So i call the splunk rest api and collect results in json format and that is kind of okay
Then i would like to pass it to splunk.Intersplunk.outputResults()
Intersplunk fails to flatten this kind of complex object so a workaround would be to just get the subset data["entry"] and one leven nesting gets flattened nicely
However there are nested elements in that as well like acl, links etc
The nested elements show up as python object in string representation which you can not then (as a lazy way out) use spath on...
Has anyone found a good way to do this transformation?
example:
{
"links": {
},
"generator": {
"build": "debde650d26e",
"version": "6.4.1"
},
"updated": "2017-08-04T15:19:21+02:00",
"origin": "https://xxx:8089/servicesNS/nobody/-/",
"entry": [
{
"links": {
"alternate": "/servicesNS/nobody/SplunkUniversalForwarder/"
},
"name": "SplunkUniversalForwarder",
"updated": "2017-08-04T15:19:21+02:00",
"id": "https://xxx:8089/servicesNS/nobody/SplunkUniversalForwarder/"
},
{
"links": {
"alternate": "/servicesNS/nobody/alert_logevent/"
},
"name": "alert_logevent",
"updated": "2017-08-04T15:19:21+02:00",
"id": "https://xxx:8089/servicesNS/nobody/alert_logevent/"
},
{
"links": {
"alternate": "/servicesNS/nobody/introspection_generator_addon/"
},
"name": "introspection_generator_addon",
"updated": "2017-08-04T15:19:21+02:00",
"id": "https://xxx:8089/servicesNS/nobody/introspection_generator_addon/"
}
]
}
↧