class Splunk::Collection

Class representing a collection in Splunk.

A Collection is a group of items, usually of class Entity or one of its subclasses, but occasionally another Collection. Usually you obtain a Collection by calling one of the convenience methods on Service.

A Collection is enumerable, and implements many of the methods found on Hash, so methods like each, select, and delete_if all work, as does fetching a member of the Collection with [].

Public Instance Methods

create(name, args={}) click to toggle source

Creates an item in this collection.

The name argument is required. All other arguments are passed as a hash, though they vary from collection to collection.

Returns: the created entity.


service = Splunk::connect(:username => 'admin', :password => 'foo')
  :password => 'mypassword',
  :realname => 'Jack_be_nimble',
  :roles => ['user'])
# File lib/splunk-sdk-ruby/collection.rb, line 342
def create(name, args={})
  body_args = args.clone()
  body_args["name"] = name

  request_args = {
      :method => :POST,
      :resource => @resource,
      :body => body_args
  if args.has_key?(:namespace)
    request_args[:namespace] = body_args.delete(:namespace)

  response = @service.request(request_args)

  if @always_fetch
    fetch_args = {:method => :GET,
                  :resource => @resource + [name]}
    if args.has_key?(:namespace)
      fetch_args[:namespace] = args[:namespace]
    response = @service.request(fetch_args)
  feed =
  raise"No entities returned") if feed.entries.empty?
  entity = atom_entry_to_entity(feed.entries[0])
  raise"Found nil entity.") if entity.nil?
  return entity
delete(name, namespace=nil) click to toggle source

Deletes an item from the collection.

Entities from different namespaces may have the same name, so if you are connected to Splunk using a namespace with wildcards in it, there may be multiple entities in the collection with the same name. In this case you must specify a namespace as well, or the delete method will raise an AmbiguousEntityReference error.


service = Splunk::connect(:username => 'admin', :password => 'foo')
props = service.confs['props']
# File lib/splunk-sdk-ruby/collection.rb, line 386
def delete(name, namespace=nil)
  if namespace.nil?
    namespace = @service.namespace

  # We don't want to handle any cases about deleting ambiguously named
  # entities.
  if !namespace.is_exact?
    raise"Must provide an exact namespace to delete an entity.")

  @service.request(:method => :DELETE,
                   :namespace => namespace,
                   :resource => @resource + [name])
  return self
delete_if(&block) click to toggle source

Deletes all entities on this collection for which the block returns true.

If block is omitted, returns an enumerator over all members of the collection.

# File lib/splunk-sdk-ruby/collection.rb, line 409
def delete_if(&block)
  # Without a block, just return an enumerator
  return each() if !block_given?

  values.each() do |entity|
      delete(, entity.namespace)