search

type DeleteSearchJob struct {
	// The index to delete events from.
	Index string `json:"index"`
	// The module to run the delete search job in. The default module is used if module field is empty.
	Module string `json:"module"`
	// The predicate expression that identifies the events to delete from the index. This expression must return true or false. To delete all events from the index, specify \"true\" instead of an expression.
	Predicate string `json:"predicate"`
	// Specifies that the delete search job will contain side effects, with possible security risks.
	AllowSideEffects *bool `json:"allowSideEffects,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to false.
	CollectEventSummary *bool `json:"collectEventSummary,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to false.
	CollectFieldSummary *bool `json:"collectFieldSummary,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to false.
	CollectTimeBuckets *bool `json:"collectTimeBuckets,omitempty"`
	// The time, in GMT, that the search job is finished. Empty if the search job has not completed.
	CompletionTime *string `json:"completionTime,omitempty"`
	// The time, in GMT, that the search job is dispatched.
	DispatchTime *string `json:"dispatchTime,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to false.
	EnablePreview *bool `json:"enablePreview,omitempty"`
	// Specifies whether the Search service should extract all of the available fields in the data, including fields not mentioned in the SPL for the search job. Set to 'false' for better search performance. The 'extractAllFields' parameter is deprecated as of version v3alpha1. Although this parameter continues to function, it might be removed in a future version. Use the 'extractFields' parameter instead.
	ExtractAllFields *bool `json:"extractAllFields,omitempty"`
	// Specifies how the Search service should extract fields. Valid values include 'all', 'none', or 'indexed'. 'all' will extract all fields, 'indexed' will extract only indexed fields, and 'none' will extract only the default fields. This parameter overwrites the value of the 'extractAllFields' parameter. Set to 'none' for better search performance.
	ExtractFields *string `json:"extractFields,omitempty"`
	// The amount of time, in seconds, to run the delete search job before finalizing the search. The maximum value is 3600 seconds (1 hour).
	MaxTime  *int32    `json:"maxTime,omitempty"`
	Messages []Message `json:"messages,omitempty"`
	// The name of the created search job.
	Name *string `json:"name,omitempty"`
	// An estimate of the percent of time remaining before the delete search job completes.
	PercentComplete *int32 `json:"percentComplete,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to false.
	PreviewAvailable *string `json:"previewAvailable,omitempty"`
	// The SPL search string that is generated based on index, module and predicate that are specified.
	Query *string `json:"query,omitempty"`
	// Represents parameters on the search job such as 'earliest' and 'latest'.
	QueryParameters *QueryParameters `json:"queryParameters,omitempty"`
	// This field does not apply to delete search jobs and is set to 0.
	RequiredFreshness *int32 `json:"requiredFreshness,omitempty"`
	// The earliest time speciifed as an absolute value in GMT. The time is computed based on the values you specify for the 'timezone' and 'earliest' queryParameters.
	ResolvedEarliest *string `json:"resolvedEarliest,omitempty"`
	// The latest time specified as an absolute value in GMT. The time is computed based on the values you specify for the 'timezone' and 'earliest' queryParameters.
	ResolvedLatest *string `json:"resolvedLatest,omitempty"`
	// The number of results produced so far by the delete search job that are going to be deleted.
	ResultsAvailable *int32 `json:"resultsAvailable,omitempty"`
	// This field does not apply to delete search jobs and is defaulted to 0.
	ResultsPreviewAvailable *int32 `json:"resultsPreviewAvailable,omitempty"`
	// The ID assigned to the delete search job.
	Sid    *string       `json:"sid,omitempty"`
	Status *SearchStatus `json:"status,omitempty"`
}

type FieldsSummary struct {
	// The amount of time, in seconds, that a time bucket spans from the earliest to the latest time.
	Duration *float64 `json:"duration,omitempty"`
	// If specified, the earliest timestamp, in UTC format, of the events to process.
	EarliestTime *string `json:"earliestTime,omitempty"`
	// The total number of events for all fields returned in the time range (earliestTime and latestTime) specified.
	EventCount *int32 `json:"eventCount,omitempty"`
	// A map of the fields in the time range specified.
	Fields map[string]SingleFieldSummary `json:"fields,omitempty"`
	// If specified, the latest timestamp, in UTC format, of the events to process.
	LatestTime *string `json:"latestTime,omitempty"`
}

