| | |
- SJob
- SObj
-
- SResult
- SSession
class SJob |
| |
Represents the list of instances from a get()
Usage:
# iterate over instances of get() objects
for myobj in myjob:
print myobj.zipcode
# do direct selection of instances 2 to 3:
print job.events[2:3]
# get number of results
count = len(job)
|
| |
Methods defined here:
- __getattr__(self, key)
- __getitem__(self, index)
- __init__(self, job)
- __iter__(self)
- __len__(self)
- next(self)
|
class SObj |
| |
Root Splunk Object, reserved for future use.
|
| |
Methods defined here:
- __init__(self)
|
class SResult(SObj) |
| |
Parent class to represent objects for storage and retrieval.
Instances must be subclasses of SResult. See registerClass().
Subclasses must define a constructor that takes kwargs of
attributes to build itself. The storage engine, calls
SResult.__str__() to serialize instance variables and self.attrs
as simple attr="val" strings, which are then passed back into the
constructor on get().
If you require more complex object storage/retrieval that a
dictionary of strings, override __str__ to write out your object
as needed, and change the constructor to handle that string back
into your object.
|
| |
Methods defined here:
- __init__(self, **kwargs)
- __str__(self)
|
class SSession |
| |
Represents a session to a Splunk instance
|
| |
Methods defined here:
- __init__(self, hostpath='localhost:8089', username='none', password='none', namespace='search')
- Constructor with various optional arguments
- hostpath: the Splunk host and port (e.g. myremotemachine:8089). Defaults to localhost:8089
- username: username (not required for Free licenses)
- password: password (not required for Free licenses)
- namespace: namespace/app to use for configuration. Defaults to 'search'.
- get(self, classes=None, **kwargs)
- Generates a search from the disjunction of classes and the
conjunction of kwargs, returning an SJob to retrieve the
results. The value of "postsearch" kwargs will be appended to
the search.
For example, if get() is called with:
get(classes=['Users', 'Servers'], company="IBM", postsearch="dedup name")
then the splunk search executed will be:
search (classname="Users" OR classname="Servers") company="IBM" | dedup names
- put(self, results)
- Asynchronously writes out the list of results to a Splunk
index, where results are a instances of a subclass of SResult.
If setSynchronous is set to true, get() will block until all
data from the last put() has finished indexed.
- setSynchronous(self, newval)
- Sets synchronicity, returns old value. If set to True, a
get() will block until all data from the last put() has
finished indexed.
| |