Package org.apache.drill.exec.store.splunk

Class SplunkQueryBuilder

java.lang.Object
org.apache.drill.exec.store.splunk.SplunkQueryBuilder
public class SplunkQueryBuilder extends Object

  • Field Details

  • Constructor Details

    • SplunkQueryBuilder

      public SplunkQueryBuilder(String index)

  • Method Details

    • addSourceType

      public void addSourceType(String sourceType)
      Adds a sourcetype to the Splunk query. Splunk indexes its data by indexes, then within the index, organizes the data by sourcetype, which could be a reference to the underlying source system. For instance, sourcetype might be csv files, log files, Azure storage or whatever. Since this is a sort of special metadata case, it is better to apply this separately than a regular filter. Sourcetypes can accept wildcards, but cannot accept any other operator other than = or !=.
      Parameters:
      sourceType - The Splunk Sourcetype to be added to the Splunk query.

    • addField

      public boolean addField(String field)
      Adds a field name to a Splunk query. To push down the projection into Splunk, Splunk accepts arguments in the format | fields foo, bar, car. This function adds these fields to the query. As an error preventative measure, this function will ignore ** from Drill.
      Parameters:
      field - The field to be added to the query
      Returns:
      true if the field was added, false if it was skipped

    • addLimit

      public void addLimit(int limit)
      Adds a row limit to the query. Ignores anything <= zero. This method should only be called once, but if is called more than once, it will set the limit to the most recent value.
      Parameters:
      limit - Positive, non-zero integer of number of desired rows.

    • addFilter

      public void addFilter(String left, String right, String operator)
      Adds a filter to the Splunk query. Splunk treats all filters as AND filters, without explicitly noting that. The operator should be the actual operator
      Parameters:
      left - The field to be filtered
      right - The value of that field
      operator - The actual operator to go in the SPL query

    • addNotNullFilter

      public void addNotNullFilter(String fieldName)
      Adds an isnotnull() filter to the Splunk query
      Parameters:
      fieldName - The field name which should be null

    • addNullFilter

      public void addNullFilter(String fieldName)
      Adds an isnull() filter to the Splunk query
      Parameters:
      fieldName - The field name which should be null

    • addFilters

      public void addFilters(Map<String,ExprNode.ColRelOpConstNode> filters)
      Processes the filters for a Splunk query
      Parameters:
      filters - A HashMap of filters

    • quoteString

      public String quoteString(String word)
      Adds quotes around text for use in SPL queries. Ignores numbers
      Parameters:
      word - The input word to be quoted.
      Returns:
      The text with quotes

    • build

      public String build()

    • isNumeric

      public static boolean isNumeric(String str)
      Returns true if the given string is numeric, false if not
      Parameters:
      str - The string to test for numeric
      Returns:
      True if the string is numeric, false if not.