IihUSrSSKrSSKrSSKrSSKrSSKrSSKrSSKJrJr SSKJ r SSK J r SSK J r SSKJr SSKJrJrJrJrJrJrJrJr \R2"\5r/S QrS rS rS rS r Sr!Sr"Sr#Sr$Sr%Sr&Sr'Sr(Sr)Sr*Sr+Sr,Sr-Sr.Sr/Sr0Sr1Sr2S r3S!r4S"r5S#r6\6S$-r7\6S%-r8\7S&\8S'3r9"S(S)\:5r;"S*S+\:5r<"S,S-\=5r>"S.S/\:5r?"S0S1\:5r@"S2S3\:5rA"S4S5\:5rBS6rCS7rDS8rESS9jrFS:rGS;rHS<rIS=rJS>rK"S?S@\5rL"SASB\L5rM"SCSD5rN"SESF\N5rO"SGSH\N5rP"SISJ\P5rQ"SKSL\Q5rR"SMSN\Q5rS"SOSP\O5rT"SQSR\O5rU"SSST\Q5rV"SUSV\O5rW"SWSX\Q5rX"SYSZ\O5rY"S[S\\O5rZ"S]S^\Q5r["S_S`\O5r\"SaSb\Q5r]"ScSd\Q5r^"SeSf\O5r_"SgSh\O5r`"SiSj\O5ra"SkSl\Q5rb"SmSn\O5rc"SoSp\Q5rd"SqSr\O5re"SsSt\O5rf"SuSv\Q5rg"SwSx\O5rh"SySz\Q5ri"S{S|\O5rj"S}S~\Q5rk"SS\O5rl"SS5rmg)aThe **splunklib.client** module provides a Pythonic interface to the `Splunk REST API `_, allowing you programmatically access Splunk's resources. **splunklib.client** wraps a Pythonic layer around the wire-level binding of the **splunklib.binding** module. The core of the library is the :class:`Service` class, which encapsulates a connection to the server, and provides access to the various aspects of Splunk's functionality, which are exposed via the REST API. Typically you connect to a running Splunk instance with the :func:`connect` function:: import splunklib.client as client service = client.connect(host='localhost', port=8089, username='admin', password='...') assert isinstance(service, client.Service) :class:`Service` objects have fields for the various Splunk resources (such as apps, jobs, saved searches, inputs, and indexes). All of these fields are :class:`Collection` objects:: appcollection = service.apps my_app = appcollection.create('my_app') my_app = appcollection['my_app'] appcollection.delete('my_app') The individual elements of the collection, in this case *applications*, are subclasses of :class:`Entity`. An ``Entity`` object has fields for its attributes, and methods that are specific to each kind of entity. For example:: print(my_app['author']) # Or: print(my_app.author) my_app.package() # Creates a compressed package of this application N)datetime timedelta)sleep)parse)data)record)AuthenticationErrorContext HTTPError UrlEncoded_encode_make_cookie_header_NoAuthenticationToken namespace)connectNotSupportedErrorOperationErrorIncomparableExceptionServicerr z apps/local/zauthorization/capabilities/zconfigs/conf-%s/z properties/zdeployment/client/zdeployment/tenants/zdeployment/server/zdeployment/serverclass/zsaved/eventtypes/zalerts/fired_alerts/z data/indexes/z data/inputs/z search/jobs/zsearch/v2/jobs/z/services/server/logger/zconfigs/conf-macros/z messages/zdata/modular-inputszauthorization/roles/zsaved/searches/zconfigs/conf-%s/%szauthentication/users/z/services/receivers/streamz/services/receivers/simplezstorage/passwordsz{http://www.w3.org/2005/Atom}%sentrycontent/z/*c\rSrSrSrSrg)IllegalOperationExceptionzzoThrown when an operation is not possible on the Splunk instance that a :class:`Service` object is connected to.N__name__ __module__ __qualname____firstlineno____doc____static_attributes__r6/venv/lib/python3.13/site-packages/splunklib/client.pyrrzs0r$rc\rSrSrSrSrg)rzpThrown when trying to compare objects (using ``==``, ``<``, ``>``, and so on) of a type that doesn't support it.rNrrr$r%rrs1r$rc\rSrSrSrSrg)AmbiguousReferenceExceptionzJThrown when the name used to fetch an entity matches more than one entity.rNrrr$r%r)r)sTr$r)c\rSrSrSrSrg)InvalidNameExceptionz_Thrown when the specified name contains characters that are not allowed in Splunk entity names.rNrrr$r%r,r,sr$r,c\rSrSrSrSrg)NoSuchCapabilityzCThrown when the capability that has been referred to doesn't exist.rNrrr$r%r/r/sMr$r/c\rSrSrSrSrg)rz1Raised for a failed operation, such as a timeout.rNrrr$r%rrs;r$rc\rSrSrSrSrg)rz?Raised for operations that are not supported on a given object.rNrrr$r%rrsIr$rcUnUH;nURU5nUS:Xa[SU-S-5eX$[U5-SnM= U$)aSubstring of *template* following all *targets*. **Example**:: template = "this is a test of the bunnies." _trailing(template, "is", "est", "the") == " bunnies" Each target is matched successively in the string, and the string remaining after the last target is returned. If one of the targets fails to match, a ValueError is raised. :param template: Template to extract a trailing string from. :type template: ``string`` :param targets: Strings to successively match in *template*. :type targets: list of ``string``s :return: Trailing string after all targets are matched. :rtype: ``string`` :raises ValueError: Raised when one of the targets does not match. zTarget z not found in template.N)find ValueErrorlen)templatetargetsstns r% _trailingr?sT( A  FF1I 7Y]-FFG G #a&jkN  Hr$c^[U5S:a[U4SjU55$[STR555$)Nrc30># UH oTU4v M g7fNr).0krs r% "_filter_content..s4t!'!*otsc3<# UHupUS;dM X4v M g7f))eai:acleai:attributestypeNrrCrDvs r%rErFs%E_TQCC1&_  )r9ritems)rargss` r%_filter_contentrPsB 4y1}4t444 EW]]_E EEr$c@URS5(dUS-nX-$)Nr)endswith)basenames r%_pathrUs! ==  dSjt ;r$c[R"URR5R SS5U5$)Nutf-8xmlcharrefreplace)rloadbodyreaddecode)responsematchs r% _load_atomr_s3 99X]]'')fW&9:E CCr$c:[U5nSU;a[URRS5S;a/$URRSS5nUcg[U[5(aU$U/$URSS5nUcg[U[5(aU$U/$)Nfeed totalResults)r0r)r_raget isinstancelist)r]rentriess r%_load_atom_entriesris8A { 66::n % 1I&&**Wd+ ?4$Wd33wB'B eeGT"Gt $//7>gY>r$cUS:Xa?[R"URR55nUR S5$[ U5R R$)Njsonsid)rkloadsrZr[rdr_r]rl)r] output_modejson_objs r% _load_sidrpsKf::hmm0023||E"" h  ( ( , ,,r$c URSS5nURS/5n[U[5(aUOU/n[SU55nURS05n[ U5n[SUR 555nSU;a[US[5(abUSVs/sH ofS:wdM UPM snUS'[ US5S:XaURSS5 [ US5S :Xa USSUS'OURSS5 [UUURURUURS 5S .5$s snf) Ntitlelinkc3P# UHoRUR4v M g7frB)relhref)rCrss r%rE$_parse_atom_entry..s;UTHHdii(Us$&rc3<# UHupUS;dM X4v M g7f))rHrINrrKs r%rErws%@!>>aVrMrJztext/xmlrupdated)rrlinksaccessfieldsrrz) rdrerfr_parse_atom_metadatarNr9popr|r})rrrelinkr{rmetadatar=s r%_parse_atom_entryrsM IIgt $E IIfb !Et,,E5'E ;U; ;Eii 2&G$G,H@ @@G gfot , ,*1&/M/Q*_q/MGFO76?#q( FD)76?#q(")&/!"4 KK % ////99Y'  Ns 3 EEcURSS5nURS05n[URS/5URS/5URS/5S.5n[XS.5$)NrHrIrequiredFieldsoptionalFieldswildcardFields)requiredoptionalwildcard)r|r})rdr)rr| attributesr}s r%r~r~sq [[D )F-r2J NN#3R8NN#3R8NN#3R8:;F V6 77r$c <[S0UD6nUR5 U$)aThis function connects and logs in to a Splunk instance. This function is a shorthand for :meth:`Service.login`. The ``connect`` function makes one round trip to the server (for logging in). :param host: The host name (the default is "localhost"). :type host: ``string`` :param port: The port number (the default is 8089). :type port: ``integer`` :param scheme: The scheme for accessing the service (the default is "https"). :type scheme: "https" or "http" :param verify: Enable (True) or disable (False) SSL verification for https connections. (optional, the default is True) :type verify: ``Boolean`` :param `owner`: The owner context of the namespace (optional). :type owner: ``string`` :param `app`: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode for the namespace (the default is "user"). :type sharing: "global", "system", "app", or "user" :param `token`: The current session token (optional). Session tokens can be shared across multiple service instances. :type token: ``string`` :param cookie: A session cookie. When provided, you don't need to call :meth:`login`. This parameter is only supported for Splunk 6.2+. :type cookie: ``string`` :param autologin: When ``True``, automatically tries to log in again if the session terminates. :type autologin: ``boolean`` :param `username`: The Splunk account username, which is used to authenticate the Splunk instance. :type username: ``string`` :param `password`: The password for the Splunk account. :type password: ``string`` :param retires: Number of retries for each HTTP connection (optional, the default is 0). NOTE THAT THIS MAY INCREASE THE NUMBER OF ROUND TRIP CONNECTIONS TO THE SPLUNK SERVER. :type retries: ``int`` :param retryDelay: How long to wait between connection attempts if `retries` > 0 (optional, defaults to 10s). :type retryDelay: ``int`` (in seconds) :param `context`: The SSLContext that can be used when setting verify=True (optional) :type context: ``SSLContext`` :return: An initialized :class:`Service` connection. **Example**:: import splunklib.client as client s = client.connect(...) a = s.apps["my_app"] ... r)rlogin)kwargsr<s r%rrs f &AGGI Hr$c\rSrSrSrg) _BaseServicei]rN)rrr r!r#rr$r%rr]sr$rc^\rSrSrSrU4Sjr\S5r\S5r\S5r \S5r \S5r \S 5r \S 5r S#S jr\S 5rS r\S5r\S5r\S5r\S5r\S5rSrS#Sjr\S5r\S5rSr\S5r\S5r\S5r\S5r\S5r\S5r \S5r!\!RDS5r!\S 5r#\S!5r$S"r%U=r&$)$riaa A Pythonic binding to Splunk instances. A :class:`Service` represents a binding to a Splunk instance on an HTTP or HTTPS port. It handles the details of authentication, wire formats, and wraps the REST API endpoints into something more Pythonic. All of the low-level operations on the instance from :class:`splunklib.binding.Context` are also available in case you need to do something beyond what is provided by this class. After creating a ``Service`` object, you must call its :meth:`login` method before you can issue requests to Splunk. Alternately, use the :func:`connect` function to create an already authenticated :class:`Service` object, or provide a session token when creating the :class:`Service` object explicitly (the same token may be shared by multiple :class:`Service` objects). :param host: The host name (the default is "localhost"). :type host: ``string`` :param port: The port number (the default is 8089). :type port: ``integer`` :param scheme: The scheme for accessing the service (the default is "https"). :type scheme: "https" or "http" :param verify: Enable (True) or disable (False) SSL verification for https connections. (optional, the default is True) :type verify: ``Boolean`` :param `owner`: The owner context of the namespace (optional; use "-" for wildcard). :type owner: ``string`` :param `app`: The app context of the namespace (optional; use "-" for wildcard). :type app: ``string`` :param `token`: The current session token (optional). Session tokens can be shared across multiple service instances. :type token: ``string`` :param cookie: A session cookie. When provided, you don't need to call :meth:`login`. This parameter is only supported for Splunk 6.2+. :type cookie: ``string`` :param `username`: The Splunk account username, which is used to authenticate the Splunk instance. :type username: ``string`` :param `password`: The password, which is used to authenticate the Splunk instance. :type password: ``string`` :param retires: Number of retries for each HTTP connection (optional, the default is 0). NOTE THAT THIS MAY INCREASE THE NUMBER OF ROUND TRIP CONNECTIONS TO THE SPLUNK SERVER. :type retries: ``int`` :param retryDelay: How long to wait between connection attempts if `retries` > 0 (optional, defaults to 10s). :type retryDelay: ``int`` (in seconds) :return: A :class:`Service` instance. **Example**:: import splunklib.client as client s = client.Service(username="boris", password="natasha", ...) s.login() # Or equivalently s = client.connect(username="boris", password="natasha") # Or if you already have a session token s = client.Service(token="atg232342aa34324a") # Or if you already have a valid cookie s = client.Service(cookie="splunkd_8089=...") c P>[TU]"S0UD6 SUlSUlSUlgNr)super__init___splunk_version_kvstore_owner_instance_type)selfr __class__s r%rService.