Class: Splunk::Entity

Inherits:
ReadOnlyEntity show all
Defined in:
lib/splunk-sdk-ruby/entity.rb

Overview

Class representing individual entities in Splunk.

Entity objects represent individual items such as indexes, users, roles, etc. They are usually contained within Collection objects.

The basic, identifying information for an Entity (name, namespace, path of the collection containing entity, and the service it’s on) is all accessible via getters (name, namespace, resource, service). All the fields containing the Entity‘s state, such as the capabilities of a role or whether an app should check for updates, are accessible with the [] operator (for instance, role[“capabilities”] or app[“check_for_updates”]).

Entity objects cache their state, so each lookup of a field does not make a roundtrip to the server. The state may be refreshed by calling the refresh method on the Entity.

Direct Known Subclasses

Index, Job, Message, SavedSearch, Stanza

Instance Attribute Summary

Attributes inherited from ReadOnlyEntity

#name, #namespace, #resource, #service

Instance Method Summary collapse

Methods inherited from ReadOnlyEntity

#[], #fetch, #initialize, #links, #read, #readmeta, #refresh

Constructor Details

This class inherits a constructor from Splunk::ReadOnlyEntity

Instance Method Details

#[]=(key, value) ⇒ Object

Updates the attribute key with value.

As for update, value may be anything that may be coerced sensibly to a String.

Returns: the new value.



233
234
235
236
 
# File 'lib/splunk-sdk-ruby/entity.rb', line 233

def []=(key, value)
  update(key => value)
  value
end

#delete ⇒ Object

Deletes this entity from the server.

Returns: nil.



193
194
195
196
197
 
# File 'lib/splunk-sdk-ruby/entity.rb', line 193

def delete()
  @service.request({:method => :DELETE,
                    :namespace => @namespace,
                    :resource => @resource + [name]})
end

#disable ⇒ Object

Disables this entity.

After a subsequent refresh, the “disabled” field will be set to “1”. Note that on some entities, such as indexes in Splunk 5.x, most other operations do not work until it is enabled again.

Returns: the Entity.



247
248
249
250
251
252
 
# File 'lib/splunk-sdk-ruby/entity.rb', line 247

def disable
  @service.request(:method => :POST,
                   :namespace => @namespace,
                   :resource => @resource + [name, "disable"])
  self
end

#enable ⇒ Object

Enables this entity.

After a subsequent refresh, the “disabled” field will be set to “0”.

Returns: the Entity.



261
262
263
264
265
266
 
# File 'lib/splunk-sdk-ruby/entity.rb', line 261

def enable
  @service.request(:method => :POST,
                   :namespace => @namespace,
                   :resource => @resource + [name, "enable"])
  self
end

#update(args) ⇒ Object

Updates the values on the Entity specified in the arguments.

The arguments can be either a Hash or a sequence of key => value pairs. This method does not refresh the Entity, so if you want to see the new values, you must call refresh yourself.

Whatever values you pass will be coerced to Strings, so updating a numeric field with an Integer, for example, will work perfectly well.

Returns: the Entity.

Example:

service = Splunk::connect(:username => 'admin', :password => 'foo')
index =  service.indexes['main']
# You could use the string "61" as well here.
index.update('rotatePeriodInSecs' => 61)



217
218
219
220
221
222
223
 
# File 'lib/splunk-sdk-ruby/entity.rb', line 217

def update(args)
  @service.request({:method => :POST,
                    :namespace => @namespace,
                    :resource => @resource + [name],
                    :body => args})
  self
end