type Iterator struct {
	// contains filtered or unexported fields
}

type ListEventsSummaryQueryParams struct {
	// Count : The maximum number of entries to return. Set to 0 to return all available entries.
	Count *int32 `key:"count"`
	// Earliest : The earliest time filter, in absolute time. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Earliest string `key:"earliest"`
	// Field : A field to return for the result set. You can specify multiple fields of comma-separated values if multiple fields are required.
	Field string `key:"field"`
	// Latest : The latest time filter in absolute time. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Latest string `key:"latest"`
	// Offset : Index of first item to return.
	Offset *int32 `key:"offset"`
}

type ListFieldsSummaryQueryParams struct {
	// Earliest : The earliest time filter, in absolute time. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Earliest string `key:"earliest"`
	// Latest : The latest time filter in absolute time. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Latest string `key:"latest"`
}

type ListJobsQueryParams struct {
	// Count : The maximum number of jobs that you want to return the status entries for.
	Count *int32 `key:"count"`
	// Filter : Filter the list of jobs by sid. Valid format is  `sid IN ({comma separated list of SIDs in quotes})`. A maximum of 50 SIDs can be specified in one query.
	Filter string `key:"filter"`
	// Status : Filter the list of jobs by status. Valid status values are 'running', 'done', 'canceled', or 'failed'.
	Status SearchStatus `key:"status"`
}

type ListPreviewResultsQueryParams struct {
	// Count : The maximum number of entries to return. Set to 0 to return all available entries.
	Count *int32 `key:"count"`
	// Offset : Index of first item to return.
	Offset *int32 `key:"offset"`
}

type ListPreviewResultsResponse struct {
	IsPreviewStable bool                               `json:"isPreviewStable"`
	Results         []map[string]interface{}           `json:"results"`
	Fields          []ListPreviewResultsResponseFields `json:"fields,omitempty"`
	Messages        []Message                          `json:"messages,omitempty"`
	NextLink        *string                            `json:"nextLink,omitempty"`
	Wait            *string                            `json:"wait,omitempty"`
}

type ListPreviewResultsResponseFields struct {
	Name           string  `json:"name"`
	DataSource     *string `json:"dataSource,omitempty"`
	GroupbyRank    *string `json:"groupbyRank,omitempty"`
	SplitField     *string `json:"splitField,omitempty"`
	SplitValue     *string `json:"splitValue,omitempty"`
	SplitbySpecial *string `json:"splitbySpecial,omitempty"`
	TypeSpecial    *string `json:"typeSpecial,omitempty"`
}

type ListResultsQueryParams struct {
	// Count : The maximum number of entries to return. Set to 0 to return all available entries.
	Count *int32 `key:"count"`
	// Field : A field to return for the result set. You can specify multiple fields of comma-separated values if multiple fields are required.
	Field string `key:"field"`
	// Offset : Index of first item to return.
	Offset *int32 `key:"offset"`
}

type ListSearchResultsResponse struct {
	Results  []map[string]interface{}           `json:"results"`
	Fields   []ListPreviewResultsResponseFields `json:"fields,omitempty"`
	Messages []Message                          `json:"messages,omitempty"`
	NextLink *string                            `json:"nextLink,omitempty"`
	Wait     *string                            `json:"wait,omitempty"`
}

type Message struct {
	Text *string      `json:"text,omitempty"`
	Type *MessageType `json:"type,omitempty"`
}

type MessageType string

type QueryFunc func(step, start int) (*ListSearchResultsResponse, error)