__init__s+ "6"#""r$c([U[[S9$)zReturns the collection of applications that are installed on this instance of Splunk. :return: A :class:`Collection` of :class:`Application` entities. item) Collection PATH_APPS Applicationrs r%apps Service.appss $ <s/$--?Baab <"4<<=> ?M )llnu$t+  ,,!M-llnu$t+-.. a s"C C0 C++C0c$URS5RR5n[R"U5SnSU;aSnU$[ US[ 5(a USS/nOUSVs/sHoUSPM nnSU;nU$s snf)zIndicates whether splunkd is in a state that requires a restart. :return: A ``boolean`` that indicates whether a restart is required. rrarFrrr)rdrZr[rrYredict)rr]rrtitlesxs r%rService.restart_required[s88J',,11399X&v. ( "F (7+T22"7+G45.6w.?@.?G*.?@'61F As6B c[U5$)zgReturns the collection of user roles. :return: A :class:`Roles` collection of :class:`Role` entities. )Rolesrs r%roles Service.rolesn T{r$c <URR"U40UD6$)aRuns a search using a search query and any optional arguments you provide, and returns a `Job` object representing the search. :param query: A search query. :type query: ``string`` :param kwargs: Arguments for the search (optional): * "output_mode" (``string``): Specifies the output format of the results. * "earliest_time" (``string``): Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * "latest_time" (``string``): Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. * "rf" (``string``): Specifies one or more fields to add to the search. :type kwargs: ``dict`` :rtype: class:`Job` :returns: An object representing the created job. )rrrs r%searchService.searchvs<yy000r$c[U5$)z~Returns the collection of saved searches. :return: A :class:`SavedSearches` collection of :class:`SavedSearch` entities. ) SavedSearchesrs r%saved_searchesService.saved_searchessT""r$c[U5$)ziReturns the collection of macros. :return: A :class:`Macros` collection of :class:`Macro` entities. )Macrosrs r%macrosService.macrossd|r$c[U5$)zReturns the configuration settings for this instance of Splunk. :return: A :class:`Settings` object containing configuration settings. )Settingsrs r%settingsService.settingss ~r$cURc3[SURSRS555UlUR$)zReturns the version of the splunkd instance this object is attached to. The version is returned as a tuple of the version components as integers (for example, `(4,3,3)` or `(5,)`). :return: A ``tuple`` of ``integers``. c38# UHn[U5v M g7frB)int)rCps r%rE)Service.splunk_version..s(Y9XAQ9Xsversion.)rtuplersplitrs r%rService.splunk_versionsD    '#((Y99M9S9STW9X(Y#YD ###r$cURc:URn[US5(aUSUlUR$SUlUR$)N instance_type)rrhasattr)r splunk_infos r%splunk_instanceService.splunk_instancesU    &))K{O44&1/&B#"""')#"""r$czURR5S:XaURS:$URS:$)Ncloud) ri)r.r)r*lowerrrs r%rService.disable_v2_apis;    % % '7 2&&3 3""W,,r$cBURcSUlUR$)zReturns the KVStore owner for this instance of Splunk. By default is the kvstore owner is not set, it will return "nobody" :return: A string with the KVStore owner. nobody)rrs r% kvstore_ownerService.kvstore_owners$    &"*D """r$c(XlUR g)z7 kvstore is refreshed, when the owner value is changed N)rkvstorerrs r%r4r5s $ r$cJURURS'[U5$)zReturns the collection of KV Store collections. sets the owner for the namespace, before retrieving the KVStore Collection :return: A :class:`KVStoreCollections` collection of :class:`KVStoreCollection` entities. owner)r4rKVStoreCollectionsrs r%r7Service.kvstores##'"4"4w!$''r$c[U5$)zbReturns the collection of users. :return: A :class:`Users` collection of :class:`User` entities. )Usersrs r%users Service.usersr r$)rrrrB)'rrr r!r"rpropertyrrrrrrrrrrrrrrrrrrr r rrrrr*rr4setterr7r?r# __classcell__rs@r%rras*;z# ==$$FF22DD77JJ6(==ee&&<6/:$1@## $ $##-- ##((r$rc8\rSrSrSrSrSrS SjrS SjrSr g) EndpointiaThis class represents individual Splunk resources in the Splunk REST API. An ``Endpoint`` object represents a URI, such as ``/services/saved/searches``. This class provides the common functionality of :class:`Collection` and :class:`Entity` (essentially HTTP GET and POST methods). cXlX lgrB)servicerrrHrs r%rEndpoint.__init__s   r$czSn[R"SU5nU(a[URS55nU$)zReturn the API version of the service used in the provided path. Args: path (str): A fully-qualified endpoint path (for example, "/services/search/jobs"). Returns: int: Version of the API (for example, 1) ryz6(?:servicesNS\/[^/]+\/[^/]+|services)\/[^/]+\/v(\d+)\/)rer rgroup)rr api_version versionSearchs r%get_api_versionEndpoint.get_api_versions9  "Z\`a m11!45Kr$Nc URS5(aUnObURRS5(dUS:waURS-UlURR URU-UX4S9nUR U5nUS:XaR[ U[5(a#[UR[[5SS9nOUR[[5nURR"U4X#US.UD6$)aPerforms a GET operation on the path segment relative to this endpoint. This method is named to match the HTTP method. This method makes at least one roundtrip to the server, one additional round trip for each 303 status returned, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. If *owner*, *app*, and *sharing* are omitted, this method takes a default namespace from the :class:`Service` object for this :class:`Endpoint`. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Service`` is not logged in. :raises HTTPError: Raised when an error in the request occurs. :param path_segment: A path segment relative to this endpoint. :type path_segment: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode for the namespace (optional). :type sharing: "global", "system", "app", or "user" :param query: All other keyword arguments, which are used as query parameters. :type query: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: import splunklib.client s = client.service(...) apps = s.apps apps.get() == \ {'body': ...a response reader object..., 'headers': [('content-length', '26208'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 16:30:35 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'status': 200} apps.get('nonexistant/path') # raises HTTPError s.logout() apps.get() # raises AuthenticationError rr'r:appsharingryT skip_encode) startswithrrRrH_abspathrPrer replace PATH_JOBS_V2 PATH_JOBSrdr path_segmentr:rTrUrrrNs r%rd Endpoint.getsj  " "3 ' 'D99%%c**|r/A IIO <<((\)A-0)CD **40  ! $ ++!$,,|Y"GUYZ||L)<||)&+g)"') )r$c URS5(aUnObURRS5(dUS:waURS-UlURR URU-X#US9nUR U5nUS:XaR[ U[5(a#[UR[[5SS9nOUR[[5nURR"U4X#US.UD6$)aPerforms a POST operation on the path segment relative to this endpoint. This method is named to match the HTTP method. This method makes at least one roundtrip to the server, one additional round trip for each 303 status returned, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. If *owner*, *app*, and *sharing* are omitted, this method takes a default namespace from the :class:`Service` object for this :class:`Endpoint`. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Service`` is not logged in. :raises HTTPError: Raised when an error in the request occurs. :param path_segment: A path segment relative to this endpoint. :type path_segment: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode of the namespace (optional). :type sharing: ``string`` :param query: All other keyword arguments, which are used as query parameters. :type query: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: import splunklib.client s = client.service(...) apps = s.apps apps.post(name='boris') == \ {'body': ...a response reader object..., 'headers': [('content-length', '2908'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 18:34:50 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'Created', 'status': 201} apps.get('nonexistant/path') # raises HTTPError s.logout() apps.get() # raises AuthenticationError rr'rSryTrV) rXrrRrHrYrPrer rZr[r\rr]s r%r Endpoint.postfsb  " "3 ' 'D99%%c**|r/A IIO <<((\)Aah(iD**40  ! $ ++!$,,|Y"GUYZ||L)<||  VUWVPUVVr$)rrHr'NNN) rrr r!r"rrPrdrr#rr$r%rFrFs&P)dGWr$rFc^\rSrSrSr0rSrSrSrSr Sr Sr S r S r SS jrS rSU4S jjrSU4SjjrSSjr\S5r\S5rSrSr\S5r\S5r\S5rSrSrSr\S5rSrSr U=r!$) EntityiaThis class is a base class for Splunk entities in the REST API, such as saved searches, jobs, indexes, and inputs. ``Entity`` provides the majority of functionality required by entities. Subclasses only implement the special cases for individual entities. For example for saved searches, the subclass makes fields like ``action.email``, ``alert_type``, and ``search`` available. An ``Entity`` is addressed like a dictionary, with a few extensions, so the following all work, for example in saved searches:: ent['action.email'] ent['alert_type'] ent['search'] You can also access the fields as though they were the fields of a Python object, as in:: ent.alert_type ent.search However, because some of the field names are not valid Python identifiers, the dictionary-like syntax is preferable. The state of an :class:`Entity` object is cached, so accessing a field does not contact the server. If you think the values on the server have changed, call the :meth:`Entity.refresh` method. c [RXU5 SUlURSS5(d"UR URSS55 gg)N skip_refreshFstate)rFr_staterdrrrHrrs r%rEntity.__init__sF$. zz.%00 LLGT2 31r$c:X g![[4a gf=f)NTF)KeyErrorAttributeError)rrs r% __contains__Entity.__contains__s&  J.)  s cF[SURR35e)aORaises IncomparableException. Since Entity objects are snapshots of times on the server, no simple definition of equality will suffice beyond instance equality, and instance equality leads to strange situations such as:: import splunklib.client as client c = client.connect(...) saved_searches = c.saved_searches x = saved_searches['asearch'] but then ``x != saved_searches['asearch']``. whether or not there was a change on the server. Rather than try to do something fancy, we simply declare that equality is undefined for Entities. Makes no roundtrips to the server. z+Equality is undefined for objects of class )rrr)rothers r%__eq__ Entity.__eq__s%*$&QRVR`R`RiRiQj$kllr$cXRR;aURRU$XR;aURU$[U5erB)rgrdefaultsrmrkeys r% __getattr__Entity.__getattr__sM **$$ $::%%c* * -- ==% %S!!r$c[X5$rB)getattrrvs r% __getitem__Entity.__getitem__st!!r$c([U[5n[U[5(a]UVs/sH'o3RR R S5PM) nn[SUSRRSUS35eUR$s snf)Nz eai:appNamez6Fetch from server returned multiple entries for name 'rz ' in apps r!) r_ XNAME_ENTRYrerfrrrdr)rr)rr]elemelers r%_load_atom_entryEntity._load_atom_entry"s(K0 dD ! !DHIDSII%%))-8DDI-HaI\I\H]]ghlgmmnoq qzz Js.Bc:URU5n[U5$rB)rr)rr]rs r% _load_stateEntity._load_state,s%%h/ ''r$c xUR"U40UD6nURU5n[U5nUR$)aURun a method and return the content Record from the returned XML. A method is a relative path from an Entity that is not itself an Entity. _run_action assumes that the returned XML is an Atom field containing one Entry, and the contents of Entry is what should be the return value. This is right in enough cases to make this method useful. )rdrrr)rr^rr]rrecs r% _run_actionEntity._run_action0s;88L3F3$$X.