n8n-nodes-base/dist/node-definitions/nodes/n8n-nodes-base/splunk/v1/resource_search_job/operation_create.ts

Base nodes of n8n

/**
 * Splunk Node - Version 1
 * Discriminator: resource=searchJob, operation=create
 */


interface Credentials {
  splunkApi: CredentialReference;
}

/** Create a search job */
export type SplunkV1SearchJobCreateParams = {
  resource: 'searchJob';
  operation: 'create';
/**
 * Search language string to execute, in Splunk's <a href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual">Search Processing Language</a>
 */
    search?: string | Expression<string> | PlaceholderValue;
/**
 * Additional Fields
 * @default {}
 */
    additionalFields?: {
    /** Ad Hoc Search Level
     * @default verbose
     */
    adhoc_search_level?: 'fast' | 'smart' | 'verbose' | Expression<string>;
    /** Seconds after which the search job automatically cancels
     * @default 0
     */
    auto_cancel?: number | Expression<number>;
    /** Auto-finalize the search after at least this many events are processed
     * @default 0
     */
    auto_finalize_ec?: number | Expression<number>;
    /** Seconds of inactivity after which the search job automatically pauses
     * @default 0
     */
    auto_pause?: number | Expression<number>;
    /** The earliest index time for the search (inclusive)
     */
    index_earliest?: string | Expression<string>;
    /** The earliest cut-off for the search (inclusive)
     */
    earliest_time?: string | Expression<string>;
    /** Exec Mode
     * @default blocking
     */
    exec_mode?: 'blocking' | 'normal' | 'oneshot' | Expression<string>;
    /** Seconds of disk sync delay for indexed real-time search
     * @default 0
     */
    indexedRealtimeOffset?: number | Expression<number>;
    /** The latest index time for the search (inclusive)
     */
    index_latest?: string | Expression<string>;
    /** The latest cut-off for the search (inclusive)
     */
    latest_time?: string | Expression<string>;
    /** Number of seconds to run this search before finalizing. Enter &lt;code&gt;0&lt;/code&gt; to never finalize.
     * @default 0
     */
    max_time?: number | Expression<number>;
    /** Application namespace in which to restrict searches
     */
    namespace?: string | Expression<string> | PlaceholderValue;
    /** How frequently to run the MapReduce reduce phase on accumulated map values
     * @default 0
     */
    reduce_freq?: number | Expression<number>;
    /** Comma-separated list of (possibly wildcarded) servers from which raw events should be pulled. This same server list is to be used in subsearches.
     */
    remote_server_list?: string | Expression<string> | PlaceholderValue;
    /** Number of seconds ago to check when an identical search is started and return the job’s search ID instead of starting a new job
     * @default 0
     */
    reuse_max_seconds_ago?: number | Expression<number>;
    /** Name of a required field to add to the search. Even if not referenced or used directly by the search, a required field is still included in events and summary endpoints.
     */
    rf?: string | Expression<string> | PlaceholderValue;
    /** Search Mode
     * @default normal
     */
    search_mode?: 'normal' | 'realtime' | Expression<string>;
    /** The most status buckets to generate. Set &lt;code&gt;0&lt;/code&gt; generate no timeline information.
     * @default 0
     */
    status_buckets?: number | Expression<number>;
    /** Number of seconds to keep this search after processing has stopped
     * @default 86400
     */
    timeout?: number | Expression<number>;
    /** New workload pool where the existing running search should be placed
     */
    workload_pool?: string | Expression<string> | PlaceholderValue;
  };
};

export type SplunkV1SearchJobCreateNode = {
  type: 'n8n-nodes-base.splunk';
  version: 1;
  credentials?: Credentials;
  config: NodeConfig<SplunkV1SearchJobCreateParams>;
};