Ii SrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK J r SSK J r SSK J r SSKJr SSKJr SS KJr SS KJr SS KJrJr SS KJr SS KJr \R8"\5r/SQr/SQr Sr!Sr"Sr#Sr$Sr%Sr&Sr'"SS5r("SS\)5r*\ S5r+Sr,\#\!\"4Sjr-S-Sjr."SS 5r/S!r0"S"S#\15r2"S$S%\25r3S&r4S'r5"S(S)5r6"S*S+\Rn5r8S.S,jr9g)/aThe **splunklib.binding** module provides a low-level binding interface to the `Splunk REST API `_. This module handles the wire details of calling the REST API, such as authentication tokens, prefix paths, URL encoding, and so on. Actual path segments, ``GET`` and ``POST`` arguments, and the parsing of responses is left to the user. If you want a friendlier interface to the Splunk REST API, use the :mod:`splunklib.client` module. N) b64encode)contextmanager)datetimewraps)BytesIO)parse)client) SimpleCookie)XML ParseError)record) __version__) AuthenticationErrorconnectContexthandler HTTPError UrlEncoded_encode_make_cookie_header_NoAuthenticationToken namespace) AuthorizationCookiezaction.email.auth_passwordauth auth_passwordclear_passwordclientIdzcrc-salt encr_password oldpasswordpassAuthpasswordsessionsuppressionKeytoken localhost8089httpsc0^[T5U4Sj5nU$)Nc>[R"5nT"U0UD6n[R"5n[RSXB- 5 U$)NzOperation took %s)rnowloggerdebug)argskwargs start_timevalend_timefs 7/venv/lib/python3.13/site-packages/splunklib/binding.pynew_f_log_duration..new_fIs?\\^   <<> ((*?@ r)r4r6s` r5 _log_durationr9Hs  1X Lr8c.[U[5(d[R"U5n[U[5(dU$0nUR 5H"up4U[ ;aSX#'M[U5X#'M$ U$![a nUsSnA$SnAff=f)z2 Masked sensitive fields data for logging purpose Nz******) isinstancedictjsonloads ExceptionitemsSENSITIVE_KEYSmask_sensitive_data)dataexmdatakvs r5rBrBTs dD ! ! ::d#D dD ! ! E   EH*1-EH  L K sA>> BB BBcx[U5nUR5HnURXR'M g)aTries to parse any key-value pairs of cookies in a string, then updates the the dictionary with any key-value pairs found. **Example**:: dictionary = {} _parse_cookies('my=value', dictionary) # Now the following is True dictionary['my'] == 'value' :param cookie_str: A string containing "key=value" pairs from an HTTP "Set-Cookie" header. :type cookie_str: ``str`` :param dictionary: A dictionary to update with any found key-value pairs. :type dictionary: ``dict`` N)r values coded_valuekey) cookie_str dictionary parsed_cookiecookies r5_parse_cookiesrPjs3 !,M&&(!'!3!3 ::)r8c2SRSU55$)a Takes a list of 2-tuples of key-value pairs of cookies, and returns a valid HTTP ``Cookie`` header. **Example**:: header = _make_cookie_header([("key", "value"), ("key_2", "value_2")]) # Now the following is True header == "key=value; key_2=value_2" :param cookies: A list of 2-tuples of cookie key-value pairs. :type cookies: ``list`` of 2-tuples :return: ``str` An HTTP header cookie string. :rtype: ``str`` z; c34# UHupUSU3v M g7f)=N).0rKvalues r5 &_make_cookie_header..s@*#uAeW%s)join)cookiess r5rrs" 99@@ @@r8c\rSrSrSrSrg)raThe value stored in a :class:`Context` or :class:`splunklib.client.Service` class that is not logged in. If a ``Context`` or ``Service`` object is created without an authentication token, and there has not yet been a call to the ``login`` method, the token field of the ``Context`` or ``Service`` object is set to ``_NoAuthenticationToken``. Likewise, after a ``Context`` or ``Service`` object has been logged out, the token is set to this value again. rTN)__name__ __module__ __qualname____firstlineno____doc____static_attributes__rTr8r5rrs r8rc:\rSrSrSrS SjrSrSrSrSr Sr g ) raThis class marks URL-encoded strings. It should be considered an SDK-private implementation detail. Manually tracking whether strings are URL encoded can be difficult. Avoid calling ``urllib.quote`` to replace special characters with escapes. When you receive a URL-encoded string, *do* use ``urllib.unquote`` to replace escapes with single characters. Then, wrap any string you want to use as a URL in ``UrlEncoded``. Note that because the ``UrlEncoded`` class is idempotent, making multiple calls to it is OK. ``UrlEncoded`` objects are identical to ``str`` objects (including being equal if their contents are equal) except when passed to ``UrlEncoded`` again. ``UrlEncoded`` removes the ``str`` type support for interpolating values with ``%`` (doing that raises a ``TypeError``). There is no reliable way to encode values this way, so instead, interpolate into a string, quoting by hand, and call ``UrlEncode`` with ``skip_encode=True``. **Example**:: import urllib UrlEncoded(f'{scheme}://{urllib.quote(host)}', skip_encode=True) If you append ``str`` strings and ``UrlEncoded`` strings, the result is also URL encoded. **Example**:: UrlEncoded('ab c') + 'de f' == UrlEncoded('ab cde f') 'ab c' + UrlEncoded('de f') == UrlEncoded('ab cde f') c[U[5(aU$U(a[RX5$U(a*[RU[R "U55$[RU[R "U55$N)r;rstr__new__r quote_plusquote)selfr2 skip_encode encode_slashs r5rhUrlEncoded.