com.splunk

Class Event

java.lang.Object

java.util.AbstractMap<K,V>

java.util.HashMap<java.lang.String,java.lang.String>

com.splunk.Event

All Implemented Interfaces:

java.io.Serializable, java.lang.Cloneable, java.util.Map<java.lang.String,java.lang.String>

public class Event
extends java.util.HashMap<java.lang.String,java.lang.String>

The Event class wraps an individual event or result that was returned by the ResultsReader.getNextEvent() method.

An event maps each field name to a list of zero of more values. These values can be accessed as either an array (using the getArray(java.lang.String) method) or as a delimited string (using the get(java.lang.String) method). We recommend accessing values as an array when possible.

The delimiter for field values depends on the underlying result format. If the underlying format does not specify a delimiter, such as with the ResultsReaderXml class, the delimiter is a comma (,).

See Also:

Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class java.util.AbstractMap

java.util.AbstractMap.SimpleEntry<K,V>, java.util.AbstractMap.SimpleImmutableEntry<K,V>

Nested classes/interfaces inherited from interface java.util.Map

java.util.Map.Entry<K,V>

Method Summary

Modifier and Type	Method and Description
void	clear()
java.lang.Object	clone()
java.lang.String	get(java.lang.String key) Returns the single value or delimited set of values for the specified field name, or null if the specified field is not present.
java.lang.String[]	getArray(java.lang.String key) Gets the values for the specified field name.
java.lang.String[]	getArray(java.lang.String key, java.lang.String delimiter) Gets the values for the specified field name.
java.lang.String	getSegmentedRaw() Gets the XML markup for the "_raw" field value.
java.lang.String	put(java.lang.String key, java.lang.String value)
void	putAll(java.util.Map<? extends java.lang.String,? extends java.lang.String> m)
java.lang.String	remove(java.lang.Object key)

Methods inherited from class java.util.HashMap

compute, computeIfAbsent, computeIfPresent, containsKey, containsValue, entrySet, forEach, get, getOrDefault, isEmpty, keySet, merge, putIfAbsent, remove, replace, replace, replaceAll, size, values

Methods inherited from class java.util.AbstractMap

equals, hashCode, toString

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.Map

equals, hashCode

Method Detail

get

public java.lang.String get(java.lang.String key)

Returns the single value or delimited set of values for the specified field name, or null if the specified field is not present. When getting a multi-valued field, use the getArray(String) or getArray(String, String) method instead.

Parameters:

key - The field name.

Returns:

The single value or delimited set of values.

getArray

public java.lang.String[] getArray(java.lang.String key)

Gets the values for the specified field name.

Caution: This variant of getArray(String, String) is unsafe for ResultsReader implementations that require a delimiter. Therefore, this method should only be used for results that are returned by ResultsReaderXml. For other readers, use the getArray(String, String) method instead.

If the underlying ResultsReader object has no delimiter, the original array of values is returned. If the object does have a delimiter, the single/delimited value is assumed to be a single value and is returned as a single-valued array.

Parameters:

key - The field name.

Returns:

The original array of values if there is no delimiter, or the single-valued array.

getArray

public java.lang.String[] getArray(java.lang.String key,
                                   java.lang.String delimiter)

Gets the values for the specified field name. The delimiter must be determined empirically based on the search string and the data format of the index. The delimiter can differ between fields in the same Event object. The delimiter is ignored for ResultsReader implementations that do not require a delimiter, such as ResultsReaderXml. If the underlying ResultsReader object has no delimiter, the original array of values is returned (and the specified delimiter is ignored). If the object does have a delimiter, the single/delimited value is split based on the specified delimiter and is returned as an array.

Parameters:

key - The field name.

delimiter - The delimiter.

Returns:

The original array of values if there is no delimiter, or the array of values split by delimiter.

getSegmentedRaw

public java.lang.String getSegmentedRaw()

Gets the XML markup for the "_raw" field value. This value is only used by the ResultsReaderXml class.

The return value is different than that of get("_raw") in that this segmented raw value is an XML fragment that includes all markup such as XML tags and escaped characters.

For example, get("_raw") returns this:

"http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt"

The getSegmentedRaw method returns this:

<v xml:space="preserve" trunc="0">"http://localhost:8000/en-US/app/<sg h=\"1\">search</sg>/flashtimeline?q=<sg h=\"1\">search</sg>%20<sg h=\"1\">search</sg>%20index%3D_internal%20%7C%20head%2010&amp;earliest=rt-1h&amp;latest=rt"</v>

Returns:

the segmented raw xml including tags and escaped characters.

clear

public void clear()

Specified by:

clear in interface java.util.Map<java.lang.String,java.lang.String>

Overrides:

clear in class java.util.HashMap<java.lang.String,java.lang.String>

clone

public java.lang.Object clone()

Overrides:

clone in class java.util.HashMap<java.lang.String,java.lang.String>

put

public java.lang.String put(java.lang.String key,
                            java.lang.String value)

Specified by:

put in interface java.util.Map<java.lang.String,java.lang.String>

Overrides:

put in class java.util.HashMap<java.lang.String,java.lang.String>

putAll

public void putAll(java.util.Map<? extends java.lang.String,? extends java.lang.String> m)

Specified by:

putAll in interface java.util.Map<java.lang.String,java.lang.String>

Overrides:

putAll in class java.util.HashMap<java.lang.String,java.lang.String>

remove

public java.lang.String remove(java.lang.Object key)

Specified by:

remove in interface java.util.Map<java.lang.String,java.lang.String>

Overrides:

remove in class java.util.HashMap<java.lang.String,java.lang.String>