%{{r$cUcUcUcURboSUR;a_URRRURRRURRR4$UR R SUR R SUR R S4$XU4$)aProduce a namespace sans wildcards for use in entity requests. This method tries to fill in the fields of the namespace which are `None` or wildcard (`'-'`) from the entity's namespace. If that fails, it uses the service's namespace. :param owner: :param app: :param sharing: :return: r|r:rTrU)rhr|r:rTrUrHrrr:rTrUs r%_proper_namespaceEntity._proper_namespace>s =S[W_{{&8t{{+B **00 **.. **2244LL**73 ..u5 ..y9; ;7""r$crUR5upnURRURXUS9$NrS)rrHdeleterrs r%r Entity.deleteTs5"446G||""499EG"TTr$c V>URX#U5up#n[TU]"U4X#US.UD6$r)rrrdrr^r:rTrUrrs r%rd Entity.getXs6"44UIGw{<XuwXRWXXr$c V>URX#U5up#n[TU]"U4X#US.UD6$r)rrrrs r%r Entity.post\s6"44UIGw|LYYSXYYr$cdUbXlU$URUR55UlU$)apRefreshes the state of this entity. If *state* is provided, load it as the new state for this entity. Otherwise, make a roundtrip to the server (by calling the :meth:`read` method of ``self``) to fetch an updated state, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. :param state: Entity-specific arguments (optional). :type state: ``dict`` :raises EntityDeletedException: Raised if the entity no longer exists on the server. **Example**:: import splunklib.client as client s = client.connect(...) search = s.apps['search'] search.refresh() )rhr[rdrrgs r%rEntity.refresh`s3*  K ))DHHJ/DK r$c.URR$)zReturns the access metadata for this entity. :return: A :class:`splunklib.data.Record` object with three keys: ``owner``, ``app``, and ``sharing``. )rgr|rs r%r| Entity.access{zz   r$c.URR$)zLReturns the contents of the entity. :return: A ``dict`` containing values. rgrrs r%rEntity.contents zz!!!r$c(URS5 U$)z%Disables the entity at this endpoint.disablerrs r%rEntity.disable ) r$c(URS5 U$)z$Enables the entity at this endpoint.enablerrs r%r Entity.enables ( r$c.URR$)zReturns the content metadata for this entity. :return: A :class:`splunklib.data.Record` object with three keys: ``required``, ``optional``, and ``wildcard``. )rgr}rs r%r} Entity.fieldsrr$c.URR$)zbReturns a dictionary of related resources. :return: A ``dict`` with keys and corresponding URLs. )rgr{rs r%r{ Entity.linkss zzr$c.URR$)zGReturns the entity name. :return: The entity name. :rtype: ``string`` )rgrrrs r%rT Entity.nameszzr$cvURU5n[SUSR555nX2S'U$)z7Reads the current state of the entity from the server. c3># UHupU[USS94v M g7f)TrVNr rKs r%rEEntity.read..s&E+C41 !*QD"AB+Csr{)rrrN)rr]resultsunquoted_linkss r%r[ Entity.readsI""8,E+27+;+A+A+CEE)r$c(URS5 U$)zReloads the entity._reloadrrs r%reload Entity.reloadrr$c SU;aSU0nSUS;a [S5eSUS;a [S5eUR"S0UD6 UR5 U$)aTo update Access Control List (ACL) properties for an endpoint. :param kwargs: Additional entity-specific arguments (required). - "owner" (``string``): The Splunk username, such as "admin". A value of "nobody" means no specific user (required). - "sharing" (``string``): A mode that indicates how the resource is shared. The sharing mode can be "user", "app", "global", or "system" (required). :type kwargs: ``dict`` **Example**:: import splunklib.client as client service = client.connect(...) saved_search = service.saved_searches["name"] saved_search.acl_update(sharing="app", owner="nobody", app="search", **{"perms.read": "admin, nobody"}) rZrUz'Required argument 'sharing' is missing.r:z%Required argument 'owner' is missing.)acl)r8rrrrs r% acl_updateEntity.acl_updatesc$  f%F F6N *FG G &. (DE E "6"  r$cTURcUR5 UR$)zgReturns the entity's state record. :return: A ``dict`` containing fields and metadata for the entity. )rhrrs r%rg Entity.states ;;  {{r$c LSU;a [S5eUR"S0UD6 U$)aUpdates the server with any changes you've made to the current entity along with any additional arguments you specify. **Note**: You cannot update the ``name`` field of an entity. Many of the fields in the REST API are not valid Python identifiers, which means you cannot pass them as keyword arguments. That is, Python will fail to parse the following:: # This fails x.update(check-new=False, email.to='boris@utopia.net') However, you can always explicitly use a dictionary to pass such keys:: # This works x.update(**{'check-new': False, 'email.to': 'boris@utopia.net'}) :param kwargs: Additional entity-specific arguments (optional). :type kwargs: ``dict`` :return: The entity this method is called on. :rtype: class:`Entity` rTz5Cannot update the name of an Entity via the REST API.r)rrrs r%update Entity.updates,< V +,cd d F r$rhNNNrbrB)"rrr r!r"rurrnrrrxr|rrrrrrdrrrAr|rrrr}r{rTr[rrrgrr#rCrDs@r%rdrdsrH4 m.""( #,UYZ6!!""  !!      <!!r$rdcb\rSrSrSr\4SjrSrSrSr Sr Sr S r S r SS jrSS jrSrg )ri zQThis class represents a read-only collection of entities in the Splunk instance. cJ[RXU5 X0lSUlg)Nr6)rFrr null_count)rrHrrs r%rReadOnlyCollection.__init__s$. r$cDX g![a g[a gf=f)zIs there at least one entry called *name* in this collection? Makes a single roundtrip to the server, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. TF)rlr)rrTs r%rnReadOnlyCollection.__contains__s,  J *  s  c[U[5(aB[U5S:Xa3Uup[USS9nUR XR UR S9nO[USS9nUR U5nURU5n[U5S:a[SUS35e[U5S:Xa [U5eUS$![a!nURS :Xa [U5eeS nAff=f) a Fetch an item named *key* from this collection. A name is not a unique identifier in a collection. The unique identifier is a name plus a namespace. For example, there can be a saved search named ``'mysearch'`` with sharing ``'app'`` in application ``'search'``, and another with sharing ``'user'`` with owner ``'boris'`` and application ``'search'``. If the ``Collection`` is attached to a ``Service`` that has ``'-'`` (wildcard) as user and app in its namespace, then both of these may be visible under the same name. Where there is no conflict, ``__getitem__`` will fetch the entity given just the name. If there is a conflict, and you pass just a name, it will raise a ``ValueError``. In that case, add the namespace as a second argument. This function makes a single roundtrip to the server, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. :param key: The name to fetch, or a tuple (name, namespace). :return: An :class:`Entity` object. :raises KeyError: Raised if *key* does not exist. :raises ValueError: Raised if no namespace is specified and *key* does not refer to a unique name. **Example**:: s = client.connect(...) saved_searches = s.saved_searches x1 = saved_searches.create( 'mysearch', 'search * | head 1', owner='admin', app='search', sharing='app') x2 = saved_searches.create( 'mysearch', 'search * | head 1', owner='admin', app='search', sharing='user') # Raises ValueError: saved_searches['mysearch'] # Fetches x1 saved_searches[ 'mysearch', client.namespace(sharing='app', app='search')] # Fetches x2 saved_searches[ 'mysearch', client.namespace(sharing='user', owner='boris', app='search')] r/T encode_slash)r:rTryzFound multiple entities named 'z'; please specify a namespace.rN) rer"r9r rdr:rT _load_listr)rlr status)rrwnsr]rhhes r%r|ReadOnlyCollection.__getitem__$sb #u%%#c(a- 4888CxxRVV8D 4888C=ooh/G7|a15cU:XY[[7|q sm#1:  yyCsm#  sB?C C- C((C-c+F# UR"S0UD6HnUv M g7f)a,Iterate over the entities in the collection. :param kwargs: Additional arguments. :type kwargs: ``dict`` :rtype: iterator over entities. Implemented to give Collection a listish interface. This function always makes a roundtrip to the server, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. **Example**:: import splunklib.client as client c = client.connect(...) saved_searches = c.saved_searches for entity in saved_searches: print(f"Saved search named {entity.name}") Nriterrrrs r%__iter__ReadOnlyCollection.__iter__l"*II''DJ(!c4[UR55$)aEnable ``len(...)`` for ``Collection`` objects. Implemented for consistency with a listish interface. No further failure modes beyond those possible for any method on an Endpoint. This function always makes a round trip to the server, plus at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. **Example**:: import splunklib.client as client c = client.connect(...) saved_searches = c.saved_searches n = len(saved_searches) )r9rfrs r%__len__ReadOnlyCollection.__len__s$499;r$c[R"URR5nSU;a[ USSS5$SU;a [ US5$U$)a_Calculate the path to an entity to be returned. *state* should be the dictionary returned by :func:`_parse_atom_entry`. :func:`_entity_path` extracts the link to this entity from *state*, and strips all the namespace prefixes from it to leave only the relative path of the entity itself, sans namespace. :rtype: ``string`` :return: an absolute path z servicesNS/rz services/)runquoter{ alternater?)rrgraw_paths r% _entity_pathReadOnlyCollection._entity_pathsO==!6!67 H $X}c3? ? ( "X{3 3r$c[U5nUc/$/nUHIn[U5nURURUR U5US9nUR U5 MK U$)a)Converts *response* to a list of entities. *response* is assumed to be a :class:`Record` containing an HTTP response, of the form:: {'status': 200, 'headers': [('content-length', '232642'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Tue, 29 May 2012 15:27:08 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'body': ...a stream implementing .read()...} The ``'body'`` key refers to a stream containing an Atom feed, that is, an XML document with a toplevel element ````, and within that element one or more ```` elements. rg)rirrrHrappendrr]rhentitiesrrgentitys r%rReadOnlyCollection._load_listsp0%X. ?2IE%e,EYY !!