SplunkRESTManager
all()
The all() method gets the entire set of model objects for all models in scope.
Use this method in combination with SplunkQuerySet.filter(), SplunkQuerySet.filter_by_app(), SplunkQuerySet.filter_by_user(), and SplunkQuerySet.search() to populate lists or locate specific entities from the pool of models in scope.
Synopsis
querySet = all()
Return Value
| Object | A SplunkQuerySet object containing a list of all models in scope. |
get()
The get() method loads the model object for the specified REST entity. The REST entity is specified using the entity URI. If id is not provided, the default model resource is used. If there is no default resource or the entity cannot be loaded, the method returns None.
This method is the most convenient and preferred way to load a single entity into a model.
Synopsis
results = get( id )
Parameters
| id | String | REST API entity path. |
Return Value
| Object None | Model object for entity id, or None if the entity cannot be loaded. |
Example
from splunk.models.base import SplunkRESTModel
required_keys = ['web-traffic', 'clientip-internal', 'internal-domain']
class MyAppModel(SplunkRESTModel):
def show(self, **kwargs):
form_content = {}
for key in required_keys:
try:
form_content[key] = self.get(
'/servicesNS/%s/%s/saved/eventtypes/%s' \
% (user, 'myapp', key))
except:
form_content[key] = {'search': }
return form_content)
order_by()
The order_by() method gets a clone of the current result set, ordered by the specified model field and sorting order.
Synopsis
clone = order_by( key, direction)
Parameters
| key | String | Key to sort on. |
| direction | String | Sort dirrection: asc = Ascending order. desc = Descending order. |
Return Value
| Object | A clone of the current SplunkRESTManager object sorted by key and direction. |
Example
from splunk.models.base import SplunkRESTManager
class MyAppModel(SplunkRESTManager):
See Also
search()
The search() method gets a clone of the current query set constrained by the specified search_string. This method is used to perform free text search against a SplunkQuerySet to limit the results returned.
Synopsis
clone = search( search_string )
Parameters
| search_string | String | Search string by which to constrain the results. |
Return Value
| Object | Clone of the current SplunkQuerySet with only members that match the specified search_string. |
Example
from splunk.models.base import SplunkRESTManager
from splunk.models.fired_alert import FiredAlert, FiredAlertSummary
class MyAppModel(SplunkRESTManager):
def index(self, app, **params):
... elided ...
if not 'alerts_id' in params:
fired_alerts = FiredAlert.all()
else:
fired_alerts = FiredAlert.get_alerts(
urllib.unquote_plus(params.get('alerts_id')))
# augment query with search
if len(search_string) > 0:
fired_alerts = fired_alerts.search(' '.join(search_string))
... elided ...
See Also
| ObjectMetadataModel | SplunkQuerySet |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9
Download manual
Feedback submitted, thanks!