Skip to content

Remove biased language example, replace with saved search #425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 19, 2022
Merged

Remove biased language example, replace with saved search #425

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f329ba3
Remove biased language example, replace with saved search
fantavlik Dec 15, 2021
25625dc
Formatting
fantavlik Dec 15, 2021
e457e58
Merge commit '5267feadeb61567a83a31899dbe5f0e253ba49e5' into fix-bias…
fantavlik Dec 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 9 additions & 20 deletions splunklib/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -857,32 +857,21 @@ class Entity(Endpoint):

``Entity`` provides the majority of functionality required by entities.
Subclasses only implement the special cases for individual entities.
For example for deployment serverclasses, the subclass makes whitelists and
blacklists into Python lists.
For example for saved searches, the subclass makes fields like ``action.email``,
``alert_type``, and ``search`` available.

An ``Entity`` is addressed like a dictionary, with a few extensions,
so the following all work::

ent['email.action']
ent['disabled']
ent['whitelist']

Many endpoints have values that share a prefix, such as
``email.to``, ``email.action``, and ``email.subject``. You can extract
the whole fields, or use the key ``email`` to get a dictionary of
all the subelements. That is, ``ent['email']`` returns a
dictionary with the keys ``to``, ``action``, ``subject``, and so on. If
there are multiple levels of dots, each level is made into a
subdictionary, so ``email.body.salutation`` can be accessed at
``ent['email']['body']['salutation']`` or
``ent['email.body.salutation']``.
so the following all work, for example in saved searches::

ent['action.email']
ent['alert_type']
ent['search']

You can also access the fields as though they were the fields of a Python
object, as in::

ent.email.action
ent.disabled
ent.whitelist
ent.alert_type
ent.search

However, because some of the field names are not valid Python identifiers,
the dictionary-like syntax is preferable.
Expand Down