%(F OOF # r$cZURS5n[U[5n[U5$)aOReturns metadata for members of the collection. Makes a single roundtrip to the server, plus two more at most if the ``autologin`` field of :func:`connect` is set to ``True``. :return: A :class:`splunklib.data.Record` object containing the metadata. **Example**:: import splunklib.client as client import pprint s = client.connect(...) pprint.pprint(s.apps.itemmeta()) {'access': {'app': 'search', 'can_change_perms': '1', 'can_list': '1', 'can_share_app': '1', 'can_share_global': '1', 'can_share_user': '1', 'can_write': '1', 'modifiable': '1', 'owner': 'admin', 'perms': {'read': ['*'], 'write': ['admin']}, 'removable': '0', 'sharing': 'user'}, 'fields': {'optional': ['author', 'configured', 'description', 'label', 'manageable', 'template', 'visible'], 'required': ['name'], 'wildcard': []}} _new)rdr_rr~)rr]rs r%itemmetaReadOnlyCollection.itemmetas+F88F#X':;#G,,r$Nc+~# UbUS:deUc URnSnX R:XdXR:aUR"SU=(d UUS.UD6nURU5n[U5nXX- nUHn U v M UbX:agX- n[R SX5XU5 X R:XaMXR:aMgg7f)a]Iterates over the collection. This method is equivalent to the :meth:`list` method, but it returns an iterator and can load a certain number of entities at a time from the server. :param offset: The index of the first entity to return (optional). :type offset: ``integer`` :param count: The maximum number of entities to return (optional). :type count: ``integer`` :param pagesize: The number of entities to load (optional). :type pagesize: ``integer`` :param kwargs: Additional arguments (optional): - "search" (``string``): The search query to filter responses. - "sort_dir" (``string``): The direction to sort returned items: "asc" or "desc". - "sort_key" (``string``): The field to use for sorting (optional). - "sort_mode" (``string``): The collating sequence for sorting returned items: "auto", "alpha", "alpha_case", or "num". :type kwargs: ``dict`` **Example**:: import splunklib.client as client s = client.connect(...) for saved_search in s.saved_searches.iter(pagesize=10): # Loads 10 saved searches at a time from the # server. ... Nr)countoffsetz3pagesize=%d, fetched=%d, offset=%d, N=%d, kwargs=%sr)rrdrr9loggerdebug) rrrpagesizerfetchedr]rNNrs r%rReadOnlyCollection.itersH8a<// =OOE&'/xxQh&7%Q&QHOOH-EE A LG 1< KF LLNPXcint u&'/sB0B=4B=;B=c <[UR"SSU0UD65$)aRetrieves a list of entities in this collection. The entire collection is loaded at once and is returned as a list. This function makes a single roundtrip to the server, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. There is no caching--every call makes at least one round trip. :param count: The maximum number of entities to return (optional). :type count: ``integer`` :param kwargs: Additional arguments (optional): - "offset" (``integer``): The offset of the first item to return. - "search" (``string``): The search query to filter responses. - "sort_dir" (``string``): The direction to sort returned items: "asc" or "desc". - "sort_key" (``string``): The field to use for sorting (optional). - "sort_mode" (``string``): The collating sequence for sorting returned items: "auto", "alpha", "alpha_case", or "num". :type kwargs: ``dict`` :return: A ``list`` of entities. rr)rfr)rrrs r%rfReadOnlyCollection.list/s :DII4E4V455r$)rr)rNNrB)rrr r!r"rdrrnr|rrrrrrrfr#rr$r%rr sD,2 FP0 (,#J%-N2vj6r$rc<^\rSrSrSrSrSrSU4SjjrSrU=r $)riOaA collection of entities. Splunk provides a number of different collections of distinct entity types: applications, saved searches, fired alerts, and a number of others. Each particular type is available separately from the Splunk instance, and the entities of that type are returned in a :class:`Collection`. The interface for :class:`Collection` does not quite match either ``list`` or ``dict`` in Python, because there are enough semantic mismatches with either to make its behavior surprising. A unique element in a :class:`Collection` is defined by a string giving its name plus namespace (although the namespace is optional if the name is unique). **Example**:: import splunklib.client as client service = client.connect(...) mycollection = service.saved_searches mysearch = mycollection['my_search', client.namespace(owner='boris', app='natasha', sharing='user')] # Or if there is only one search visible named 'my_search' mysearch = mycollection['my_search'] Similarly, ``name`` in ``mycollection`` works as you might expect (though you cannot currently pass a namespace to the ``in`` operator), as does ``len(mycollection)``. However, as an aggregate, :class:`Collection` behaves more like a list. If you iterate over a :class:`Collection`, you get an iterator over the entities, not the names and namespaces. **Example**:: for entity in mycollection: assert isinstance(entity, client.Entity) Use the :meth:`create` and :meth:`delete` methods to create and delete entities in this collection. To view the access control list and other metadata of the collection, use the :meth:`ReadOnlyCollection.itemmeta` method. :class:`Collection` does no caching. Each call makes at least one round trip to the server to fetch data. c [U[5(d[US35eSU;a>URS5nURUS'UR US'UR US'UR"SSU0UD6n[U[5nUcX$URn[U5nURURURU5US9nU$) aCreates a new entity in this collection. This function makes either one or two roundtrips to the server, depending on the type of entities in this collection, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :param name: The name of the entity to create. :type name: ``string`` :param namespace: A namespace, as created by the :func:`splunklib.binding.namespace` function (optional). You can also set ``owner``, ``app``, and ``sharing`` in ``params``. :type namespace: A :class:`splunklib.data.Record` object with keys ``owner``, ``app``, and ``sharing``. :param params: Additional entity-specific arguments (optional). :type params: ``dict`` :return: The new entity. :rtype: A subclass of :class:`Entity`, chosen by :meth:`Collection.self.item`. **Example**:: import splunklib.client as client s = client.connect(...) applications = s.apps new_app = applications.create("my_fake_app") z# is not a valid name for an entity.rr:rTrUrTrr)restrr,rr:rTrUrr_rrrrrHr) rrTparamsrr]atomrrgrs r%rCollection.create}s6$$$&$/R'ST T &  ;/I'ooF7O%MMF5M ) 1 1F9 991$1&1(K0 <:  !%( LL   e $ r$c h[USS9nSU;a>URS5nURUS'URUS'URUS'UR R "[URU540UD6 U$![a$nURS:Xa[SU35eeS nAff=f) aDeletes a specified entity from the collection. :param name: The name of the entity to delete. :type name: ``string`` :return: The collection. :rtype: ``self`` This method is implemented for consistency with the REST API's DELETE method. If there is no *name* entity on the server, a ``KeyError`` is thrown. This function always makes a roundtrip to the server. **Example**:: import splunklib.client as client c = client.connect(...) saved_searches = c.saved_searches saved_searches.create('my_saved_search', 'search * | head 1') assert 'my_saved_search' in saved_searches saved_searches.delete('my_saved_search') assert 'my_saved_search' not in saved_searches Trrr:rTrUrzNo such entity N) r rr:rTrUrHrrUrr rrl)rrTrrrs r%rCollection.deletes2$T2 &  ;/I'ooF7O%MMF5M ) 1 1F9   LL  dii 6 A& A  yyC788 s1B B1 B,,B1c <>[USS9n[TU]"XX440UD6$)a+Performs a GET request to the server on the collection. If *owner*, *app*, and *sharing* are omitted, this method takes a default namespace from the :class:`Service` object for this :class:`Endpoint`. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Service`` is not logged in. :raises HTTPError: Raised when an error in the request occurs. :param path_segment: A path segment relative to this endpoint. :type path_segment: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode for the namespace (optional). :type sharing: "global", "system", "app", or "user" :param query: All other keyword arguments, which are used as query parameters. :type query: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: import splunklib.client s = client.service(...) saved_searches = s.saved_searches saved_searches.get("my/saved/search") == \ {'body': ...a response reader object..., 'headers': [('content-length', '26208'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 16:30:35 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'status': 200} saved_searches.get('nonexistant/search') # raises HTTPError s.logout() saved_searches.get() # raises AuthenticationError Tr)r rrd)rrTr:rTrUrrs r%rdCollection.gets(Z$T2w{4>>>r$rrb) rrr r!r"rrrdr#rCrDs@r%rrOs+Z.`)V.?.?r$rc\rSrSrSrSrSrg)ConfigurationFilei zHThis class contains all of the stanzas from one configuration file. c P[RXU[S9 USSUlg)Nrrgrr)rrStanzarTris r%rConfigurationFile.__init__s'D4f=7OG, r$rTN)rrr r!r"rr#rr$r%rr s  -r$rc<\rSrSrSrSrSrSrSrSr Sr S r g ) riaHThis class provides access to the configuration files from this Splunk instance. Retrieve this collection using :meth:`Service.confs`. Splunk's configuration is divided into files, and each file into stanzas. This collection is unusual in that the values in it are themselves collections of :class:`ConfigurationFile` objects. c[RX[[S9 URR R S:Xd$URR RS:Xa [S5eg)Nr-z2Configurations cannot have wildcards in namespace.) rrPATH_PROPERTIESrrHrr:rTr8rrHs r%rConfigurations.__init__sZD?ARS << ! ! ' '3 .$,,2H2H2L2LPS2SQR R3Tr$cURU5 [UR[U-SU0S9$![a!nUR S:Xa [ U5eeSnAff=f)Nrrrr)rdrrH PATH_CONFr rrlrrwrs r%r|Configurations.__getitem__#sW  HHSM$T\\9s?7TW.Y Y yyCsm#  s.1 AAAcxURU5 g![anURS:XaSnAgeSnAff=f)NTrF)rdr rrs r%rnConfigurations.__contains__4s7  HHSM yyC  s 9449c8[U[5(d[S[U535eUR US9nUR S:XaX$UR S:Xa#[ UR[U-[SU0S9$[SUR S35e) zCreates a configuration file named *name*. If there is already a configuration file with that name, the existing file is returned. :param name: The name of the configuration file. :type name: ``string`` :return: The :class:`ConfigurationFile` object. Invalid name: )__confi/rr)rrgUnexpected status code returned from creating a stanza) rerr8reprrrrrHrr )rrTr]s r%rConfigurations.create?s$$$~d4j\:; ;99D9) ??c !:  ??c !$T\\9t3C&Y`bfXgh h28??2CCcdeer$c[S5e)z#Raises `IllegalOperationException`.z4Cannot delete configuration files from the REST API.rrvs r%rConfigurations.deleteVs'(^__r$c[US-$)Nrr)rrs r%rConfigurations._entity_pathZs5>))r$rN) rrr r!r"rr|rnrrrr#rr$r%rrs(S " f.`*r$rc$\rSrSrSrSrSrSrg)r iaz2This class contains a single configuration stanza.cd[S0UD6nURRURUS9 U$)zAdds keys to the current configuration stanza as a dictionary of key-value pairs. :param stanza: A dictionary of key-value pairs for the stanza. :type stanza: ``dict`` :return: The :class:`Stanza` object. )rZr)r rHrr)rstanzarZs r%submit Stanza.submitds1   $))$/ r$c[URRR5Vs/sH%nUR S5(aMUS:wdM#UPM' sn5$s snf)Neaidisabled)r9rhrkeysrX)rrs r%rStanza.__len__ps`t{{22779D9!<<.34 ?9DE EDsA AArN)rrr r!r"r)rr#rr$r%r r as< Er$r cl^\rSrSrSrU4Sjr\S5r\S5r\S5r \S5r Sr U=r $) StoragePasswordixz,This class contains a storage password. c >URSS5nURSUSL5US'[TU]"X40UD6 X@lg)Nrgrf)rdrrrh)rrHrrrgrs r%rStoragePassword.__init__|sD 7D)!'NEURRS:XdURRS:Xa [S5e[TU]U[ [S9 g)Nrz4StoragePasswords cannot have wildcards in namespace.r)rr:rTr8rrPATH_STORAGE_PASSWORDSr1)rrHrs r%rStoragePasswords.__init__sK    " "c )W->->-B-Bc-IST T "8Or$cr[U[5(d[S[U535eUcUR XS9nOUR XUS9nUR S:wa[SUR S35e[ U5n[US5n[URURU5USS 9nU$) aCreates a storage password. A `StoragePassword` can be identified by , or by : if the optional realm parameter is also provided. :param password: The password for the credentials - this is the only part of the credentials that will be stored securely. :type name: ``string`` :param username: The username for the credentials. :type name: ``string`` :param realm: The credential realm. (optional) :type name: ``string`` :return: The :class:`StoragePassword` object created. r)passwordrT)rFr=rTrrrrT)rgrf) rerr8rrrrirr1rHr)rrFrr=r]rhrgstorage_passwords r%rStoragePasswords.creates(C((~d8n-=>? ? =yy(yBHyy(hyOH ??c !6x6GGghi i$X.!'!