alerts

type AlertParams struct {
	Name         string
	Description  string `default:""`
	CronSchedule string
	// splunk search in spl syntax
	SearchQuery string
	OutputMode  string `default:"json"`
	// splunk returns a job SID only if the job is complete
	EarliestTime string
	// latest (exclusive) time bounds for the search
	LatestTime string
	//condition for triggering the alert
	AlertCondition      string
	AlertSuppress       string
	AlertSuppressPeriod string
	Actions             string
	WebhookUrl          string
}

type AlertRequest struct {
	Headers map[string]string
	Params  AlertParams
}

type Content struct {
	Sid                 string `json:"sid"`
	SavedSearchName     string `json:"savedsearch_name"`
	TriggerTime         int    `json:"trigger_time"`
	TriggeredAlertCount int    `json:"triggered_alert_count"`
}

type EntryItem struct {
	Name    string  `json:"name"`
	Links   Links   `json:"links"`
	Content Content `content:"content"`
}

type Links struct {
	Alternate   string `json:"alternate"`
	List        string `json:"list"`
	Remove      string `json:"remove"`
	Job         string `json:"job"`
	SavedSearch string `json:"savedsearch"`
}

type TriggeredAlerts struct {
	Origin  string      `json:"origin"`
	Updated string      `json:"updated"`
	Entry   []EntryItem `json:"entry"`
}

type TriggeredInstances struct {
	Origin  string      `json:"origin"`
	Updated string      `json:"updated"`
	Entry   []EntryItem `json:"entry"`
}