__new__sa c: & &J ;;t) ) ;;tU%5%5c%:; ;{{4S!122r8c[U[5(a[[RX5SS9$[[RU[R "U55SS9$)zRself + other If *other* is not a ``UrlEncoded``, URL encode it before adding it. Trl)r;rrg__add__r rjrkothers r5rqUrlEncoded.__add__sH eZ ( (ckk$6DI I#++dEKK,>?TRRr8c[U[5(a[[RX5SS9$[[R [ R "U5U5SS9$)zSother + self If *other* is not a ``UrlEncoded``, URL _encode it before adding it. Trp)r;rrg__radd__rqr rjrrs r5rvUrlEncoded.__radd__sH eZ ( (cll47TJ J#++ekk%&8$?TRRr8c[S5e)z{Interpolation into ``UrlEncoded``s is disabled. If you try to write ``UrlEncoded("%s") % "abc", will get a ``TypeError``. z,Cannot interpolate into a UrlEncoded object.) TypeError)rkfieldss r5__mod__UrlEncoded.__mod__s FGGr8cZS[[R"[U555S3$)Nz UrlEncoded())reprr unquotergrks r5__repr__UrlEncoded.__repr__s$T%--D ":;>r8rTN)FF) r]r^r_r`rarhrqrvr{rrbrTr8r5rrs$B 3 S SH?r8rc#r# Sv g![a!nURS:Xa [X5eeSnAff=f7f)aHandle re-raising HTTP authentication errors as something clearer. If an ``HTTPError`` is raised with status 401 (access denied) in the body of this context manager, re-raise it as an ``AuthenticationError`` instead, with *msg* as its message. This function adds no round trips to the server. :param msg: The message to be raised in ``AuthenticationError``. :type msg: ``str`` **Example**:: with _handle_auth_error("Your login failed."): ... # make an HTTP request N)rstatusr)msghes r5_handle_auth_errorrs6$  99 %c. .  s7 7 4/47c0^[T5U4Sj5nU$)aDecorator to handle autologin and authentication errors. *request_fun* is a function taking no arguments that needs to be run with this ``Context`` logged into Splunk. ``_authentication``'s behavior depends on whether the ``autologin`` field of ``Context`` is set to ``True`` or ``False``. If it's ``False``, then ``_authentication`` aborts if the ``Context`` is not logged in, and raises an ``AuthenticationError`` if an ``HTTPError`` of status 401 is raised in *request_fun*. If it's ``True``, then ``_authentication`` will try at all sensible places to log in before issuing the request. If ``autologin`` is ``False``, ``_authentication`` makes one roundtrip to the server if the ``Context`` is logged in, or zero if it is not. If ``autologin`` is ``True``, it's less deterministic, and may make at most three roundtrips (though that would be a truly pathological case). :param request_fun: A function of no arguments encapsulating the request to make to the server. **Example**:: import splunklib.binding as binding c = binding.connect(..., autologin=True) c.logout() def f(): c.get("/services") return 42 print(_authentication(f)) c>UR[LazUR5(deUR(a3UR(a"UR (aUR 5 O![S5 T"U/UQ70UD6sSSS5 $T"U/UQ70UD6$!,(df  N=f![anURS:XaUR(aq[S5 UR 5 SSS5 O!,(df  O=f[S5 T"U/UQ70UD6sSSS5 sSnA$!,(df  SnAg=fURS:XaUR(d [SU5eeSnAff=f)NzRequest aborted: not logged in.rzAutologin failed.zOAuthentication Failed! If session token is used, it seems to have been expired.z)Request failed: Session is not logged in.) r&r has_cookies autologinusernamer#loginrrrr)rkr/r0r request_funs r5wrapper _authentication..wrapper1s" ::/ /8H8H8J8J~~$--DMM ((IJ&t=d=f=KJ t5d5f5 5 KJ  yyCDNN((;<JJL=<<'(yz&t=d=f={zzzzc!$..)?EE s`9 B B- B*- E<7,E7#C=4 E7= D E7 D4% E7.E<4 E >E71E77E<r)rrs` r5_authenticationrs$F ;> Nr8cSU;a4URS5(aURS5(dSU-S-n[USUSU3SS9$)a8Construct a URL authority from the given *scheme*, *host*, and *port*. Named in accordance with RFC2396_, which defines URLs as:: ://? .. _RFC2396: http://www.ietf.org/rfc/rfc2396.txt So ``https://localhost:8000/a/b/b?boris=hilda`` would be parsed as:: scheme := https authority := localhost:8000 path := /a/b/c query := boris=hilda :param scheme: URL scheme (the default is "https") :type scheme: "http" or "https" :param host: The host name (the default is "localhost") :type host: string :param port: The port number (the default is 8089) :type port: integer :return: The URL authority. :rtype: UrlEncoded (subclass of ``str``) **Example**:: _authority() == "https://localhost:8089" _authority(host="splunk.utopia.net") == "https://splunk.utopia.net:8089" _authority(host="2001:0db8:85a3:0000:0000:8a2e:0370:7334") == "https://[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:8089" _authority(scheme="http", host="splunk.utopia.net", port="471") == "http://splunk.utopia.net:471" :[]z://Trp) startswithendswithr)schemehostports r5 _authorityrTsVN d{DOOC00T]]35G5GTzC D64&1t DDr8c US;a[USSS.5$US;a[USUS.5$US;a[XUS.5$[S5e)aThis function constructs a Splunk namespace. Every Splunk resource belongs to a namespace. The namespace is specified by the pair of values ``owner`` and ``app`` and is governed by a ``sharing`` mode. The possible values for ``sharing`` are: "user", "app", "global" and "system", which map to the following combinations of ``owner`` and ``app`` values: "user" => {owner}, {app} "app" => nobody, {app} "global" => nobody, {app} "system" => nobody, system "nobody" is a special user name that basically means no user, and "system" is the name reserved for system resources. "-" is a wildcard that can be used for both ``owner`` and ``app`` values and refers to all users and all apps, respectively. In general, when you specify a namespace you can specify any combination of these three values and the library will reconcile the triple, overriding the provided values as appropriate. Finally, if no namespacing is specified the library will make use of the ``/services`` branch of the REST API, which provides a namespaced view of Splunk resources equivelent to using ``owner={currentUser}`` and ``app={defaultApp}``. The ``namespace`` function returns a representation of the namespace from reconciling the values you provide. It ignores any keyword arguments other than ``owner``, ``app``, and ``sharing``, so you can provide ``dicts`` of configuration information without first having to extract individual keys. :param sharing: The sharing mode (the default is "user"). :type sharing: "system", "global", "app", or "user" :param owner: The owner context (the default is "None"). :type owner: ``string`` :param app: The app context (the default is "None"). :type app: ``string`` :returns: A :class:`splunklib.data.Record` containing the reconciled namespace. **Example**:: import splunklib.binding as binding n = binding.namespace(sharing="user", owner="boris", app="search") n = binding.namespace(sharing="global", app="search") )systemnobodyr)sharingownerapp)globalr)userNz%Invalid value for argument: 'sharing')r ValueError)rrrr0s r5rrs^f*'HXNOO##'HSIJJ. '#FGG < ==r8c\rSrSrSrSSjrSrSr\S5r Sr \ \ SS j55r \ \ SS j55r\ \ SS j55r\ \ S S0SSS4S j55rSrSrSSjrSrg)ria This class represents a context that encapsulates a splunkd connection. The ``Context`` class encapsulates the details of HTTP requests, authentication, a default namespace, and URL prefixes to simplify access to the REST API. After creating a ``Context`` object, you must call its :meth:`login` method before you can issue requests to splunkd. Or, use the :func:`connect` function to create an already-authenticated ``Context`` object. You can provide a session token explicitly (the same token can be shared by multiple ``Context`` objects) to provide authentication. :param host: The host name (the default is "localhost"). :type host: ``string`` :param port: The port number (the default is 8089). :type port: ``integer`` :param scheme: The scheme for accessing the service (the default is "https"). :type scheme: "https" or "http" :param verify: Enable (True) or disable (False) SSL verification for https connections. :type verify: ``Boolean`` :param self_signed_certificate: Specifies if self signed certificate is used :type self_signed_certificate: ``Boolean`` :param sharing: The sharing mode for the namespace (the default is "user"). :type sharing: "global", "system", "app", or "user" :param owner: The owner context of the namespace (optional, the default is "None"). :type owner: ``string`` :param app: The app context of the namespace (optional, the default is "None"). :type app: ``string`` :param token: A session token. When provided, you don't need to call :meth:`login`. :type token: ``string`` :param cookie: A session cookie. When provided, you don't need to call :meth:`login`. This parameter is only supported for Splunk 6.2+. :type cookie: ``string`` :param username: The Splunk account username, which is used to authenticate