a Splunk query
void	addLimit(int limit) Adds a row limit to the query.
void	addNotNullFilter(String fieldName) Adds an isnotnull() filter to the Splunk query
void	addNullFilter(String fieldName) Adds an isnull() filter to the Splunk query
void	addSourceType(String sourceType) Adds a sourcetype to the Splunk query.
String	build()
static boolean	isNumeric(String str) Returns true if the given string is numeric, false if not
String	quoteString(String word) Adds quotes around text for use in SPL queries.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

EQUAL_OPERATOR

public static final String EQUAL_OPERATOR

See Also:

Constant Field Values

NOT_EQUAL_OPERATOR

public static final String NOT_EQUAL_OPERATOR

See Also:

Constant Field Values

GREATER_THAN

public static final String GREATER_THAN

See Also:

Constant Field Values

GREATER_THAN_EQ

public static final String GREATER_THAN_EQ

See Also:

Constant Field Values

LESS_THAN

public static final String LESS_THAN

See Also:

Constant Field Values

LESS_THAN_EQ

public static final String LESS_THAN_EQ

See Also:

Constant Field Values

Constructor Detail

SplunkQueryBuilder

public SplunkQueryBuilder(String index)

Method Detail

addSourceType

public void addSourceType(String sourceType)

Adds a sourcetype to the Splunk query. Splunk indexes its data by indexes, then within the index, organizes the data by sourcetype, which could be a reference to the underlying source system. For instance, sourcetype might be csv files, log files, Azure storage or whatever. Since this is a sort of special metadata case, it is better to apply this separately than a regular filter. Sourcetypes can accept wildcards, but cannot accept any other operator other than = or !=.

Parameters:

sourceType - The Splunk Sourcetype to be added to the Splunk query.

addField

public boolean addField(String field)

Adds a field name to a Splunk query. To push down the projection into Splunk, Splunk accepts arguments in the format | fields foo, bar, car. This function adds these fields to the query. As an error preventative measure, this function will ignore ** from Drill.

Parameters:

field - The field to be added to the query

Returns:

true if the field was added, false if it was skipped

addLimit

public void addLimit(int limit)

Adds a row limit to the query. Ignores anything <= zero. This method should only be called once, but if is called more than once, it will set the limit to the most recent value.

Parameters:

limit - Positive, non-zero integer of number of desired rows.

addFilter

public void addFilter(String left,
                      String right,
                      String operator)

Adds a filter to the Splunk query. Splunk treats all filters as AND filters, without explicitly noting that. The operator should be the actual operator

Parameters:

left - The field to be filtered

right - The value of that field

operator - The actual operator to go in the SPL query

addNotNullFilter

public void addNotNullFilter(String fieldName)

Adds an isnotnull() filter to the Splunk query

Parameters:

fieldName - The field name which should be null

addNullFilter

public void addNullFilter(String fieldName)

Adds an isnull() filter to the Splunk query

Parameters:

fieldName - The field name which should be null

addFilters

public void addFilters(Map<String,ExprNode.ColRelOpConstNode> filters)

Processes the filters for a Splunk query

Parameters:

filters - A HashMap of filters

quoteString

public String quoteString(String word)

Adds quotes around text for use in SPL queries. Ignores numbers

Parameters:

word - The input word to be quoted.

Returns:

The text with quotes

build

public String build()

isNumeric

public static boolean isNumeric(String str)

Returns true if the given string is numeric, false if not

Parameters:

str - The string to test for numeric

Returns:

True if the string is numeric, false if not.