Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove biased language example, replace with saved search #425

Merged
merged 3 commits into from
Apr 19, 2022
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 9 additions & 20 deletions splunklib/client.py
Original file line number Diff line number Diff line change
Expand Up @@ -857,32 +857,21 @@ class Entity(Endpoint):

``Entity`` provides the majority of functionality required by entities.
Subclasses only implement the special cases for individual entities.
For example for deployment serverclasses, the subclass makes whitelists and
blacklists into Python lists.
For example for saved searches, the subclass makes fields like ``action.email``,
``alert_type``, and ``search`` available.

An ``Entity`` is addressed like a dictionary, with a few extensions,
so the following all work::

ent['email.action']
ent['disabled']
ent['whitelist']

Many endpoints have values that share a prefix, such as
``email.to``, ``email.action``, and ``email.subject``. You can extract
the whole fields, or use the key ``email`` to get a dictionary of
all the subelements. That is, ``ent['email']`` returns a
dictionary with the keys ``to``, ``action``, ``subject``, and so on. If
there are multiple levels of dots, each level is made into a
subdictionary, so ``email.body.salutation`` can be accessed at
``ent['email']['body']['salutation']`` or
``ent['email.body.salutation']``.
so the following all work, for example in saved searches::

ent['action.email']
ent['alert_type']
ent['search']

You can also access the fields as though they were the fields of a Python
object, as in::

ent.email.action
ent.disabled
ent.whitelist
ent.alert_type
ent.search

However, because some of the field names are not valid Python identifiers,
the dictionary-like syntax is preferable.
Expand Down