com.splunk

Class Event

java.lang.Object

java.util.AbstractMap<K,V>

java.util.HashMap<String,String>

com.splunk.Event

All Implemented Interfaces:

Serializable, Cloneable, Map<String,String>

public class Event
extends HashMap<String,String>

The Event class wraps an individual event or result that was returned by the ResultsReader.getNextEvent() method.

An event maps each field name to a list of zero of more values. These values can be accessed as either an array (using the getArray(java.lang.String) method) or as a delimited string (using the get(java.lang.String) method). We recommend accessing values as an array when possible.

The delimiter for field values depends on the underlying result format. If the underlying format does not specify a delimiter, such as with the ResultsReaderXml class, the delimiter is a comma (,).

See Also:

Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class java.util.AbstractMap

AbstractMap.SimpleEntry<K,V>, AbstractMap.SimpleImmutableEntry<K,V>

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K,V>

Method Summary

Modifier and Type	Method and Description
void	clear()
Object	clone()
String	get(String key) Returns the single value or delimited set of values for the specified field name, or null if the specified field is not present.
String[]	getArray(String key) Gets the values for the specified field name.
String[]	getArray(String key, String delimiter) Gets the values for the specified field name.
String	getSegmentedRaw() Gets the XML markup for the "_raw" field value.
String	put(String key, String value)
void	putAll(Map<? extends String,? extends String> m)
String	remove(Object key)

Methods inherited from class java.util.HashMap

compute, computeIfAbsent, computeIfPresent, containsKey, containsValue, entrySet, forEach, get, getOrDefault, isEmpty, keySet, merge, putIfAbsent, remove, replace, replace, replaceAll, size, values

Methods inherited from class java.util.AbstractMap

equals, hashCode, toString

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.Map

equals, hashCode

Method Detail

get

public String get(String key)

Returns the single value or delimited set of values for the specified field name, or null if the specified field is not present. When getting a multi-valued field, use the getArray(String) or getArray(String, String) method instead.

Parameters:

key - The field name.

Returns:

The single value or delimited set of values.

getArray

public String[] getArray(String key)

Gets the values for the specified field name.

Caution: This variant of getArray(String, String) is unsafe for ResultsReader implementations that require a delimiter. Therefore, this method should only be used for results that are returned by ResultsReaderXml. For other readers, use the getArray(String, String) method instead.

If the underlying ResultsReader object has no delimiter, the original array of values is returned. If the object does have a delimiter, the single/delimited value is assumed to be a single value and is returned as a single-valued array.

Parameters:

key - The field name.

Returns:

The original array of values if there is no delimiter, or the single-valued array.

getArray

public String[] getArray(String key,
                         String delimiter)

Gets the values for the specified field name. The delimiter must be determined empirically based on the search string and the data format of the index. The delimiter can differ between fields in the same Event object. The delimiter is ignored for ResultsReader implementations that do not require a delimiter, such as ResultsReaderXml. If the underlying ResultsReader object has no delimiter, the original array of values is returned (and the specified delimiter is ignored). If the object does have a delimiter, the single/delimited value is split based on the specified delimiter and is returned as an array.

Parameters:

key - The field name.

delimiter - The delimiter.

Returns:

The original array of values if there is no delimiter, or the array of values split by delimiter.

getSegmentedRaw

public String getSegmentedRaw()

Gets the XML markup for the "_raw" field value. This value is only used by the ResultsReaderXml class.

The return value is different than that of get("_raw") in that this segmented raw value is an XML fragment that includes all markup such as XML tags and escaped characters.

For example, get("_raw") returns this:

"http://localhost:8000/en-US/app/search/flashtimeline?q=search%20search%20index%3D_internal%20%7C%20head%2010&earliest=rt-1h&latest=rt"

The getSegmentedRaw method returns this:

<v xml:space="preserve" trunc="0">"http://localhost:8000/en-US/app/<sg h=\"1\">search</sg>/flashtimeline?q=<sg h=\"1\">search</sg>%20<sg h=\"1\">search</sg>%20index%3D_internal%20%7C%20head%2010&amp;earliest=rt-1h&amp;latest=rt"</v>

Returns:

the segmented raw xml including tags and escaped characters.

clear

public void clear()

Specified by:

clear in interface Map<String,String>

Overrides:

clear in class HashMap<String,String>

clone

public Object clone()

Overrides:

clone in class HashMap<String,String>

put

public String put(String key,
                  String value)

Specified by:

put in interface Map<String,String>

Overrides:

put in class HashMap<String,String>

putAll

public void putAll(Map<? extends String,? extends String> m)

Specified by:

putAll in interface Map<String,String>

Overrides:

putAll in class HashMap<String,String>

remove

public String remove(Object key)

Specified by:

remove in interface Map<String,String>

Overrides:

remove in class HashMap<String,String>