the Splunk instance. :type username: ``string`` :param password: The password for the Splunk account. :type password: ``string`` :param splunkToken: Splunk authentication token :type splunkToken: ``string`` :param headers: List of extra HTTP headers to send (optional). :type headers: ``list`` of 2-tuples. :param retires: Number of retries for each HTTP connection (optional, the default is 0). NOTE THAT THIS MAY INCREASE THE NUMBER OF ROUND TRIP CONNECTIONS TO THE SPLUNK SERVER AND BLOCK THE CURRENT THREAD WHILE RETRYING. :type retries: ``int`` :param retryDelay: How long to wait between connection attempts if `retries` > 0 (optional, defaults to 10s). :type retryDelay: ``int`` (in seconds) :param handler: The HTTP request handler (optional). :returns: A ``Context`` instance. **Example**:: import splunklib.binding as binding c = binding.Context(username="boris", password="natasha", ...) c.login() # Or equivalently c = binding.connect(username="boris", password="natasha") # Or if you already have a session token c = binding.Context(token="atg232342aa34324a") # Or if you already have a valid cookie c = binding.Context(cookie="splunkd_8089=...") Nc 4[XRSS5URS5URS5URS5URSS5URSS 5S 9UlURS [5UlURc [UlURS [ 5UlURS [5Ul[URS[55Ul [UR URUR5Ul [S0UD6UlURSS5UlURSS5UlURSS5UlURSS5UlURSS5UlURS/5UlURSS5UlSU;a4USS[4;a$[-USURR.5 ggg)NverifyFkey_file cert_filecontextretriesr retryDelay )rrrrrr&rrrrrr#basic splunkTokenrheadersself_signed_certificateTrOrT)HttpLibgethttprr&DEFAULT_SCHEMEr DEFAULT_HOSTrint DEFAULT_PORTrr authorityrrr#r bearerTokenradditional_headers_self_signed_certificaterP_cookies)rkrr0s r5__init__Context.__init__sGZZ%%@6::V`Ka&,jj&=vzzR[G\$*JJy!$<T`bdIeg ZZ)?@ :: /DJjj>: JJv|4  6<89 #DKKDIIF",V, :r2  :r2 ZZ/ !::mR8K7"(**Y";(. 3Ld(S% v &"24AW:X"X 6(+TYY-?-? @#Y r8c.URR$)zGets the dictionary of cookies from the ``HttpLib`` member of this instance. :return: Dictionary of cookies stored on the ``self.http``. :rtype: ``dict`` )rrrs r5 get_cookiesContext.get_cookiess yy!!!r8cj^Sm[U4SjUR5R555$)zReturns true if the ``HttpLib`` member of this instance has auth token stored. :return: ``True`` if there is auth token present, else ``False`` :rtype: ``bool`` splunkd_c3.># UH nTU;v M g7frfrT)rUrKauth_token_keys r5rW&Context.has_cookies..(sN4MS>S(4Ms)anyrkeys)rkrs @r5rContext.has_cookies!s- $ND4D4D4F4K4K4MNNNr8c V/nUR5(a3S[[UR5R 5554/$UR (ajUR (aYUR(aHS[UR <SUR<3RS55RS53nOsUR(aSUR3nORUR[La/nON>N>P>V>V>X9Y%Z[ \ r8c^[R"[R[R5nURS:Xa[R "5nU=R [R[R--slUR(+Ul UR(a[RO[RUl URXRS9nUR![R""UR5UR$45 U$)aReturns an open connection (socket) to the Splunk instance. This method is used for writing bulk events to an index or similar tasks where the overhead of opening a connection multiple times would be prohibitive. :returns: A socket. **Example**:: import splunklib.binding as binding c = binding.connect(...) socket = c.connect() socket.write("POST %s HTTP/1.1\r\n" % "some/path/to/post/to") socket.write("Host: %s:%s\r\n" % (c.host, c.port)) socket.write("Accept-Encoding: identity\r\n") socket.write("Authorization: %s\r\n" % c.token) socket.write("X-Splunk-Input-Mode: Streaming\r\n") socket.write("\r\n") r))server_hostname)socketAF_INET SOCK_STREAMrsslcreate_default_contextoptions OP_NO_TLSv1 OP_NO_TLSv1_1rcheck_hostname CERT_NONE CERT_REQUIRED verify_mode wrap_socketrr gethostbynamer)rksockrs r5rContext.connectKs*}}V^^V-?-?@ ;;' !002G OOs1B1BB BO)-)F)F%FG "373P3P#--VYVgVgG &&tYY&GD f**4995tyyAB r8c URURXX4S9-n[RSU[ U55 UR R "X`R40UD6nU$)aPerforms a DELETE operation at the REST path segment with the given namespace and query. This method is named to match the HTTP method. ``delete`` makes at least one round trip to the server, one additional round trip for each 303 status returned, and at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. If *owner*, *app*, and *sharing* are omitted, this method uses the default :class:`Context` namespace. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Context`` object is not logged in. :raises HTTPError: Raised when an error occurred in a GET operation from *path_segment*. :param path_segment: A REST path segment. :type path_segment: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode of the namespace (optional). :type sharing: ``string`` :param query: All other keyword arguments, which are used as query parameters. :type query: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: c = binding.connect(...) c.delete('saved/searches/boris') == \ {'body': ...a response reader object..., 'headers': [('content-length', '1786'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 16:53:06 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'status': 200} c.delete('nonexistant/path') # raises HTTPError c.logout() c.delete('apps/local') # raises AuthenticationError rrrzDELETE request to %s (body: %s))r_abspathr-r.rBrdeleter)rk path_segmentrrrquerypathresponses r5rContext.deletejsfh~~ l25!.!HH 6>QRW>XY99##D*<*<FFr8c Uc/nURURXX5S9-n[RSU[ U55 X@R -UR -nURR"Xx40UD6n U $)a"Performs a GET operation from the REST path segment with the given namespace and query. This method is named to match the HTTP method. ``get`` makes at least one round trip to the server, one additional round trip for each 303 status returned, and at most two additional round trips if the ``autologin`` field of :func:`connect` is set to ``True``. If *owner*, *app*, and *sharing* are omitted, this method uses the default :class:`Context` namespace. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Context`` object is not logged in. :raises HTTPError: Raised when an error occurred in a GET operation from *path_segment*. :param path_segment: A REST path segment. :type path_segment: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param headers: List of extra HTTP headers to send (optional). :type headers: ``list`` of 2-tuples. :param sharing: The sharing mode of the namespace (optional). :type sharing: ``string`` :param query: All other keyword arguments, which are used as query parameters. :type query: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: c = binding.connect(...) c.get('apps/local') == \ {'body': ...a response reader object..., 'headers': [('content-length', '26208'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 16:30:35 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'status': 200} c.get('nonexistant/path') # raises HTTPError c.logout() c.get('apps/local') # raises AuthenticationError rzGET request to %s (body: %s)) rrr-r.rBrrrr) rkrrrrrrr all_headersrs r5r Context.getsl ?G~~ l25!.!HH 3T;Nu;UV 7 77$:L:LL 99==>$=u=r8GETc Uc/nURURXXgS9-nX0R-UR-n [R SX([ [[U 555[U55 U(a.[S 0UD6nUS:XaU[SU-SS9-nUU S.n O UU US.n OUU S.n URRX5n U $) aIssues an arbitrary HTTP request to the REST path segment. This method is named to match ``httplib.request``. This function makes a single round trip to the server. If *owner*, *app*, and *sharing* are omitted, this method uses the default :class:`Context` namespace. All other keyword arguments are included in the URL as query parameters. :raises AuthenticationError: Raised when the ``Context`` object is not logged in. :raises HTTPError: Raised when an error occurred in a GET operation from *path_segment*. :param path_segment: A REST path segment. :type path_segment: ``string`` :param method: The HTTP method to use (optional). :type method: ``string`` :param headers: List of extra HTTP headers to send (optional). :type headers: ``list`` of 2-tuples. :param body: Content of the HTTP request (optional). :type body: ``string`` :param owner: The owner context of the namespace (optional). :type owner: ``string`` :param app: The app context of the namespace (optional). :type app: ``string`` :param sharing: The sharing mode of the namespace (optional). :type sharing: ``string`` :return: The response from the server. :rtype: ``dict`` with keys ``body``, ``headers``, ``reason``, and ``status`` **Example**:: c = binding.connect(...) c.request('saved/searches', method='GET') == \ {'body': ...a response reader object..., 'headers': [('content-length', '46722'), ('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'), ('server', 'Splunkd'), ('connection', 'close'), ('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'), ('date', 'Fri, 11 May 2012 17:24:19 GMT'), ('content-type', 'text/xml; charset=utf-8')], 'reason': 'OK', 'status': 200} c.request('nonexistant/path', method='GET') # raises HTTPError c.logout() c.get('apps/local') # raises AuthenticationError rz(%s request to %s (headers: %s, body: %s)r?TrpmethodrrrbodyrT) rrrrr-r.rgrBr<rrrrequest) rkrrrrrrrrrmessagers r5rContext.request3sj ?G~~|#&99 7 77$:L:LL  ?3':4 ;L'M#NPcdhPi k ?T?DjtFF%+&13&,&1#')"("-/G99$$T3r8cUR5(a#UR(dUR(dgUR[La#UR(dUR(dgUR (a#UR(aUR(agUR (agURRURURS5-URURURSS9nURR5n[U5RS5nSU3UlU$![ a"nUR"S:Xa [%SU5eeSnAff=f) akLogs into the Splunk instance referred to by the :class:`Context` object. Unless a ``Context`` is created with an explicit authentication token (probably obtained by logging in from a different ``Context`` object) you must call :meth:`login` before you can issue requests. The authentication token obtained from the server is stored in the ``token`` field of the ``Context`` object. :raises AuthenticationError: Raised when login fails. :returns: The ``Context`` object, so you can chain calls. **Example**:: import splunklib.binding as binding c = binding.Context(...).login() # Then issue requests... Nz/services/auth/login1)rr#rrOz ./sessionKeyrrz Login failed.)rrr#r&rrrrrrrrrreadr findtextrrr)rkrrr$rs r5r Context.logins(     t}}  ::3 3t}}  ::4==T]]      yy~~/E!FF// &H==%%'D$i((8G"7),DJK yyC)/2>>  s6BE E9E44E9c>[Ul0URlU$)z/Forgets the current session token, and cookies.)rr&rrrs r5logoutContext.logouts+   r8c[U[5nURS5(a [XS9$U(dU(dU(a [X#US9nO URnURcUR c [SU3US9$UR cSO UR nURcSO URn[SUSUSU3US9n U $)aQualifies *path_segment* into an absolute path for a URL. If *path_segment* is already absolute, returns it unchanged. If *path_segment* is relative, then qualifies it with either the provided namespace arguments or the ``Context``'s default namespace. Any forbidden characters in *path_segment* are URL encoded. This function has no network activity. Named to be consistent with RFC2396_. .. _RFC2396: http://www.ietf.org/rfc/rfc2396.txt :param path_segment: A relative or absolute URL path segment. :type path_segment: ``string`` :param owner, app, sharing: Components of a namespace (defaults to the ``Context``'s namespace if all three are omitted) :type owner, app, sharing: ``string`` :return: A ``UrlEncoded`` (a subclass of ``str``). :rtype: ``string`` **Example**:: import splunklib.binding as binding c = binding.connect(owner='boris', app='search', sharing='user') c._abspath('/a/b/c') == '/a/b/c' c._abspath('/a/b c/d') == '/a/b%20c/d' c._abspath('apps/local/search') == '/servicesNS/boris/search/apps/local/search' c._abspath('apps/local/search', sharing='system') == '/servicesNS/nobody/system/apps/local/search' url = c.authority + c._abspath('apps/local/sharing') /rprz /services/rrz /servicesNS/)r;rrrrr) rkrrrrrlnsonameanamers r5rContext._abspathsF!z:   " "3 ' 'lD D C7ABB 66>bhh. <.9{S SHH,"((FFNLqqGU`a r8)rrrrrrrrrr#rrr&rrfNNN)NNNN)r]r^r_r`rarrrpropertyrrrr9rrrrrr rrbrTr8r5rrs>@A2"O>>66p<<|KKZ+0$RdNN`<|04:r8rc <[S0UD6nUR5 U$)aThis function returns an authenticated :class:`Context` object. This function is a shorthand for calling :meth:`Context.login`. This function makes one round trip to the server. :param host: The host name (the default is "localhost"). :type host: ``string`` :param port: The port number (the default is 8089). :type port: ``integer`` :param scheme: The scheme for accessing the service (the default is "https"). :type scheme: "https" or "http" :param owner: The owner context of the namespace (the default is "None"). :type owner: ``string`` :param app: The app context of the namespace (the default is "None"). :type app: ``string`` :param sharing: The sharing mode for the namespace (the default is "user"). :type sharing: "global", "system", "app", or "user" :param token: The current session token (optional). Session tokens can be shared across multiple service instances. :type token: ``string`` :param cookie: A session cookie. When provided, you don't need to call :meth:`login`. This parameter is only supported for Splunk 6.2+. :type cookie: ``string`` :param username: The Splunk account username, which is used to authenticate the Splunk instance. :type username: ``string`` :param password: The password for the Splunk account. :type password: ``string`` :param headers: List of extra HTTP headers to send (optional). :type headers: ``list`` of 2-tuples. :param autologin: When ``True``, automatically tries to log in again if the session terminates. :type autologin: ``Boolean`` :return: An initialized :class:`Context` instance. **Example**:: import splunklib.binding as binding c = binding.connect(...) response = c.get("apps/local") rT)rr)r0cs r5rrs V &AGGI Hr8c"\rSrSrSrSSjrSrg)ri9zAThis exception is raised for HTTP responses that return an error.NcxURnURnURR5n[ U5R S5nUcSOSU3nSUSUU3n[RX=(d U5 X0lX@lURUl XPlXl g![ a UnNjf=f)Nz./messages/msgrz -- zHTTP  ) rreasonrrr rr r?rr _response) rkr_messagerrrdetaildetail_formattedrs r5rHTTPError.