type QueryParameters struct {
	// The earliest time, in absolute or relative format, to retrieve events. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Earliest *string `json:"earliest,omitempty"`
	// The latest time, in absolute or relative format, to retrieve events. When specifying an absolute time specify either UNIX time, or UTC in seconds using the ISO-8601 (%FT%T.%Q) format. For example 2019-01-25T13:15:30Z. GMT is the default timezone. You must specify GMT when you specify UTC. Any offset specified is ignored.
	Latest *string `json:"latest,omitempty"`
	// Relative values for the 'earliest' and 'latest' parameters snap to the unit that you specify. For example, if 'earliest' is set to -d@d, the unit is day. If the 'relativeTimeAnchor' is is set to '2020-10-05T13:15:30Z' then 'resolvedEarliest' is snapped to '2020-10-05T00:00:00Z', which is the day. Hours, minutes, and seconds are dropped. If no 'relativeTimeAnchor' is specified, the default value is set to the time the search job was created.
	RelativeTimeAnchor *string `json:"relativeTimeAnchor,omitempty"`
	// The timezone that relative time specifiers are based off of. Timezone only applies to relative time literals for 'earliest' and 'latest'. If UNIX time or UTC format is used for 'earliest' and 'latest', this field is ignored. For the list of supported timezone formats, see https://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps#zoneinfo_.28TZ.29_database type: string default: \"GMT\"
	Timezone interface{} `json:"timezone,omitempty"`
}

type SearchJob struct {
	// The SPL search string.
	Query string `json:"query"`
	// Specifies whether a search that contains commands with side effects (with possible security risks) is allowed to run.
	AllowSideEffects *bool `json:"allowSideEffects,omitempty"`
	// Specified whether a search is allowed to collect events summary during the run time.
	CollectEventSummary *bool `json:"collectEventSummary,omitempty"`
	// Specified whether a search is allowed to collect Fields summary during the run time.
	CollectFieldSummary *bool `json:"collectFieldSummary,omitempty"`
	// Specified whether a search is allowed to collect Timeline Buckets summary during the run time.
	CollectTimeBuckets *bool `json:"collectTimeBuckets,omitempty"`
	// The time, in GMT, that the search job is finished. Empty if the search job has not completed.
	CompletionTime *string `json:"completionTime,omitempty"`
	// The time, in GMT, that the search job is dispatched.
	DispatchTime *string `json:"dispatchTime,omitempty"`
	// Specified whether a search is allowed to collect preview results during the run time.
	EnablePreview *bool `json:"enablePreview,omitempty"`
	// Specifies whether the Search service should extract all of the available fields in the data, including fields not mentioned in the SPL for the search job. Set to 'false' for better search performance. The 'extractAllFields' parameter is deprecated as of version v3alpha1. Although this parameter continues to function, it might be removed in a future version. Use the 'extractFields' parameter instead.
	ExtractAllFields *bool `json:"extractAllFields,omitempty"`
	// Specifies how the Search service should extract fields. Valid values include 'all', 'none', or 'indexed'. 'all' will extract all fields, 'indexed' will extract only indexed fields, and 'none' will extract only the default fields. This parameter overwrites the value of the 'extractAllFields' parameter. Set to 'none' for better search performance.
	ExtractFields *string `json:"extractFields,omitempty"`
	// The number of seconds to run the search before finalizing the search. The maximum value is 3600 seconds (1 hour).
	MaxTime  *int32    `json:"maxTime,omitempty"`
	Messages []Message `json:"messages,omitempty"`
	// The module to run the search in. The default module is used if a module is not specified.
	Module *string `json:"module,omitempty"`
	// The name of the created search job.
	Name *string `json:"name,omitempty"`
	// An estimate of the percent of time remaining before the job completes.
	PercentComplete *int32 `json:"percentComplete,omitempty"`
	// Specifies if preview results for the search job are available. The valid status values are 'unknown', 'true', and 'false'.
	PreviewAvailable *string `json:"previewAvailable,omitempty"`
	// Represents parameters on the search job such as 'earliest' and 'latest'.
	QueryParameters *QueryParameters `json:"queryParameters,omitempty"`
	// Specifies a maximum time interval, in seconds, between identical existing searches. The 'requiredFreshness' parameter is used to determine if an existing search with the same query and the same time boundaries can be reused, instead of running the same search again. Freshness is applied to the resolvedEarliest and resolvedLatest parameters. If an existing search has the same exact criteria as this search and the resolvedEarliest and resolvedLatest values are within the freshness interval, the existing search metadata is returned instead of initiating a new search job. By default, the requiredFreshness parameter is set to 0 which means that the platform does not attempt to use an existing search.
	RequiredFreshness *int32 `json:"requiredFreshness,omitempty"`
	// The earliest time speciifed as an absolute value in GMT. The time is computed based on the values you specify for the 'timezone' and 'earliest' queryParameters.
	ResolvedEarliest *string `json:"resolvedEarliest,omitempty"`
	// The latest time specified as an absolute value in GMT. The time is computed based on the values you specify for the 'timezone' and 'earliest' queryParameters.
	ResolvedLatest *string `json:"resolvedLatest,omitempty"`
	// The number of results produced so far for the search job.
	ResultsAvailable *int32 `json:"resultsAvailable,omitempty"`
	// The number of the preview search results for the job with the specified search ID (SID)
	ResultsPreviewAvailable *int32 `json:"resultsPreviewAvailable,omitempty"`
	// The ID assigned to the search job.
	Sid    *string       `json:"sid,omitempty"`
	Status *SearchStatus `json:"status,omitempty"`
}

