Fix modeling of fired alerts.

Author: blovering

examples/fired_alerts.py

@@ -26,13 +26,17 @@ def main():
     opts = parse(sys.argv[1:], {}, ".splunkrc")
     service = connect(**opts.kwargs)
 
-    for item in service.fired_alerts:
-        print "[%s]" % item.name
-        content = item.content
-        for key in sorted(content.keys()):
-            value = content[key]
-            print "%s: %s" % (key, value)
-        print
+    for group in service.fired_alerts:
+        header = "%s (count: %d)" % (group.name, group.count)
+        print "%s" % header
+        print '='*len(header)
+        alerts = group.alerts
+        for alert in alerts.list():
+            content = alert.content
+            for key in sorted(content.keys()):
+                value = content[key]
+                print "%s: %s" % (key, value)
+            print
 
 if __name__ == "__main__":
     main()

splunklib/client.py

@@ -151,7 +151,7 @@ def event_types(self):
 
     @property
     def fired_alerts(self):
-        return Collection(self, PATH_FIRED_ALERTS)
+        return Collection(self, PATH_FIRED_ALERTS, item=AlertGroup)
 
     @property
     def indexes(self):
@@ -371,7 +371,7 @@ def itemmeta(self):
         }
 
     # kwargs: count, offset, search, sort_dir, sort_key, sort_mode
-    def list(self, count=0, **kwargs):
+    def list(self, count=-1, **kwargs):
         response = self.get(count=count, **kwargs)
         return self._load_list(response)
 
@@ -396,6 +396,22 @@ def submit(self, stanza):
         self.service.request(self.path, message)
         return self
 
+class AlertGroup(Entity):
+    """An entity that represents a group of fired alerts that can be accessed
+       through the `alerts` property."""
+    def __init__(self, service, path, **kwargs):
+        Entity.__init__(self, service, path, **kwargs)
+
+    @property
+    def alerts(self):
+        """Returns a collection of triggered alert instances."""
+        return Collection(self.service, self.path)
+
+    @property
+    def count(self):
+        """Returns the count of triggered alerts."""
+        return int(self.content.triggered_alert_count)
+
 class Index(Entity):
     """Index class access to specific operations."""
     def __init__(self, service, path, **kwargs):
@@ -542,7 +558,7 @@ def list(self, *args):
         for kind in kinds:
             response = None
             try:
-                response = self.service.get(self.kindpath(kind), count=0)
+                response = self.service.get(self.kindpath(kind), count=-1)
             except HTTPError as e:
                 if e.status == 404: 
                     continue # No inputs of this kind
@@ -656,6 +672,9 @@ def create(self, query, **kwargs):
         sid = _load_sid(response)
         return Job(self.service, PATH_JOBS + sid)
 
+    def list(self, count=0, **kwargs):
+        return Collection.list(self, count, **kwargs)
+
 class Message(Entity):
     def __init__(self, service, name, **kwargs):
         Entity.__init__(self, service, _path(PATH_MESSAGES, name), **kwargs)

tests/splunklib.client.baseline

@@ -1,2 +1,2 @@
-['Collection', 'Conf', 'Confs', 'Context', 'Endpoint', 'Entity', 'HTTPError', 'INPUT_KINDMAP', 'Index', 'Input', 'Inputs', 'Job', 'Jobs', 'MATCH_ENTRY_CONTENT', 'Message', 'NotSupportedError', 'OperationError', 'PATH_APPS', 'PATH_CAPABILITIES', 'PATH_CONF', 'PATH_CONFS', 'PATH_EVENT_TYPES', 'PATH_FIRED_ALERTS', 'PATH_INDEXES', 'PATH_INPUTS', 'PATH_JOBS', 'PATH_LOGGER', 'PATH_MESSAGES', 'PATH_ROLES', 'PATH_SAVED_SEARCHES', 'PATH_STANZA', 'PATH_USERS', 'SavedSearch', 'SavedSearches', 'Service', 'Settings', 'Stanza', 'Users', 'XNAMEF_ATOM', 'XNAME_CONTENT', 'XNAME_ENTRY', '__all__', '__builtins__', '__doc__', '__file__', '__name__', '__package__', '_filter_content', '_load_atom', '_load_atom_entries', '_load_sid', '_parse_atom_entry', '_path', '_path_conf', 'connect', 'data', 'quote', 'record', 'sleep', 'urlencode']
+['AlertGroup', 'Collection', 'Conf', 'Confs', 'Context', 'Endpoint', 'Entity', 'HTTPError', 'INPUT_KINDMAP', 'Index', 'Input', 'Inputs', 'Job', 'Jobs', 'MATCH_ENTRY_CONTENT', 'Message', 'NotSupportedError', 'OperationError', 'PATH_APPS', 'PATH_CAPABILITIES', 'PATH_CONF', 'PATH_CONFS', 'PATH_EVENT_TYPES', 'PATH_FIRED_ALERTS', 'PATH_INDEXES', 'PATH_INPUTS', 'PATH_JOBS', 'PATH_LOGGER', 'PATH_MESSAGES', 'PATH_ROLES', 'PATH_SAVED_SEARCHES', 'PATH_STANZA', 'PATH_USERS', 'SavedSearch', 'SavedSearches', 'Service', 'Settings', 'Stanza', 'Users', 'XNAMEF_ATOM', 'XNAME_CONTENT', 'XNAME_ENTRY', '__all__', '__builtins__', '__doc__', '__file__', '__name__', '__package__', '_filter_content', '_load_atom', '_load_atom_entries', '_load_sid', '_parse_atom_entry', '_path', '_path_conf', 'connect', 'data', 'quote', 'record', 'sleep', 'urlencode']
 

tests/test_fired_alert.py

@@ -117,13 +117,11 @@ def test_crud(self):
             wait(search, lambda search: alert_count(search) == count)
             self.assertEqual(alert_count(search), count)
 
-            # And now .. after all that trouble, verify that we see the 
-            # expected alerts!
+            # And now .. after all that trouble, verify that we see the alerts!
             self.assertTrue(search_name in fired_alerts)
-            alerts = fired_alerts[search_name]
-            self.assertEqual(alerts.name, search_name)
-            actual = int(alerts.content.triggered_alert_count)
-            self.assertEqual(actual, count)
+            alert_group = fired_alerts[search_name]
+            self.assertEqual(alert_group.name, search_name)
+            self.assertEqual(alert_group.count, count)
 
         # Cleanup
         searches.delete(search_name)
@@ -132,10 +130,11 @@ def test_crud(self):
 
     def test_read(self):
         service = client.connect(**opts.kwargs)
-        fired_alerts = service.fired_alerts
 
-        for fired_alert in fired_alerts:
-            fired_alert.content
+        for alert_group in service.fired_alerts:
+            alert_group.count
+            for alert in alert_group.alerts:
+                alert.content
 
 if __name__ == "__main__":
     opts = parse(sys.argv[1:], {}, ".splunkrc")