*-*4<<9J9J59QY^mqrr$cUcUnO[USS9S-[USS9-nUSS:waUS-n[RX5$)aDelete a storage password by username and/or realm. The identifier can be passed in through the username parameter as or :, but the preferred way is by passing in the username and realm parameters. :param username: The username for the credentials, or : if the realm parameter is omitted. :type name: ``string`` :param realm: The credential realm. (optional) :type name: ``string`` :return: The `StoragePassword` collection. :rtype: ``self`` Tr:r6)r rr)rrr=rTs r%rStoragePasswords.deletesW =De$7#= 8bf@ggD 8s?#:D  ,,r$rrB) rrr r!r"rrrr#rCrDs@r%rrsP  @--r$rcD\rSrSrSrSrSr\S5r\S5r Sr g) riznThis class represents a group of fired alerts for a saved search. Access it using the :meth:`alerts` property.c 4[R"XU40UD6 grBrdrris r%rAlertGroup.__init__t6v6r$cUR$rB)rrs r%rAlertGroup.__len__s zzr$cB[URUR5$)z_Returns a collection of triggered alerts. :return: A :class:`Collection` of triggered alerts. )rrHrrs r%alertsAlertGroup.alertss $,, 22r$cL[URRSS55$)z`Returns the count of triggered alerts. :return: The triggered alert count. :rtype: ``integer`` triggered_alert_countr)rrrdrs r%rAlertGroup.counts!4<<##$;Q?@@r$rN) rrr r!r"rrrArTrr#rr$r%rrs;-733AAr$rc$\rSrSrSrSrSrSrg)rizThis class contains the collection of indexes in this Splunk instance. Retrieve this collection using :meth:`Service.indexes`. cUSnUS$)zQReturns the name of the default index. :return: The name of the default index. _auditdefaultDatabaser)rindexs r% get_defaultIndexes.get_defaults X&''r$cxURRS:a[RX5 g[ S5e)zDeletes a given index. **Note**: This method is only supported in Splunk 5.0 and later. :param name: The name of the index to delete. :type name: ``string`` rzKDeleting indexes via the REST API is not supported before Splunk version 5.N)rHrrrrrs r%rIndexes.deletes9 << & &$ .   d )+-UV Vr$rN)rrr r!r"r^rr#rr$r%rrs( Vr$rcl\rSrSrSrSrS Sjr\RS5r S Sjr Sr S S jr S r S rg)rizThis class represents an index and provides different operations, such as cleaning the index, writing to the index, and so forth.c 4[R"XU40UD6 grBrNris r%rIndex.__init__rPr$NcSUR0nUbXS'UbX$S'UbX4S'[[S-[R"U5-SS9nUR R [LaUR R O%UR R RSS 5nS US 3nUR R5(a7[UR R5R55nS US 3nUR R5nS [UR RU55S3R!S5SUR R"S[%UR R&5S 3R!S5SUR!S5SS/n U Hn UR)U 5 M U$)a}Opens a stream (a writable socket) for writing events to the index. :param host: The host value for events written to the stream. :type host: ``string`` :param source: The source value for events written to the stream. :type source: ``string`` :param sourcetype: The sourcetype value for events written to the stream. :type sourcetype: ``string`` :return: A writable socket. r]hostsource sourcetype?TrVzSplunk r'zAuthorization: Splunk z zCookie: zPOST z HTTP/1.1 rWzHost: rJsAccept-Encoding: identity s X-Splunk-Input-Mode: Streaming s )rTr PATH_RECEIVERS_STREAMr urlencoderHtokenrrZ has_cookiesr get_cookiesrNrrrYencoderfrportwrite) rrfrgrhrOr cookie_headercookie_or_auth_headersockheadershs r%attach Index.attachs#  D&\  H~  ! #5/#58MM[_`.2ll.@.@DZ.Z **`d`l`l`r`r`z`z|EGIaJ "8t L << # # % %/ 0H0H0J0P0P0RSM&.}oT$B ! ||##%3t||44T:;A 0A> 1A;;A>cUR5 USnUSnURnU(d*URRS:aUR 5 UR SSS9 UR 5 [R"5n[US9nURRS:wam[R"5XV-:aR[S5 UR5 URRS:wa[R"5XV-:aMRURRS:wa[SURS US 35eUR X#S9 U(d*URRS:aUR5 U$!UR X#S9 U(d,URRS:aUR5 fff=f) a&Deletes the contents of the index. This method blocks until the index is empty, because it needs to restore values at the end of the operation. :param timeout: The time-out period for the operation, in seconds (the default is 60). :type timeout: ``integer`` :return: The :class:`Index`. maxTotalDataSizeMBfrozenTimePeriodInSecsrry)rrrrczCleaning index z took longer than z seconds; timing out.)rr-rHrrrroll_hot_bucketsrrrrtotalEventCountrrrTr)rrtdsftpwas_disabled_initiallyrrs r%clean Index.cleanfs '(+,!% )dll.I.ID.P  KK1QK G  ! ! #LLNEW-D,,..#5(,,.5<:Wa ,,..#5(,,.5<:W||++s2$%dii[0B7)K`acc3 KK3K K)dll.I.ID.P  KK3K K)dll.I.ID.P /Q)sC4F6FAGc(URS5 U$)zKPerforms rolling hot buckets for this index. :return: The :class:`Index`. zroll-hot-bucketsrrs r%rIndex.roll_hot_bucketss $% r$cSUR0nUbX%S'UbX5S'UbXES'URR"[4SU0UD6 U$)atSubmits a single event to the index using ``HTTP POST``. :param event: The event to submit. :type event: ``string`` :param `host`: The host value of the event. :type host: ``string`` :param `source`: The source value of the event. :type source: ``string`` :param `sourcetype`: The sourcetype value of the event. :type sourcetype: ``string`` :return: The :class:`Index`. r]rfrgrhrZ)rTrHrPATH_RECEIVERS_SIMPLE)reventrfrgrhrOs r%r) Index.submitsY#  D&\  H~  ! #5 /DeDtD r$c fURUS'SnURR"U4SU0UD6 U$)aUploads a file for immediate indexing. **Note**: The file must be locally accessible from the server. :param filename: The name of the file to upload. The file can be a plain, compressed, or archived file. :type filename: ``string`` :param kwargs: Additional arguments (optional). For more about the available parameters, see `Index parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The :class:`Index`. r]zdata/inputs/oneshotrT)rTrHr)rfilenamerrs r%upload Index.uploads7))w$ $8X88 r$rr)<)rrr r!r"rrw contextlibcontextmanagerr~rrr)rr#rr$r%rrsB?7(TB*X.r$rc6^\rSrSrSrSSjrU4SjrSrU=r$)rizThis class represents a Splunk input. This class is the base for all typed input classes and is also used when the client does not recognize an input kind. c <[R"XU40UD6 UcLURS5nURS5S-nXVS:XaXVS-XVS--UlOXVUlOX0lURS:XaSUlURS:XaSUlgg)Nrrrytcptcp/raw splunktcp tcp/cooked)rdrr#r]r)rrHrrr path_segmentsis r%rInput.__init__s t6v6 < JJsOM##H-1A5(),s2]q55II ), I 99 !DI 99 #$DI $r$c 2>URS;a[TU]"S0UD6$UR5nSU;a [ S5eSUR R ;a,URS:waUR R SUS'[TU]"S0UD6$)aUpdates the server with any changes you've made to the current input along with any additional arguments you specify. :param kwargs: Additional arguments (optional). For more about the available parameters, see `Input parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The input this method was called on. :rtype: class:`Input` )rrrrudprestrictToHostz+F+ + I6)/0noo4;;#6#66499;M.2kk.A.ABR.S *+7>.I. .r$rrB) rrr r!r"rrr#rCrDs@r%rrs %,$/$/r$rc|\rSrSrSrSSjrSrSrSrSSjr S r SS jr \ S 5r S rS rSrSrSrSrg)ri zThis class represents a collection of inputs. The collection is heterogeneous and each member of the collection contains a *kind* property that indicates the specific type of input. Retrieve this collection using :meth:`Service.inputs`.Nc>[RX[[S9 gNr)rr PATH_INPUTSr)rrHkindmaps r%rInputs.__init__ sD;UCr$cN[U[5(a[U5S:XaUup[USS9nUR UR U5S-U-5nUR U5n[U5S:a[SUSUS35e[U5S :Xa [X45eUS $SnSn[USS9nURHunUR US-U-5nUR U5n[U5S:a[SUSUS35e[U5S :XaM^Ub[S US 35eUS nMw Uc [U5eU$![a"nURS :Xa [X45eeSnAff=f![anURS :XaSnAMeSnAff=f) Nr/TrrryzFound multiple inputs of kind z named r!rrzFound multiple inputs named z, please specify a kind) rer"r9r rdkindpathrr)rlr rkinds)rrwrr]rhr candidates r%r|Inputs.__getitem__ s c5 ! !c#h!mICSt4C 88DMM$$7#$=$CD//(3wseCZ [#]]$+AJ #$ sm# = 99#"C;//  .!yyC' s=A7E AE>$E> E;E66E;> F$FFF$c[U[5(a"[U5S:XaURU5 gUR HLnUR URU5S-U-5nURU5n[U5S:a gMN g![a gf=f![anURS:XaSnAMeSnAff=f)Nr/TFrrr) rer"r9r|rlrrdrrr r)rrwrr]rhrs r%rnInputs.__contains__D s c5 ! !c#h!m   %  #xx d(;c(AC(GHH"ooh7G7|a'#( ##  !yyC' s0BAB% B"!B"% C /CCC c URU5nUR"U4SU0UD6 [USS9n[URU-SU;a USSU3OU5n[ UR XR5$)a&Creates an input of a specific kind in this collection, with any arguments you specify. :param `name`: The input name. :type name: ``string`` :param `kind`: The kind of input: - "ad": Active Directory - "monitor": Files and directories - "registry": Windows Registry - "script": Scripts - "splunktcp": TCP, processed - "tcp": TCP, unprocessed - "udp": UDP - "win-event-log-collections": Windows event log - "win-perfmon": Performance monitoring - "win-wmi-collections": WMI :type kind: ``string`` :param `kwargs`: Additional arguments (optional). For more about the available parameters, see `Input parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The new :class:`Input`. rTTrrrJ)rrr rUrrrH)rrTrrrrs r%r Inputs.create] sH==& (000$T2 II 4D4Nv&'($ 0TX T\\4..r$cUc)URRXR5 U$URRXU4R5 U$)a,Removes an input from the collection. :param `kind`: The kind of input: - "ad": Active Directory - "monitor": Files and directories - "registry": Windows Registry - "script": Scripts - "splunktcp": TCP, processed - "tcp": TCP, unprocessed - "udp": UDP - "win-event-log-collections": Windows event log - "win-perfmon": Performance monitoring - "win-wmi-collections": WMI :type kind: ``string`` :param name: The name of the input to remove. :type name: ``string`` :return: The :class:`Inputs` collection. )rHrr)rrTrs r%r Inputs.delete sN> < LL    0  LL  4Z 0 5 5 6 r$czURURUS35n[U[5n[ U5$)a Returns metadata for the members of a given kind. :param `kind`: The kind of input: - "ad": Active Directory - "monitor": Files and directories - "registry": Windows Registry - "script": Scripts - "splunktcp": TCP, processed - "tcp": TCP, unprocessed - "udp": UDP - "win-event-log-collections": Windows event log - "win-perfmon": Performance monitoring - "win-wmi-collections": WMI :type kind: ``string`` :return: The metadata. :rtype: class:``splunklib.data.Record`` z/_new)rd_kindmapr_rr~)rrr]rs r%rInputs.itemmeta s;<88t}}T2359:X':;#G,,r$cUc/n/nURSRU55n[U5nUHnXR/-nURS:XdUSS/:XaM,SURVs/sHowR PM sn;a1SRXR/-5nUR U5 MURXR/-5n URU 5 M U$s snf)Nrallrsslr) rdjoinrirrrsrur_get_kind_listextend) rsubpathrr]rr this_subpathrrsubkindss r%rInputs._get_kind_list s ?G88CHHW-.