type SearchStatus string

type Service services.BaseService

type Servicer interface {
	//interfaces that cannot be auto-generated from codegen
	// WaitForJob polls the job until it's completed or errors out
	WaitForJob(jobID string, pollInterval time.Duration) (interface{}, error)

	//interfaces that are auto-generated in interface_generated.go
	ServicerGenerated
}

type ServicerGenerated interface {
	/*
		CreateJob - search service endpoint
		Creates a search job.
		Parameters:
			searchJob
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	CreateJob(searchJob SearchJob, resp ...*http.Response) (*SearchJob, error)
	/*
		DeleteJob - search service endpoint
		Creates a search job that deletes events from an index. The events are deleted from the index in the specified module, based on the search criteria as specified by the predicate.
		Parameters:
			deleteSearchJob
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	DeleteJob(deleteSearchJob DeleteSearchJob, resp ...*http.Response) (*DeleteSearchJob, error)
	/*
		GetJob - search service endpoint
		Return the search job with the specified search ID (SID).
		Parameters:
			sid: The search ID.
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	GetJob(sid string, resp ...*http.Response) (*SearchJob, error)
	/*
		ListEventsSummary - search service endpoint
		Return events summary, for search ID (SID) search.
		Parameters:
			sid: The search ID.
			query: a struct pointer of valid query parameters for the endpoint, nil to send no query parameters
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListEventsSummary(sid string, query *ListEventsSummaryQueryParams, resp ...*http.Response) (*ListSearchResultsResponse, error)
	/*
		ListFieldsSummary - search service endpoint
		Return fields stats summary of the events to-date, for search ID (SID) search.
		Parameters:
			sid: The search ID.
			query: a struct pointer of valid query parameters for the endpoint, nil to send no query parameters
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListFieldsSummary(sid string, query *ListFieldsSummaryQueryParams, resp ...*http.Response) (*FieldsSummary, error)
	/*
		ListJobs - search service endpoint
		Return the matching list of search jobs.
		Parameters:
			query: a struct pointer of valid query parameters for the endpoint, nil to send no query parameters
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListJobs(query *ListJobsQueryParams, resp ...*http.Response) ([]SearchJob, error)
	/*
		ListPreviewResults - search service endpoint
		Return the preview search results for the job with the specified search ID (SID). Can be used when a job is running to return interim results.
		Parameters:
			sid: The search ID.
			query: a struct pointer of valid query parameters for the endpoint, nil to send no query parameters
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListPreviewResults(sid string, query *ListPreviewResultsQueryParams, resp ...*http.Response) (*ListPreviewResultsResponse, error)
	/*
		ListResults - search service endpoint
		Return the search results for the job with the specified search ID (SID).
		Parameters:
			sid: The search ID.
			query: a struct pointer of valid query parameters for the endpoint, nil to send no query parameters
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListResults(sid string, query *ListResultsQueryParams, resp ...*http.Response) (*ListSearchResultsResponse, error)
	/*
		ListTimeBuckets - search service endpoint
		Return event distribution over time of the untransformed events read to-date, for search ID(SID) search.
		Parameters:
			sid: The search ID.
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	ListTimeBuckets(sid string, resp ...*http.Response) (*TimeBucketsSummary, error)
	/*
		UpdateJob - search service endpoint
		Update the search job with the specified search ID (SID) with an action.
		Parameters:
			sid: The search ID.
			updateJob
			resp: an optional pointer to a http.Response to be populated by this method. NOTE: only the first resp pointer will be used if multiple are provided
	*/
	UpdateJob(sid string, updateJob UpdateJob, resp ...*http.Response) (*SearchJob, error)
}

