splunkobject.py

from splunk import auth, entity
from remoteobjects import fields, RemoteObject


class SplunkObject(RemoteObject):

    @classmethod
    def get_path(cls):
        return None

    @classmethod
    def get(cls, url, namespace=None, owner=None, **kw):
        s = cls()
        s._entity = entity.getEntity(cls.get_path(), url, namespace=namespace, owner=owner)
        s.from_entity(s._entity)
        return s

    def __init__(self, **kw):
        super(SplunkObject, self).__init__(**kw)
        self._entity = None
        self._links = {}
        self.namespace = kw.get('namespace')
        self.owner = kw.get('owner')

    def from_entity(self, entity):
        dict_entity = dict(entity)
        dict_entity['name'] = entity.name

        self._links = {}
        for action, uri in entity.links:
            self._links[action] = uri

        self.update_from_dict(dict_entity)


    def post(self, sessionKey=None):
        self.update_entity()
        edit_uri = self._links['edit'] if self._links.get('edit') else self._entity.getFullPath()
        entity.setEntity(self._entity, sessionKey=sessionKey, uri=edit_uri)

    def update_entity(self):
        if not self._entity:
            self._entity = entity.Entity(self.__class__.get_path(), self.name, namespace=self.namespace, owner=self.owner)

        rep = self.to_dict()
        for k in rep:
            if k == 'name': continue
            self._entity[k] = rep[k]

        name = rep.get('name')
        if name: self._entity.name = name


class SavedSearch(SplunkObject):

    name = fields.Field()
    search = fields.Field()
    dispatch_earliest_time = fields.Field(api_name='dispatch.earliest_time')
    dispatch_latest_time = fields.Field(api_name='dispatch.latest_time')
    dispatch_max_time = fields.Field(api_name='dispatch.max_time')

    @classmethod
    def get_path(self):
        return '/saved/searches'


if __name__ == '__main__':
    key = auth.getSessionKey('admin', 'changeme')
    ssearch = SavedSearch.get('Errors in the last 24 hours', namespace='search', owner='admin')
    print(ssearch.dispatch_earliest_time)
    ssearch.dispatch_earliest_time = '-3h'
    ssearch.post()
    print(ssearch.dispatch_earliest_time)

    snew = SavedSearch(namespace="search", owner="admin")
    snew.name = 'foobarbaz'
    snew.search = 'index=_internal'
    snew.post()
    print(snew.dispatch_max_time)
    snew = SavedSearch.get('foobarbaz', namespace='search', owner='admin')
    print(snew.dispatch_max_time)