Struct splunk::search::searchjob::SearchJob

pub struct SearchJob {
    pub query: String,
    pub count: u64,
    pub exec_mode: SearchExecMode,
    pub earliest_time: String,
    pub latest_time: String,
    pub fields: Vec<String>,
    pub sid: Option<String>,
    pub creation_response: Response,
}

A search job

Fields

query: String

The search query

count: u64

How many results we are asking for

exec_mode: SearchExecMode

What SearchExecMode to run in

earliest_time: String

set earliest_time

latest_time: String

set latest_time

fields: Vec<String>

ask for a particular set of fields - leave empty for all

sid: Option<String>

set the search ID on creation

creation_response: Response

The raw reqwest::Response object

Implementations

impl SearchJob

pub fn create(query: impl Into<String>) -> SearchJobBuilder

Defaults to 10000 results, last 24 hours -> now(),