$X.E"kk]2L{{e#|u~'E5::6:aEE:66xx;;- 78 T"..w++/FG X& 7s0C1c"UR5$)zeReturns the input kinds on this Splunk instance. :return: The list of input kinds. :rtype: ``list`` )rrs r%r Inputs.kinds s""$$r$cVUS:Xa [SSS9$US:Xa [SSS9$[USS9$)aReturns a path to the resources for a given input kind. :param `kind`: The kind of input: - "ad": Active Directory - "monitor": Files and directories - "registry": Windows Registry - "script": Scripts - "splunktcp": TCP, processed - "tcp": TCP, unprocessed - "udp": UDP - "win-event-log-collections": Windows event log - "win-perfmon": Performance monitoring - "win-wmi-collections": WMI :type kind: ``string`` :return: The relative endpoint path. :rtype: ``string`` rrTrVrrr)rrs r%rInputs.kindpath s:< 5=iT: : ; l= =$D11r$c ^[U5S:Xa URn[U5S:XaUSn[RS5 UR U5n[RSU5 [ USS9nUR "U40UD6n/n[W5nUc/$UH^n [U 5n [R"U RR5n[UR XCU S 9n UR#U 5 M` U$UR S S 5n /nUHnSn[ USS9nUR UR U5U S 9n[U5nUcM?UH^n [U 5n [R"U RR5n[UR XCU S 9n UR#U 5 M` M S U;aXrS SnSU;aUSUSnUR SS5S:Xa+UR SS5mTS:XaSnOU4Sjn[%X~S9nUR SS5S:Xa+UR SS5mTS:XaSnOU4Sjn[%X~S9nUR SS5S:Xa['[)U55nU$![a"nURS:Xa/sSnA$SnAGN%SnAff=f![an U RS:XaSn A GMeSn A ff=f)aLReturns a list of inputs that are in the :class:`Inputs` collection. You can also filter by one or more input kinds. This function iterates over all possible inputs, regardless of any arguments you specify. Because the :class:`Inputs` collection is the union of all the inputs of each kind, this method implements parameters such as "count", "search", and so on at the Python level once all the data has been fetched. The exception is when you specify a single input kind, and then this method makes a single request with the usual semantics for parameters. :param kinds: The input kinds to return (optional). - "ad": Active Directory - "monitor": Files and directories - "registry": Windows Registry - "script": Scripts - "splunktcp": TCP, processed - "tcp": TCP, unprocessed - "udp": UDP - "win-event-log-collections": Windows event log - "win-perfmon": Performance monitoring - "win-wmi-collections": WMI :type kinds: ``string`` :param kwargs: Additional arguments (optional): - "count" (``integer``): The maximum number of items to return. - "offset" (``integer``): The offset of the first item to return. - "search" (``string``): The search query to filter responses. - "sort_dir" (``string``): The direction to sort returned items: "asc" or "desc". - "sort_key" (``string``): The field to use for sorting (optional). - "sort_mode" (``string``): The collating sequence for sorting returned items: "auto", "alpha", "alpha_case", or "num". :type kwargs: ``dict`` :return: A list of input kinds. :rtype: ``list`` rryz8Inputs.list taking short circuit branch for single kind.zPath for inputs: %sTrVrNrr *)r rr sort_modealpha sort_fieldrTc6URR5$rB)rTr0rs r%Inputs.list.. saffllnr$c*>UTR5$rB)r0rrs r%rr sa m113r$)rw alpha_casecUR$rBr rs r%rr saffr$c>UT$rBrrs r%rr s a mr$sort_dirascdesc)r9rrrrr rdr rrirrrr{rrrHrsortedrfreversed)rrrrrr]rrrhrrgrr rfrs @r%rf Inputs.list sn u:?JJE u:?8D LLS T==&D LL. 5 !$D988D3F3H(2G  )%0}}U[[%:%:;t||TuE'!OHc*DH !$D988DMM$$78G)2G )%0}}U[[%:%:;t||TuE'!* v x 0 12H f  01H ::k4 (G 3L&9JV#,3h.H ::k4 (L 8L&9JV#$+h.H ::j% (F 2HX./H{ 99#I$ 2 88s?  s<.J )J8 J5J0$J50J58 KKKKc+F# UR"S0UD6HnUv M g7frrrs r%rInputs.__iter__ s II''DJ(rc+F# UR"S0UD6HnUv M g7f)ajIterates over the collection of inputs. :param kwargs: Additional arguments (optional): - "count" (``integer``): The maximum number of items to return. - "offset" (``integer``): The offset of the first item to return. - "search" (``string``): The search query to filter responses. - "sort_dir" (``string``): The direction to sort returned items: "asc" or "desc". - "sort_key" (``string``): The field to use for sorting (optional). - "sort_mode" (``string``): The collating sequence for sorting returned items: "auto", "alpha", "alpha_case", or "num". :type kwargs: ``dict`` Nr)rfrs r%r Inputs.iter rrc ,UR"SSU0UD6 g)aqCreates a oneshot data input, which is an upload of a single file for one-time indexing. :param path: The path and filename. :type path: ``string`` :param kwargs: Additional arguments (optional). For more about the available parameters, see `Input parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` rTN)oneshotr)rrrs r%rInputs.oneshot s 1$1&1r$rrB)rrr r!r"rr|rnrrrrrArrrfrrrr#rr$r%rr s_> D.`21/f#J -D*%%"2H~@0 2r$rc\rSrSrSrSrSrSrSrSr Sr S r S r S r \S 5rS rSrSrSrSrSrSrSrSrSrSrg)ri z#This class represents a search job.c SnUR(aUR[US9nOUR[US9n[R "XU4SS0UD6 X lg)Nz {path}{sid})rrlrfT)rformatr\r[rdrrl)rrHrlrrs r%r Job.__init__ sQ  ! !;;I3;7D;;Lc;:DtI$I&Ir$c,[U5R$rB)r_rrs r%rJob._load_atom_entry s(#)))r$czURSSS9 U$![anURS:XaSnAU$eSnAff=f)zTStops the current search and deletes the results cache. :return: The :class:`Job`. controlcancelactionrN)rr r)rrs r%r Job.cancel sM   IIiI 1  yyC   s :55:c&URSSS9 U$)z;Disables preview for this job. :return: The :class:`Job`. rdisablepreviewrrrs r%disable_previewJob.disable_preview s )$4 5 r$c&URSSS9 U$)zvEnables preview for this job. **Note**: Enabling preview might slow search considerably. :return: The :class:`Job`. r enablepreviewrrrs r%enable_previewJob.enable_preview s )O 4 r$c URSS5US'URR(aUR"S0UD6R$UR"S0UD6R$)aReturns a streaming handle to this job's events. :param kwargs: Additional parameters (optional). For a list of valid parameters, see `GET search/jobs/{search_id}/events `_ in the REST API documentation. :type kwargs: ``dict`` :return: The ``InputStream`` IO handle to this job's events. segmentationnone)eventsrdrHrrZrrs r%r Job.events sX"(NF!C~ << & &88//44 4yy,V,111r$c&URSSS9 U$)z[Stops the job and provides intermediate results for retrieval. :return: The :class:`Job`. rfinalizerrrs r%r Job.finalize s )J / r$cjUR5(dgURRSS:HnU$)zzIndicates whether this job finished running. :return: ``True`` if the job is done, ``False`` if not. :rtype: ``boolean`` FisDone1)is_readyrhr)rdones r%is_done Job.is_done s0 }} ##H-4 r$cUR5nURS:XagURU5UlURRSS;nU$)zIndicates whether this job is ready for querying. :return: ``True`` if the job is ready, ``False`` if not. :rtype: ``boolean`` F dispatchState)QUEUEDPARSING)rdrr[rhr)rr]readys r%r Job.is_ready sM88: ??c !ii)  ##O4`_. :type query_params: ``dict`` :return: The ``InputStream`` IO handle to this job's results. rr)rrr query_paramss r%r Job.results; s[F(4'7'7'O ^$ << & &8866;; ;yy3l3888r$c URSS5US'URR(aUR"S0UD6R$UR"S0UD6R$)aReturns a streaming handle to this job's preview search results. Unlike :class:`splunklib.results.JSONResultsReader`along with the query param "output_mode='json'", which requires a job to be finished to return any results, the ``preview`` method returns any results that have been generated so far, whether the job is running or not. The returned search results are the raw data from the server. Pass the handle returned to :class:`splunklib.results.JSONResultsReader` to get a nice, Pythonic iterator over objects, as in:: import splunklib.client as client import splunklib.results as results service = client.connect(...) job = service.jobs.create("search * | head 5") rr = results.JSONResultsReader(job.preview(output_mode='json')) for result in rr: if isinstance(result, results.Message): # Diagnostic messages may be returned in the results print(f'{result.type}: {result.message}') elif isinstance(result, dict): # Normal events are returned as dicts print(result) if rr.is_preview: print("Preview of a running search job.") else: print("Job is finished. Results are final.") This method makes one roundtrip to the server, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :param query_params: Additional parameters (optional). For a list of valid parameters, see `GET search/jobs/{search_id}/results_preview `_ in the REST API documentation. :type query_params: ``dict`` :return: The ``InputStream`` IO handle to this job's preview results. rr)results_previewrrs r%preview Job.previewe s[L(4'7'7'O ^$ << & &88>>CC Cyy;l;@@@r$c :UR"S0UD6R$)aReturns a streaming handle to this job's search log. :param `kwargs`: Additional parameters (optional). For a list of valid parameters, see `GET search/jobs/{search_id}/search.log `_ in the REST API documentation. :type kwargs: ``dict`` :return: The ``InputStream`` IO handle to this job's search log. )z search.logrdrZrs r% searchlog Job.searchlog sxx//444r$c(URSSUS9 U$)aSets this job's search priority in the range of 0-10. Higher numbers indicate higher priority. Unless splunkd is running as *root*, you can only decrease the priority of a running job. :param `value`: The search priority. :type value: ``integer`` :return: The :class:`Job`. r setpriority)rpriorityrr8s r% set_priorityJob.set_priority s )ME B r$c :UR"S0UD6R$)aReturns a streaming handle to this job's summary. :param `kwargs`: Additional parameters (optional). For a list of valid parameters, see `GET search/jobs/{search_id}/summary `_ in the REST API documentation. :type kwargs: ``dict`` :return: The ``InputStream`` IO handle to this job's summary. )summaryrrs r%r& Job.summary sxx,V,111r$c :UR"S0UD6R$)aReturns a streaming handle to this job's timeline results. :param `kwargs`: Additional timeline arguments (optional). For a list of valid parameters, see `GET search/jobs/{search_id}/timeline `_ in the REST API documentation. :type kwargs: ``dict`` :return: The ``InputStream`` IO handle to this job's timeline. )timelinerrs r%r) Job.timeline sxx-f-222r$c&URSSS9 U$)zExtends the expiration time of the search to the current time (now) plus the time-to-live (ttl) value. :return: The :class:`Job`. rtouchrrrs r%r, Job.touch s )G , r$c(URSSUS9 U$)zSet the job's time-to-live (ttl) value, which is the time before the search job expires and is still available. :param `value`: The ttl value, in seconds. :type value: ``integer`` :return: The :class:`Job`. rsetttl)rttlrr8s r%set_ttl Job.set_ttl s )H% 8 r$c&URSSS9 U$)zCResumes the current search, if paused. :return: The :class:`Job`. runpauserrrs r%r4 Job.unpause s )I . r$)rhrlN)rrr r!r"rrrrrrrrrrArTrrrrr#r&r)r,r1r4r#rr$r%rr s{- * 2$  (9T+AZ 5  2 3 r$rc<\rSrSrSrSrSrSrSrSr Sr S r g ) ri zgThis class represents a collection of search jobs. Retrieve this collection using :meth:`Service.jobs`.cUR(d[nO[n[R XU[ S9 SUlg)Nrr)rr[r\rrrrrIs r%r Jobs.__init__ s3%%DDD4c:r$c[U5nUc/$/nUH@n[U5nURURUSSUS9nUR U5 MB U$)Nrrlr)rirrrHrrs r%rJobs._load_list sm$X. ?2IE%e,EYY i 'F OOF # r$c URSS5S:Xa [S5eUR"SSU0UD6n[X2RSS55n[ UR U5$)aCreates a search using a search query and any additional parameters you provide. :param query: The search query. :type query: ``string`` :param kwargs: Additiona parameters (optional). For a list of available parameters, see `Search job parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The :class:`Job`. exec_modeNrzACannot specify exec_mode=oneshot; use the oneshot method instead.r rnr)rd TypeErrorrrprrH)rrrr]rls r%r Jobs.create s_ ::k4 (I 5_` `994E4V4**]D"AB4<<%%r$c SU;a [S5eURSS5US'UR"SSUS.UD6R$)aRuns a search and immediately starts streaming preview events. This method returns a streaming handle to this job's events as an XML document from the server. To parse this stream into usable Python objects, pass the handle to :class:`splunklib.results.JSONResultsReader` along with the query param "output_mode='json'":: import splunklib.client as client import splunklib.results as results service = client.connect(...) rr = results.JSONResultsReader(service.jobs.export("search * | head 5",output_mode='json')) for result in rr: if isinstance(result, results.Message): # Diagnostic messages may be returned in the results print(f'{result.type}: {result.message}') elif isinstance(result, dict): # Normal events are returned as dicts print(result) assert rr.is_preview == False Running an export search is more efficient as it streams the results directly to you, rather than having to write them out to disk and make them available later. As soon as results are ready, you will receive them. The ``export`` method makes a single roundtrip to the server (as opposed to two for :meth:`create` followed by :meth:`preview`), plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :raises `ValueError`: Raised for invalid queries. :param query: The search query. :type query: ``string`` :param params: Additional arguments (optional). For a list of valid parameters, see `GET search/jobs/export `_ in the REST API documentation. :type params: ``dict`` :return: The ``InputStream`` IO handle to raw XML returned from the server. r<z&Cannot specify an exec_mode to export.rrexport)r^r rr=rdrrZrrrs r%r@ Jobs.export sVN & DE E!'NF!C~yy#h %#!