Run a Splunk search from Emacs.
Splunk is a tool that ingests plain data (for example, logs) and makes it searchable. It exposes a REST API, which made this package possible. See https://www.splunk.com for more information.
"Pepita": "nugget" in Spanish.
Table of contents
Installation and configuration
Place pepita.el in your load-path. Or install from MELPA (coming soon).
The next step would be to use customize for pepita. Not a lot to see so far:
- REQUIRED: Add the Splunk URL (Notice the trailing /):
(setq 'pepita-splunk-url "https://splunk.something.com:8089/services/")
- You can set
pepita-splunk-usernameif you don't want to enter your user name on each session
The first request to Splunk you will be prompted user/pass and then your credentials will be cached in memory as long as Emacs is open. I couldn't get session auth to work yet (so we don't need to keep credentials around) but it's a feature in the roadmap.
pepita-new-search: Prompts for a query text and time range. If called with prefix arg, provides the parameters from the last search as starting point.
pepita-search-at-point: Just like the previous function, but use the region, or current line if region is not active, as query text. If called with prefix args, prepend the last search text to the new input.
I keep an org file with some common queries, in those scenarios the second function is really handy. It's also useful to refine a search from results (highlight the text you want to add to the query and call with prefix arg).
Query text: this is exacly what you would type in the search box in Splunk
From: A time specification, or blank.
To: A time specification, or blank.
Splunk is really flexible with the format for the last two. For the full details see https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/SearchTimeModifiers, but the following examples can get you started:
- -5d => five days ago
- -30m => last thirty minutes
- 2019-01-01T14:00:00 => Jan 1st 2019 at 2 PM ISO 8601 format
- From: -3h To: -10m => events from 3 hours ago up to 10 minutes ago
The search runs in the background, and the results are displayed in a new buffer, in CSV format. From that buffer you can use:
- j - to export to JSON
- h - to export to HTML
- ? - to see the parameters used in the query
- g - to re-run the query in the same results buffer. Use prefix arg to re-run the query in a new buffer.