__init__<s}}!!# Y''(89F"(2tF8_&6(+;*<=4!4W5  ''  ! F sB** B98B9)rrrrrrfr]r^r_r`rarrbrTr8r5rr9s K"r8rc\rSrSrSrSrSrg)riNzRaised when a login request to Splunk fails. If your username was unknown or you provided an incorrect password in a call to :meth:`Context.login` or :meth:`splunklib.client.Service.login`, this exception is raised. c[UR5URl[R XRU5 grf)rrrrr)rkrcauses r5rAuthenticationError.__init__Vs- 'uzz24':r8rTNrrTr8r5rrNs ;r8rc /nUR5HQup#[U[5(a%URUVs/sHoBU4PM sn5 M?UR X#45 MS [ R "U5$s snfrf)r@r;rextendrr urlencode)r0r@rKrVitems r5rrwsg Elln  eT " " LL%8%$+%8 9 LL# & % ??5 !!9s A> cx[R"U5nURnURnUR(a'SR UR UR45O UR nURS5(aURS5(aUSSnUc[nURX#U4$)Nrrr) r urlparsehostnamerrrYrrrrr)url parsed_urlrrrs r5 _spliturlr/s$J   D ??D response_dict`` where `url` is the URL to make the request to (including any query and fragment sections) as a dictionary with the following keys: - method: The method for the request, typically ``GET``, ``POST``, or ``DELETE``. - headers: A list of pairs specifying the HTTP headers (for example: ``[('key': value), ...]``). - body: A string containing the body to send with the request (this string should default to ''). and ``response_dict`` is a dictionary with the following keys: - status: An integer containing the HTTP status code (such as 200 or 404). - reason: The reason phrase, if any, returned by the server. - headers: A list of pairs containing the response headers (for example, ``[('key': value), ...]``). - body: A stream-like object supporting ``read(size=None)`` and ``close()`` methods to get the body of the response. The response dictionary is returned directly by ``HttpLib``'s methods with no further processing. By default, ``HttpLib`` calls the :func:`handler` function to get a handler function. If using the default handler, SSL verification can be disabled by passing verify=False. Nc\Uc[X#XES9UlOXl0UlX`lXplg)N)rrrr)rrrr)rkcustom_handlerrrrrrrs r5rHttpLib.__init__s,  !"&yjDL)L  $r8c xUc/nU(aU[S[S0UD6-SS9-nSUS.nURX5$)aSends a DELETE request to a URL. :param url: The URL. :type url: ``string`` :param headers: A list of pairs specifying the headers for the HTTP response (for example, ``[('Content-Type': 'text/cthulhu'), ('Token': 'boris')]``). :type headers: ``list`` :param kwargs: Additional keyword arguments (optional). These arguments are interpreted as the query part of the URL. The order of keyword arguments is not preserved in the request, but the keywords and their arguments will be URL encoded. :type kwargs: ``dict`` :returns: A dictionary describing the response (see :class:`HttpLib` for its structure). :rtype: ``dict`` rTrpDELETErrTrrr)rkr-rr0rs r5rHttpLib.deletesN" ?bG  3):6):#:MMC ||C))r8c vUc/nU(aU[S[S0UD6-SS9-nURUSUS.5$)aSends a GET request to a URL. :param url: The URL. :type url: ``string`` :param headers: A list of pairs specifying the headers for the HTTP response (for example, ``[('Content-Type': 'text/cthulhu'), ('Token': 'boris')]``). :type headers: ``list`` :param kwargs: Additional keyword arguments (optional). These arguments are interpreted as the query part of the URL. The order of keyword arguments is not preserved in the request, but the keywords and their arguments will be URL encoded. :type kwargs: ``dict`` :returns: A dictionary describing the response (see :class:`HttpLib` for its structure). :rtype: ``dict`` rTrprrrTr6)rkr-rr0s r5r HttpLib.getsF" ?bG  3):6):#:MMC||CEg!FGGr8c Uc/nSU;a[UVs/sHoDSR5S:XdMUPM sn5S:XaURS5 URS5n[ U[ 5(a[ S 0UD6RS5n[U5S:aU[S[ S 0UD6-SS9-nO[ S 0UD6RS5nS UUS .nURX5$s snf) aSends a POST request to a URL. :param url: The URL. :type url: ``string`` :param headers: A list of pairs specifying the headers for the HTTP response (for example, ``[('Content-Type': 'text/cthulhu'), ('Token': 'boris')]``). :type headers: ``list`` :param kwargs: Additional keyword arguments (optional). If the argument is ``body``, the value is used as the body for the request, and the keywords and their arguments will be URL encoded. If there is no ``body`` keyword argument, all the keyword arguments are encoded into the body of the request in the format ``x-www-form-urlencoded``. :type kwargs: ``dict`` :returns: A dictionary describing the response (see :class:`HttpLib` for its structure). :rtype: ``dict`` rrz content-type)z Content-Typez!application/x-www-form-urlencodedrrTrpPOSTrrT) lenlowerrpopr;r<rrrr)rkr-rr0xrrs r5r HttpLib.posts$ ?bG V wIw!A$**,.