##'4 (r$c[5e)zThere is no metadata available for class:``Jobs``. Any call to this method raises a class:``NotSupportedError``. :raises: class:``NotSupportedError`` rrs r%r Jobs.itemmetaD  !!r$c SU;a [S5eURSS5US'UR"SUSS.UD6R$)aqRun a oneshot search and returns a streaming handle to the results. The ``InputStream`` object streams fragments from the server. To parse this stream into usable Python objects, pass the handle to :class:`splunklib.results.JSONResultsReader` along with the query param "output_mode='json'" :: import splunklib.client as client import splunklib.results as results service = client.connect(...) rr = results.JSONResultsReader(service.jobs.oneshot("search * | head 5",output_mode='json')) for result in rr: if isinstance(result, results.Message): # Diagnostic messages may be returned in the results print(f'{result.type}: {result.message}') elif isinstance(result, dict): # Normal events are returned as dicts print(result) assert rr.is_preview == False The ``oneshot`` method makes a single roundtrip to the server (as opposed to two for :meth:`create` followed by :meth:`results`), plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :raises ValueError: Raised for invalid queries. :param query: The search query. :type query: ``string`` :param params: Additional arguments (optional): - "output_mode": Specifies the output format of the results (XML, JSON, or CSV). - "earliest_time": Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. - "latest_time": Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. - "rf": Specifies one or more fields to add to the search. :type params: ``dict`` :return: The ``InputStream`` IO handle to raw XML returned from the server. r<z'Cannot specify an exec_mode to oneshot.rrr)r r<rrArBs r%r Jobs.oneshotM sV^ & EF F!'NF!C~yy##,#!##'4 (r$)rN) rrr r!r"rrrr@rrr#rr$r%rr s&.  &(,(\"4(r$rc$\rSrSrSrSrSrSrg)ri zyThis class represents a collection of service logging categories. Retrieve this collection using :meth:`Service.loggers`.c8[RX[5 grB)rr PATH_LOGGERrs r%rLoggers.__init__ sD;7r$c[5e)zThere is no metadata available for class:``Loggers``. Any call to this method raises a class:``NotSupportedError``. :raises: class:``NotSupportedError`` rErs r%rLoggers.itemmeta rGr$rN)rrr r!r"rrr#rr$r%rr s?8"r$rc*\rSrSrSr\S5rSrg)ri c 4[R"XU40UD6 grBrNris r%rMessage.__init__ rPr$cXR$)zKReturns the message value. :return: The message value. :rtype: ``string`` r rs r%r Message.value sIIr$rN)rrr r!rrArr#rr$r%rr s7r$rc:\rSrSrSrSrSr\S5rSr Sr g) ri zThis class contains the different types of modular inputs. Retrieve this collection using :meth:`Service.modular_input_kinds`. cpURRSSnX;ag[RX5$)N endpointsrOT)rgrrdrnrrTrOs r%rnModularInputKind.__contains__ s4zz!!+.v6 <""4..r$cxURRSSnX;aUS$[RX5$)NendpointrOr)rgrrdr|rXs r%r|ModularInputKind.__getitem__ s;zz!!*-f5 << !!$--r$c:URRSS$)aA dictionary of all the arguments supported by this modular input kind. The keys in the dictionary are the names of the arguments. The values are another dictionary giving the metadata about that argument. The possible keys in that dictionary are ``"title"``, ``"description"``, ``"required_on_create``", ``"required_on_edit"``, ``"data_type"``. Each value is a string. It should be one of ``"true"`` or ``"false"`` for ``"required_on_create"`` and ``"required_on_edit"``, and one of ``"boolean"``, ``"string"``, or ``"number``" for ``"data_type"``. :return: A dictionary describing the arguments this modular input kind takes. :rtype: ``dict`` r[rOrrs r% argumentsModularInputKind.arguments szz!!*-f55r$c [S5e)z3Raises an error. Modular input kinds are read only.z7Modular input kinds cannot be updated via the REST API.r"rs r%rModularInputKind.update s'(abbr$rN) rrr r!r"rnr|rAr^rr#rr$r%rr s+/ .  6 6cr$rc\rSrSrSrSrSr\S5rSr \S5r Sr SS jr SS jr S r\S 5rSrSrg ) SavedSearchi z%This class represents a saved search.c 4[R"XU40UD6 grBrNris r%rSavedSearch.__init__ rPr$c(URS5 U$)zxAcknowledges the suppression of alerts from this saved search and resumes alerting. :return: The :class:`SavedSearch`. acknowledgerrs r%rgSavedSearch.acknowledge s -  r$c`[URRRSS55$)zReturns the number of alerts fired by this saved search. :return: The number of alerts fired by this saved search. :rtype: ``integer`` rWr)rrhrrdrs r% alert_countSavedSearch.alert_count s'4;;&&**+BAFGGr$c UR"S0UD6n[X!RSS55n[URU5$)aRuns the saved search and returns the resulting search job. :param `kwargs`: Additional dispatch arguments (optional). For details, see the `POST saved/searches/{name}/dispatch `_ endpoint in the REST API documentation. :type kwargs: ``dict`` :return: The :class:`Job`. rnN)dispatch)rrprdrrH)rrr]rls r%rmSavedSearch.dispatch s;99262**]D"AB4<<%%r$c jUSS:Xa [S5e[URURR[UR -UR RRUR RRUR RRS9[S9nU$)zReturns the collection of fired alerts (a fired alert group) corresponding to this saved search's alerts. :raises IllegalOperationException: Raised when the search is not scheduled. :return: A collection of fired alerts. :rtype: :class:`AlertGroup` is_scheduledrcz*Unscheduled saved searches have no alerts.rSr) rrrHrYrrTrhr|r:rTrUr)rcs r%rSavedSearch.fired_alerts s  3 &+,XY Y  LL LL ! !"3dii"?(, (:(:(@(@&*kk&8&8&<&<*.++*<*<*D*D " F  r$c UR"S0UD6n[U5nUc/$/nUH4n[URUR5nUR U5 M6 U$)zReturns a list of search jobs corresponding to this saved search. :param `kwargs`: Additional arguments (optional). :type kwargs: ``dict`` :return: A list of :class:`Job` objects. )history)rdrirrHrrr)rrr]rhrrrs r%rtSavedSearch.history s^8800$X. ?2IEdllEKK0C KK  r$Nc jUcURRn[R"U4SU0UD6 U$)aUpdates the server with any changes you've made to the current saved search along with any additional arguments you specify. :param `search`: The search query (optional). :type search: ``string`` :param `kwargs`: Additional arguments (optional). For a list of available parameters, see `Saved search parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The :class:`SavedSearch`. r )rr rdr)rr rs r%rSavedSearch.update s2" >DLL$7$76 d464V4 r$cURSUUS9nURU5n[U5nURRVs/sH"n[ R "[U55PM$ nnU$s snf)aReturns the times when this search is scheduled to run. By default this method returns the times in the next hour. For different time ranges, set *earliest_time* and *latest_time*. For example, for all times in the last day use "earliest_time=-1d" and "latest_time=now". :param earliest_time: The earliest time. :type earliest_time: ``string`` :param latest_time: The latest time. :type latest_time: ``string`` :return: The list of search times. scheduled_times) earliest_time latest_time)rdrrrryr fromtimestampr)rrzr{r]rrr=timess r%rySavedSearch.scheduled_times* s88-*7(35$$X.%++5575Q''A/5 7 7s)A3c&URSUS9 U$)zSkips any scheduled runs of this search in the next *expiration* number of seconds. :param expiration: The expiration period, in seconds. :type expiration: ``integer`` :return: The :class:`SavedSearch`. suppress expirationr)rrs r%rSavedSearch.suppressB s * 4 r$cpURS5nURS:Xa[UR5$g)zReturns the number of seconds that this search is blocked from running (possibly 0). :return: The number of seconds. :rtype: ``integer`` rrr)r suppressedrr)rrgs r%rSavedSearch.suppressedN s2   Z ( <<3 q||$ $r$c&URSSS9 U$)z`Cancels suppression and makes this search run as scheduled. :return: The :class:`SavedSearch`. rrcrrrs r% unsuppressSavedSearch.unsuppress[ s * - r$rrB)rz+1h)rrr r!r"rrgrArjrmrrtrryrrrr#rr$r%rcrc sk/7HH &("*0   r$rcc$\rSrSrSrSrSrSrg)rid ztThis class represents a collection of saved searches. Retrieve this collection using :meth:`Service.saved_searches`.c>[RX[[S9 gr)rrPATH_SAVED_SEARCHESrcrs r%rSavedSearches.__init__h s .[  Br$c 4[R"X4SU0UD6$)aCreates a saved search. :param name: The name for the saved search. :type name: ``string`` :param search: The search query. :type search: ``string`` :param kwargs: Additional arguments (optional). For a list of available parameters, see `Saved search parameters `_ on Splunk Developer Portal. :type kwargs: ``dict`` :return: The :class:`SavedSearches` collection. r rr)rrTr rs r%rSavedSearches.createl s  EFEfEEr$rNrrr r!r"rrr#rr$r%rrd s8BFr$rcx\rSrSrSrSr\S5r\S5r\S5r \S5r S S jr \S 5r S r g) Macroi} z%This class represents a search macro.c 4[R"XU40UD6 grBrNris r%rMacro.__init__ rPr$cNURRRSS5$)zNReturns the macro arguments. :return: The macro arguments. :rtype: ``string`` rOr'rhrrdrs r%rO Macro.args s! {{""&&vr22r$cNURRRSS5$)zPReturns the macro definition. :return: The macro definition. :rtype: ``string`` definitionr'rrs r%rMacro.definition ! {{""&&|R88r$cNURRRSS5$)z|Returns the validation error message for the macro. :return: The validation error message for the macro. :rtype: ``string`` errormsgr'rrs r%rMacro.errormsg s! {{""&&z266r$cNURRRSS5$)zsReturns the eval-based definition status of the macro. :return: The iseval value for the macro. :rtype: ``string`` isevalrcrrs r%r Macro.iseval s! {{""&&x55r$Nc jUcURRn[R"U4SU0UD6 U$)aUpdates the server with any changes you've made to the current macro along with any additional arguments you specify. :param `definition`: The macro definition (optional). :type definition: ``string`` :param `kwargs`: Additional arguments (optional). Available parameters are: 'disabled', 'iseval', 'validation', and 'errormsg'. :type kwargs: ``dict`` :return: The :class:`Macro`. r)rrrdr)rrrs r%r Macro.update s3  DLL,C,Cz d[RX[[S9 gr)rr PATH_MACROSrrs r%rMacros.__init__ s ;U  4r$c 4[R"X4SU0UD6$)aUCreates a macro. :param name: The name for the macro. :type name: ``string`` :param definition: The macro definition. :type definition: ``string`` :param kwargs: Additional arguments (optional). Available parameters are: 'disabled', 'iseval', 'validation', and 'errormsg'. :type kwargs: ``dict`` :return: The :class:`Macros` collection. rr)rrTrrs r%r Macros.create s  M MfMMr$rNrrr$r%rr s04 Nr$rc$\rSrSrSrSrSrSrg)ri z{This class represents configuration settings for a Splunk service. Retrieve this collection using :meth:`Service.settings`.c 4[R"XS40UD6 g)Nz/services/server/settingsrN)rrHrs r%rSettings.