diff --git a/splunklib/client.py b/splunklib/client.py index 0a700b2d3..485964992 100644 --- a/splunklib/client.py +++ b/splunklib/client.py @@ -857,32 +857,21 @@ class Entity(Endpoint): ``Entity`` provides the majority of functionality required by entities. Subclasses only implement the special cases for individual entities. - For example for deployment serverclasses, the subclass makes whitelists and - blacklists into Python lists. + For example for saved searches, the subclass makes fields like ``action.email``, + ``alert_type``, and ``search`` available. An ``Entity`` is addressed like a dictionary, with a few extensions, - so the following all work:: - - ent['email.action'] - ent['disabled'] - ent['whitelist'] - - Many endpoints have values that share a prefix, such as - ``email.to``, ``email.action``, and ``email.subject``. You can extract - the whole fields, or use the key ``email`` to get a dictionary of - all the subelements. That is, ``ent['email']`` returns a - dictionary with the keys ``to``, ``action``, ``subject``, and so on. If - there are multiple levels of dots, each level is made into a - subdictionary, so ``email.body.salutation`` can be accessed at - ``ent['email']['body']['salutation']`` or - ``ent['email.body.salutation']``. + so the following all work, for example in saved searches:: + + ent['action.email'] + ent['alert_type'] + ent['search'] You can also access the fields as though they were the fields of a Python object, as in:: - ent.email.action - ent.disabled - ent.whitelist + ent.alert_type + ent.search However, because some of the field names are not valid Python identifiers, the dictionary-like syntax is preferable.