*HAwIJaOTU::f%D$%%--g66{QJsW->v->'>DQQ$V$++G4D  ||C))Js C/C/c 8UR"X40UD6n[ U5nSUR::a [U5eURn[UR[5(a#[URR55nUH0upgUR5S:XdM[XpR 5 M2 U$![aI URS::ae[R"UR 5 U=RS-slOf=fGM)aIssues an HTTP request to a URL. :param url: The URL. :type url: ``string`` :param message: A dictionary with the format as described in :class:`HttpLib`. :type message: ``dict`` :param kwargs: Additional keyword arguments (optional). These arguments are passed unchanged to the handler. :type kwargs: ``dict`` :returns: A dictionary describing the response (see :class:`HttpLib` for its structure). :rtype: ``dict`` rr)iz set-cookie)rr?rtimesleeprrrrrr;r<rr@r=rPr)rkr-rr0rkey_value_tuplesrKrVs r5rHttpLib.request%s &<<??(# (// !H% %$++ h&& - -#H$4$4$:$:$<= *JCyy{l*umm4++ &<<1$JJt/LLA%L  & sCADD)rrrr)NFNNNrrrf) r]r^r_r`rarrrrrrbrTr8r5rrs-(Tpq%*:H2)*V(r8rcZ\rSrSrSrS SjrSr\S5rSr Sr S S jr S r S r S rg)ResponseReaderiQaThis class provides a file-like interface for :class:`httplib` responses. The ``ResponseReader`` class is intended to be a layer to unify the different types of HTTP libraries used with this SDK. This class also provides a preview of the stream and a few useful predicates. Nc*XlX lSUlg)Nr8)r _connection_buffer)rkr connections r5rResponseReader.__init__\s!% r8c6[UR5S5$)NzUTF-8)rgrrs r5__str__ResponseReader.__str__as499;((r8c*URS5S:H$)z9Indicates whether there is any more data in the response.r)r8)peekrs r5emptyResponseReader.emptydsyy|s""r8cPURU5nURU-UlU$)zNondestructively retrieves a given number of characters. The next :meth:`read` operation behaves as though this method was never called. :param size: The number of characters to retrieve. :type size: ``integer`` )rrJ)rksizers r5rQResponseReader.peekis& IIdO||a' r8cUR(aURR5 URR5 g)zCloses this response.N)rIcloserrs r5rXResponseReader.closevs-       " " $ r8cURnSUlUbU[U5-nX RRU5-nU$)zReads a given number of characters from the response. :param size: The number of characters to read, or "None" to read the entire response. :type size: ``integer`` or "None" r8)rJr<rr)rkrUrs r5rResponseReader.read|sC LL   CFND ##D) )r8cg)z/Indicates that the response reader is readable.TrTrs r5readableResponseReader.readablesr8c\[U5nURU5n[U5nX1SU&U$)zRead data into a byte array, upto the size of the byte array. :param byte_array: A byte array/memory view to pour bytes into. :type byte_array: ``bytearray`` or ``memoryview`` N)r<r)rk byte_arraymax_sizerC bytes_reads r5readintoResponseReader.readintos4z?yy"Y "&;Jr8)rJrIrrf)r]r^r_r`rarrNrrRrQrXrr^rdrbrTr8r5rGrGQs> )##   r8rGc4^^^^^^UUUUU4SjmUU4SjnU$)aThis class returns an instance of the default HTTP request handler using the values you provide. :param `key_file`: A path to a PEM (Privacy Enhanced Mail) formatted file containing your private key (optional). :type key_file: ``string`` :param `cert_file`: A path to a PEM (Privacy Enhanced Mail) formatted file containing a certificate chain file (optional). :type cert_file: ``string`` :param `timeout`: The request time-out period, in seconds (optional). :type timeout: ``integer`` or "None" :param `verify`: Set to False to disable SSL verification on https connections. :type verify: ``Boolean`` :param `context`: The SSLContext that can is used with the HTTPSConnection when verify=True is enabled and context is specified :type context: ``SSLContext` c >0nTbTUS'US:Xa[R"X40UD6$US:XaSTbTUS'TbTUS'T(d[R"5US'O T(aTUS'[R"X40UD6$[ SU35e)Ntimeoutrr)rrrzunsupported scheme: )r HTTPConnectionr_create_unverified_contextHTTPSConnectionr) rrrr0rrrrhrs r5rhandler..connects  Gy 1 V ((>v> > W #(VJ%7$If[&9$'$B$B$Dy!$+y!))$?? ?/x899r8c>[U5up4pVURSS5n[[U55US[-SSS.nUSH upXU 'M URSS 5n T"X4U5n S n U R XXx5 TbU R RT5 U R5nS URS S S9R5;n U (dU R5 URURUR5[X(aU 5S.$S5S.$!U (dU R5 ff=f)Nrrzsplunk-sdk-python/%sz*/*Close)zContent-LengthHostz User-AgentAccept ConnectionrrrFz keep-aliverKrX)default)rrrr)r/rrgr<rrr settimeout getresponse getheaderr=rXrr getheadersrG)r-rr0rrrrrheadrKrVrrK is_keepaliverrrhs r5rhandler..requestsK#,S> d{{62&!#d)n0;>!  "),JCI-Xu-V40   #   vT 8"**73!--/H'8+=+=lT[+=+\+b+b+ddL  "oooo**,"8rs+   %%1!!   8 $     ,4*A*  N?N?b4CL%xD D N- f" "* ;) ;R"/~~DIR\\IXCr8