__init__ s'BMfMr$c >URR"S0UD6 U$)aUpdates the settings on the server using the arguments you provide. :param kwargs: Additional arguments. For a list of valid arguments, see `POST server/settings/{name} `_ in the REST API documentation. :type kwargs: ``dict`` :return: The :class:`Settings` collection. )z"/services/server/settings/settings)rHrrs r%rSettings.update s I&I r$rN)rrr r!r"rrr#rr$r%rr s@N r$rc(\rSrSrSr\S5rSrg)Useri z)This class represents a Splunk user. cURRR5Vs/sHoRPM nnURRVs/sH#o3U;dM URRUPM% sn$s snfs snf)z]Returns a list of roles assigned to this user. :return: The list of roles. :rtype: ``list`` )rHr rfrTr)rrgall_role_namesrTs r% role_entitiesUser.role_entities sq+/,,*<*<*A*A*CD*CQ&&*CD59\\5G5Gb5GTSaKa( ""4(5GbbEbsB B#BrN)rrr r!r"rArr#rr$r%rr sccr$rc6\rSrSrSrSrSrSrSrSr Sr g ) r>i zThis class represents the collection of Splunk users for this instance of Splunk. Retrieve this collection using :meth:`Service.users`. c>[RX[[S9 gr)rr PATH_USERSrrs r%rUsers.__init__ D:DAr$cH[RXR55$rBrr|r0rvs r%r|Users.__getitem__%%dIIK88r$cH[RXR55$rBrrnr0rs r%rnUsers.__contains__&&tZZ\::r$c [U[5(d[S[U535eUR5nUR"SXUS.UD6 UR U5n[ U[5Rn[U5nURUR[R"URR5US9nU$)aCreates a new user. This function makes two roundtrips to the server, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :param username: The username. :type username: ``string`` :param password: The password. :type password: ``string`` :param roles: A single role or list of roles for the user. :type roles: ``string`` or ``list`` :param params: Additional arguments (optional). For a list of available parameters, see `User authentication parameters `_ on Splunk Developer Portal. :type params: ``dict`` :return: The new user. :rtype: :class:`User` **Example**:: import splunklib.client as client c = client.connect(...) users = c.users boris = users.create("boris", "securepassword", roles="user") hilda = users.create("hilda", "anotherpassword", roles=["user","power"]) zInvalid username: )rTrFr rrrerr8r0rrdr_rrrrrHrrr{r) rrrFr rr]rrgrs r%r Users.creates<(C((1#h-AB B>># Jx%J6J88H%8[177!%( LL MM%++// 0 r$cH[RXR55$)zDeletes the user and returns the resulting collection of users. :param name: The name of the user to delete. :type name: ``string`` :return: :rtype: :class:`Users` rrr0rs r%r Users.delete3s  zz|44r$rN rrr r!r"rr|rnrrr#rr$r%r>r> s"B9;+Z 5r$r>c$\rSrSrSrSrSrSrg)Rolei?z'This class represents a user role. cURRnUHnX2;dM [U5e US[U5-nUR US9 U$)aGrants additional capabilities to this role. :param capabilities_to_grant: Zero or more capabilities to grant this role. For a list of capabilities, see `Capabilities `_ on Splunk Developer Portal. :type capabilities_to_grant: ``string`` or ``list`` :return: The :class:`Role`. **Example**:: service = client.connect(...) role = service.roles['somerole'] role.grant('change_own_password', 'search') rr)rHrr/rfr)rcapabilities_to_grantpossible_capabilities capabilitynew_capabilitiess r%grant Role.grantCs[ !% 9 9/J6&z220 /$7L2MM / 0 r$cURRnUHnX2;dM [U5e USn/nUHnXa;dM URU5 M U(dSnUR US9 U$)aRevokes zero or more capabilities from this role. :param capabilities_to_revoke: Zero or more capabilities to grant this role. For a list of capabilities, see `Capabilities `_ on Splunk Developer Portal. :type capabilities_to_revoke: ``string`` or ``list`` :return: The :class:`Role`. **Example**:: service = client.connect(...) role = service.roles['somerole'] role.revoke('change_own_password', 'search') rr'r)rHrr/rr)rcapabilities_to_revokerrold_capabilitiesrrqs r%revoke Role.revoke[s"!% 9 90J6&z221 /!A. ''*" !  / 0 r$rN)rrr r!r"rrr#rr$r%rr?s0r$rc6\rSrSrSrSrSrSrSrSr Sr g ) ri{z{This class represents the collection of roles in the Splunk instance. Retrieve this collection using :meth:`Service.roles`.c>[RX[[S9 gr)rr PATH_ROLESrrs r%rRoles.__init__rr$cH[RXR55$rBrrvs r%r|Roles.__getitem__rr$cH[RXR55$rBrrs r%rnRoles.__contains__rr$c [U[5(d[S[U535eUR5nUR"SSU0UD6 UR U5n[ U[5Rn[U5nURUR[R"URR5US9nU$)aCreates a new role. This function makes two roundtrips to the server, plus at most two more if the ``autologin`` field of :func:`connect` is set to ``True``. :param name: Name for the role. :type name: ``string`` :param params: Additional arguments (optional). For a list of available parameters, see `Roles parameters `_ on Splunk Developer Portal. :type params: ``dict`` :return: The new role. :rtype: :class:`Role` **Example**:: import splunklib.client as client c = client.connect(...) roles = c.roles paltry = roles.create("paltry", imported_roles="user", defaultApp="search") zInvalid role name: rTrrr)rrTrr]rrgrs r%r Roles.creates2$$$23t9+>? ?zz| &t&v&88D>8[177!%( LL MM%++// 0 r$cH[RXR55$)zDeletes the role and returns the resulting collection of roles. :param name: The name of the role to delete. :type name: ``string`` :rtype: The :class:`Roles` rrs r%r Roles.deletes  zz|44r$rNrrr$r%rr{s"=B9;&P5r$rc4\rSrSrSr\S5rSrSrSr g)riz*Represents a locally-installed Splunk app.c:URRSS5$)zLReturns the setup information for the app. :return: The setup information. z eai:setupNr6rs r% setupInfoApplication.setupInfos || T22r$c$URS5$)z6Creates a compressed package of the app for archiving.packagerrs r%rApplication.packages **r$c$URS5$)z=Returns any update information that is available for the app.rrrs r% updateInfoApplication.updateInfos))r$rN) rrr r!r"rArrrr#rr$r%rrs!4 33+*r$rc.\rSrSrSrSr004SjrSrg)r;ic6[RXS[S9 g)Nzstorage/collections/configr)rrKVStoreCollectionrs r%rKVStoreCollections.__init__sD+GN_`r$c[RX5nURR5H0up4SU;dM [R "U5URU'M2 U$)Naccelerated_fields)rr|rrNrkrm)rrresrDrLs r%r|KVStoreCollections.__getitem__sO$$T0KK%%'DA#q(!%A A( r$c UR5H7upV[U[5(a[R"U5nXdSU-'M9 UR5H upVXdSU-'M UR "SSU0UD6$)aCreates a KV Store Collection. :param name: name of collection to create :type name: ``string`` :param accelerated_fields: dictionary of accelerated_fields definitions :type accelerated_fields: ``dict`` :param fields: dictionary of field definitions :type fields: ``dict`` :param kwargs: a dictionary of additional parameters specifying indexes and field definitions :type kwargs: ``dict`` :return: Result of POST request accelerated_fields.field.rTr)rNrerrkdumpsr)rrTrr}rrDrLs r%rKVStoreCollections.createsx',,.DA!T""JJqM01(1, -/LLNDA#$8a< #yy-d-f--r$rN)rrr r!rr|rr#rr$r%r;r;sa/1.r$r;c0\rSrSr\S5rSrSrSrg)ric[U5$)zQReturns data object for this Collection. :rtype: :class:`KVStoreCollectionData` )KVStoreCollectionDatars r%rKVStoreCollection.datas %T**r$c0n[U[5(a[R"U5OUUSU-'UR"S0UD6$)zChanges the definition of a KV Store accelerated_field. :param name: name of accelerated_fields to change :type name: ``string`` :param value: new accelerated_fields definition :type value: ``dict`` :return: Result of POST request rr)rerrkrrrrTrrs r%update_accelerated_field*KVStoreCollection.update_accelerated_fieldsDDNuVZD[D[tzz%/@af$t+,yy"6""r$c80nX#SU-'UR"S0UD6$)zChanges the definition of a KV Store field. :param name: name of field to change :type name: ``string`` :param value: new field definition :type value: ``string`` :return: Result of POST request rrrrs r% update_fieldKVStoreCollection.update_fields'"'x$yy"6""r$rN) rrr r!rArrr r#rr$r%rrs ++ # #r$rcj\rSrSrSrS/rSrSrSrSr Sr S r S r SS jr S rSrSrSrSrg )rizpThis class represents the data endpoint for a KVStoreCollection. Retrieve using :meth:`KVStoreCollection.data` )z Content-Typezapplication/jsoncURUlXlUR5uUlUlUlS[ URRSS9-S-Ulg)Nzstorage/collections/data/Trr) rH collectionrr:rTrUr rTr)rr s r%rKVStoreCollectionData.__init__sS!)) $-7-I-I-K* DHdl/*T__=Q=Q`d2eehkk r$c URR"URU-4URURUR S.UD6$r)rHrdrr:rTrUrurlrs r%_getKVStoreCollectionData._get$s=|| CptzztxxY]YeYepioppr$c URR"URU-4URURUR S.UD6$r)rHrrr:rTrUrs r%_postKVStoreCollectionData._post's=||  Sq Z^ZfZfqjpqqr$c URR"URU-4URURUR S.UD6$r)rHrrr:rTrUrs r%_deleteKVStoreCollectionData._delete*s=||""499s?s$**$((\`\h\hslrssr$c 0UR5H6up#[X[5(dM[R"U5X'M8 [R "UR "S0UD6RR5RS55$)a Gets the results of query, with optional parameters sort, limit, skip, and fields. :param query: Optional parameters. Valid options are sort, limit, skip, and fields :type query: ``dict`` :return: Array of documents retrieved by query. :rtype: ``array`` rWr') rNrerrkrrmrrZr[r\)rrrwrs r%rKVStoreCollectionData.query-sl ++-JC%*d++!ZZ. (zz$))0%055::<CCGLMMr$c [R"UR[[ U5SS95R R 5RS55$)z Returns object with _id = id. :param id: Value for ID. If not a string will be coerced to string. :type id: ``string`` :return: Document with id :rtype: ``dict`` TrrW)rkrmrr rrZr[r\rids r% query_by_id!KVStoreCollectionData.query_by_id>sBzz$))Js2wT$JKPPUUW^^_fghhr$c [U[5(a[R"U5n[R"UR S[ RUS9RR5RS55$)z Inserts item into this collection. An _id field will be generated if not assigned in the data. :param data: Document to insert :type data: ``string`` :return: _id of inserted object :rtype: ``dict`` r'rurZrW) rerrkrrmrr JSON_HEADERrZr[r\)rrs r%insertKVStoreCollectionData.insertJsf dD ! !::d#Dzz JJr#8#D#D4J P U U Z Z \ c cdk ln nr$Nc@UR"S0U(aSU0D6$0D6$)z Deletes all data in collection if query is absent. Otherwise, deletes all data matched by query. :param query: Query to select documents to delete :type query: ``string`` :return: Result of DELETE request rr)r)rrs r%rKVStoreCollectionData.deleteYs%||FGU#3FF2FFr$cFUR[[U5SS95$)z Deletes document that has _id = id. :param id: id of document to delete :type id: ``string`` :return: Result of DELETE request Tr)rr rrs r% delete_by_id"KVStoreCollectionData.delete_by_idds||Js2wTBCCr$c .[U[5(a[R"U5n[R"UR [ [U5SS9[RUS9RR5RS55$)z Replaces document with _id = id with data. :param id: _id of document to update :type id: ``string`` :param data: the new document to insert :type data: ``string`` :return: id of replaced document :rtype: ``dict`` Trr#rW) rerrkrrmrr rrr$rZr[r\)rrrs r%rKVStoreCollectionData.updateosn dD ! !::d#Dzz$**ZBd%KUjUvUv*.%004TTVFF7OM Mr$c[U5S:a [S5e[R"U5n[R"UR S[ RUS9RR5RS55$)z Returns array of results from queries dbqueries. :param dbqueries: Array of individual queries as dictionaries :type dbqueries: ``array`` of ``dict`` :return: Results of each query :rtype: ``array`` of ``array`` ryzMust have at least one query. batch_findr#rW r9rrkrrmrrr$rZr[r\)r dbqueriesrs r%r/ KVStoreCollectionData.batch_findsr y>A ;< <zz)$zz JJ|-B-N-NUYJ Z _ _ d d f m mnu vx xr$c[U5S:a [S5e[R"U5n[R"UR S[ RUS9RR5RS55$)z Inserts or updates every document specified in documents. :param documents: Array of documents to save as dictionaries :type documents: ``array`` of ``dict`` :return: Results of update operation as overall stats :rtype: ``dict`` ryz Must have at least one document. batch_saver#rWr0)r documentsrs r%r4 KVStoreCollectionData.batch_savesr y>A >? ?zz)$zz JJ|-B-N-NUYJ Z _ _ d d f m mnu vx xr$)rTr r:rrHrUrB)rrr r!r"r$rrrrrr r%rr*rr/r4r#rr$r%rrsY88Kl qrtN" i n G DM"x$xr$rrB)nr"rrrkloggingrLr{rtimerurllibr splunklibrsplunklib.datarsplunklib.bindingr r r r r rrr getLoggerrr__all__rrrrPATH_DEPLOYMENT_CLIENTSPATH_DEPLOYMENT_TENANTSPATH_DEPLOYMENT_SERVERSPATH_DEPLOYMENT_SERVERCLASSESrrrrr\r[rLrrrrr PATH_STANZArrjrrC XNAMEF_ATOMr XNAME_CONTENTrrrrr8r)r,r/rrr?rPrUr_rirprr~rrrrFrdrrrrr r1rrrrrrrrrrrrcrrrrrr>rrrr;rrrr$r%rFsq8B  (!***   8 $   1  ./. 9&*    ( $  + # '" $ 44,/ G# i' $ Q}oR80 0 1I1 U*U9 NyN