splunk

type Config struct {
	Host     string      `json:"host" yaml:"host" mapstructure:"host"`
	Username string      `json:"username" yaml:"username" mapstructure:"username"`
	Password string      `json:"password" yaml:"password" mapstructure:"password"`
	Event    EventConfig `json:"event" yaml:"event" mapstructure:"event"`
}

type EventClient struct {
	// contains filtered or unexported fields
}

type EventConfig struct {
	Host   string `json:"host" yaml:"host" mapstructure:"host"`
	Index  string `json:"index" yaml:"index" mapstructure:"index"`
	Source string `json:"source" yaml:"source" mapstructure:"source"`
	Token  string `json:"token" yaml:"token" mapstructure:"token"`
}

type EventReq struct {
	Timestamp_   int64  `json:"timestamp"`
	Name_        string `json:"name,omitempty"`
	Description_ string `json:"description,omitempty"`
	App_         string `json:"app,omitempty"`
	Label_       string `json:"label,omitempty"`
	Events_      []any  `json:"events,omitempty"`
	Event_       any    `json:"event,omitempty"`
}

type JobStatus struct {
	Entry []struct {
		Content JobStatusEntryCount `json:"content"`
	} `json:"entry"`
}

type JobStatusEntryCount struct {
	IsDone      bool  `json:"isDone"`
	DiskUsage   int64 `json:"diskUsage"`
	ResultCount int64 `json:"resultCount"`
}

type OutputMode string

type QueryResults []map[string]string

type QueryRsp struct {
	Results QueryResults `json:"results"`
}

type QuerySid struct {
	Sid string `json:"sid"`
}

type SearchRsp struct {
	Updated time.Time      `json:"updated"`
	Entry   []SearchesItem `json:"entry"`
	Paging  struct {
		Total int `json:"total"`
	} `json:"paging"`
}

type SearchesItem struct {
	Name    string    `json:"name"`
	Updated time.Time `json:"updated"`
	Author  string    `json:"author"`
	Content struct {
		SplunkHecTarget  string `json:"action.forward_alert_to_splunk_hec.param.splunk_hec_target"`
		ActionWebhookURL string `json:"action.webhook.param.url"`
		Actions          string `json:"actions"`
		CronSchedule     string `json:"cron_schedule"`
		Disabled         bool   `json:"disabled"`
		IsScheduled      bool   `json:"is_scheduled"`
		Search           string `json:"search"`
	} `json:"content"`
}