You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
31 lines
1.2 KiB
31 lines
1.2 KiB
__author__ = 'peter'
|
|
|
|
import re
|
|
from collections import OrderedDict
|
|
import splunk.entity as en
|
|
import splunk.Intersplunk as intersplunk
|
|
|
|
# all supported input types
|
|
aws_source_type_patten = 'aws:.*'
|
|
aws_input_location_pattern = '/data/inputs/aws_.*'
|
|
|
|
# get data volume per sourcetype
|
|
results, dummy_results, settings = intersplunk.getOrganizedResults()
|
|
|
|
# get all source types used in inputs
|
|
# TODO should get inputs from remote target if configured, not localhost
|
|
# This bug is not very critical because we have already calculated all sourcetypes start with "aws:"
|
|
all_inputs = en.getEntitiesList('data/inputs/all',
|
|
namespace=settings['namespace'],
|
|
owner=settings['owner'],
|
|
sessionKey=settings['sessionKey'])
|
|
|
|
# add more customized sourcetypes
|
|
source_types = set([x.get('sourcetype') for x in all_inputs if re.match(aws_input_location_pattern, x.get('eai:location')) is not None])
|
|
|
|
# get data volume per sourcetype
|
|
output = [x for x in results if x.get('series') in source_types or re.match(aws_source_type_patten, x.get('series')) is not None]
|
|
|
|
# return result
|
|
intersplunk.outputResults(output)
|