type SingleFieldSummary struct {
	// The total number of events that contain the field.
	Count *int32 `json:"count,omitempty"`
	// The total number of unique values in the field.
	DistinctCount *int32 `json:"distinctCount,omitempty"`
	// Specifies if the distinctCount is accurate. The isExact property is FALSE when the distinctCount exceeds the maximum count and an exact count is not available.
	IsExact *bool `json:"isExact,omitempty"`
	// The maximum numeric values in the field.
	Max *string `json:"max,omitempty"`
	// The mean (average) for the numeric values in the field.
	Mean *float64 `json:"mean,omitempty"`
	// The minimum numeric values in the field.
	Min *string `json:"min,omitempty"`
	// An array of the values in the field.
	Modes []SingleValueMode `json:"modes,omitempty"`
	// The count of the numeric values in the field.
	NumericCount *int32 `json:"numericCount,omitempty"`
	// Specifies if the field was added or changed by the search.
	Relevant *bool `json:"relevant,omitempty"`
	// The standard deviation for the numeric values in the field.
	Stddev *float64 `json:"stddev,omitempty"`
}

type SingleTimeBucket struct {
	// Count of available events. Not all events in a bucket are retrievable. Typically this count is capped at 10000.
	AvailableCount *int32   `json:"availableCount,omitempty"`
	Duration       *float64 `json:"duration,omitempty"`
	// The timestamp of the earliest event in the current bucket, in UNIX format. This is the same time as 'earliestTimeStrfTime' in UNIX format.
	EarliestTime *float64 `json:"earliestTime,omitempty"`
	// The timestamp of the earliest event in the current bucket, in UTC format with seconds. For example 2019-01-25T13:15:30Z, which follows the ISO-8601 (%FT%T.%Q) format.
	EarliestTimeStrfTime *string `json:"earliestTimeStrfTime,omitempty"`
	// Specifies if all of the events in the current bucket have been finalized.
	IsFinalized *bool `json:"isFinalized,omitempty"`
	// The total count of the events in the current bucket.
	TotalCount *int32 `json:"totalCount,omitempty"`
}

type SingleValueMode struct {
	// The number of occurences that the value appears in a field.
	Count *int32 `json:"count,omitempty"`
	// Specifies if the count is accurate. The isExact property is FALSE when the count exceeds the maximum count and an exact count is not available.
	IsExact *bool `json:"isExact,omitempty"`
	// The value in the field.
	Value *string `json:"value,omitempty"`
}

type TimeBucketsSummary struct {
	// Specifies if the events are returned in time order.
	IsTimeCursored *bool              `json:"IsTimeCursored,omitempty"`
	Buckets        []SingleTimeBucket `json:"buckets,omitempty"`
	// Identifies where the cursor is in processing the events. The cursorTime is a timestamp specified in UNIX time.
	CursorTime *float32 `json:"cursorTime,omitempty"`
	// The number of events processed at the cursorTime.
	EventCount *int32 `json:"eventCount,omitempty"`
}

type UpdateJob struct {
	// The status to PATCH to an existing search job. The only status values you can PATCH are 'canceled' and 'finalized'. You can PATCH the 'canceled' status only to a search job that is running.
	Status UpdateJobStatus `json:"status"`
}

type UpdateJobStatus string