SplunkCustomJSON

#
# Splunk UI module python renderer
# This module is imported by the module loader (lib.module.ModuleMapper) into
# the splunk.appserver.mrsparkle.controllers.module.* namespace.
#


# required imports
import cherrypy, datetime
import controllers.module as module

# common imports
import xml.sax.saxutils as su
import splunk, splunk.search, splunk.util, splunk.entity
import lib.util as util
import lib.i18n as i18n

import json
from splunk.appserver.mrsparkle.lib import jsonresponse

# logging setup
import logging
logger = logging.getLogger('splunk.appserver.controllers.module.CustomJSONResults')

# define standard time field name
TIME_FIELD = '_time'
RAW_FIELD = '_raw'

# define a delimiter that can be used to pass content and a css class down to the module via generateResults
# and css class name to add when the module is displaying an exception
CSS_CLASS_DELIMITER = '//!-!//'
EXCEPTION_CSS_CLASS = 'CustomJSONResultsWithException'


class CustomJSONResults(module.ModuleHandler):

    def generateResults(self, host_app, client_app, sid, count=1000,
            earliest_time=None, latest_time=None, field_list=None,
            offset=0, max_lines=None, reverse_order=0, entity_name='results',
            postprocess=None, display_row_numbers='True', show_preview='0', mark_interactive=None,
            sortField=None, sortDir=None):

        # assert input
        if not sid:
            raise Exception('CustomJSONResults.generateResults - sid not passed!')

        try:
            job = splunk.search.JobLite(sid)
        except Exception, e:
            return self.generateErrorMessage(_('Job not available'))

        job.setFetchOption(output_time_format=i18n.ISO8609_MICROTIME)

       # pass in any field list
        if (field_list) :
            job.setFetchOption(fieldList=field_list, show_empty_fields=False)

        if postprocess:
            job.setFetchOption(search=postprocess)

        if splunk.util.normalizeBoolean(show_preview) and entity_name == 'results':
            entity_name = 'results_preview'

        rs = job.getResults(entity_name, offset, count)

        if rs == None:
            return _('<p class="resultStatusMessage">The job appears to have expired or has been canceled. Splunk could not retrieve data for this search.</p>')

        fieldNames = [x for x in rs.fieldOrder() if (not x.startswith('_') or x in (TIME_FIELD, RAW_FIELD) )]

        dataset = rs.results()

        outputJSON = {}
        for row in dataset:
        rowData = {}
                for fieldName in fieldNames:
            try:
                rowData[fieldName] = str(row[fieldName][0].value)
            except:
                pass

        outputJSON[row['sectionCode'][0].value] = rowData

        cherrypy.response.headers['Content-Type'] = 'text/json'
        return json.dumps(outputJSON, sort_keys=True)

    def generateErrorMessage(self, errorString):
        return '%s%s%s' % (su.escape(errorString), CSS_CLASS_DELIMITER, EXCEPTION_CSS_CLASS)