Skip to content

Commit

Permalink
Merge pull request #425 from splunk/fix-biased-language-example
Browse files Browse the repository at this point in the history
Remove biased language example, replace with saved search
  • Loading branch information
fantavlik committed Apr 19, 2022
2 parents e162cc0 + e457e58 commit fa7b2a8
Showing 1 changed file with 9 additions and 20 deletions.
29 changes: 9 additions & 20 deletions splunklib/client.py
Original file line number Diff line number Diff line change
Expand Up @@ -859,32 +859,21 @@ class Entity(Endpoint):
``Entity`` provides the majority of functionality required by entities.
Subclasses only implement the special cases for individual entities.
For example for deployment serverclasses, the subclass makes whitelists and
blacklists into Python lists.
For example for saved searches, the subclass makes fields like ``action.email``,
``alert_type``, and ``search`` available.
An ``Entity`` is addressed like a dictionary, with a few extensions,
so the following all work::
ent['email.action']
ent['disabled']
ent['whitelist']
Many endpoints have values that share a prefix, such as
``email.to``, ``email.action``, and ``email.subject``. You can extract
the whole fields, or use the key ``email`` to get a dictionary of
all the subelements. That is, ``ent['email']`` returns a
dictionary with the keys ``to``, ``action``, ``subject``, and so on. If
there are multiple levels of dots, each level is made into a
subdictionary, so ``email.body.salutation`` can be accessed at
``ent['email']['body']['salutation']`` or
``ent['email.body.salutation']``.
so the following all work, for example in saved searches::
ent['action.email']
ent['alert_type']
ent['search']
You can also access the fields as though they were the fields of a Python
object, as in::
ent.email.action
ent.disabled
ent.whitelist
ent.alert_type
ent.search
However, because some of the field names are not valid Python identifiers,
the dictionary-like syntax is preferable.
Expand Down

0 comments on commit fa7b2a8

Please sign in to comment.