Module Expr Str Import alias alias Expr Call AttributeLoad AttributeLoad NameLoad attr attr Num Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Str Str Import alias Import alias identifier TryExcept body Import alias handlers ExceptHandler type NameLoad body Raise Call NameLoad Str Assign NameStore Dict Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str Dict Str Str ListLoad Str Str FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad Str keyword NameLoad Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore NameLoad Assign NameStore Dict For NameStore Call AttributeLoad NameLoad attr body If Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad body If CompareEq NameLoad Str body Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index NameLoad orelse Assign SubscriptStore NameLoad Index NameLoad SubscriptLoad AttributeLoad NameLoad attr Index NameLoad If UnaryOpNot NameLoad body If Call AttributeLoad NameLoad attr Str body Assign NameStore Str orelse Assign NameStore Str If BoolOpAnd CompareNotEq NameLoad Str CompareNotEq NameLoad Str CompareNotEq NameLoad Str CompareNotEq NameLoad Str body Print BinOpMod Str NameLoad Expr Call AttributeLoad NameLoad attr Num If BoolOpAnd UnaryOpNot Call AttributeLoad NameLoad attr Str CompareNotEq NameLoad Str body Print Str Expr Call AttributeLoad NameLoad attr Num If BoolOpAnd CompareNotEq NameLoad Str CompareNotEq NameLoad Str body Assign NameStore SubscriptLoad NameLoad Index Str Expr Call AttributeLoad NameLoad attr Str If CompareEq NameLoad Str body Assign NameStore Call AttributeLoad NameLoad attr Str NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call AttributeLoad NameLoad attr BinOpMod Str NameLoad NameLoad orelse If CompareEq NameLoad Str body Assign NameStore Call AttributeLoad NameLoad attr Str NameLoad orelse Assign NameStore Call AttributeLoad NameLoad attr BinOpMod Str NameLoad NameLoad Print BinOpMod Str AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Expr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad decorator_list If CompareEq NameLoad Str body Expr Call NameLoad SubscriptLoad AttributeLoad NameLoad attr Slice Num
N/A N/A A command line utility for manipulating saved searches 
   (list-all/create/list/delete). N/A sys os N/A N/A N/A N/A sys path insert 0 N/A N/A N/A os path join N/A N/A N/A os path dirname __file__ .. .. N/A urllib N/A splunklib.binding binding N/A N/A N/A utils N/A N/A N/A ImportError N/A N/A N/A Exception Add the SDK repository to your PYTHONPATH to run the examples (e.g., export PYTHONPATH=~/splunk-sdk-python. N/A RULES N/A name search is_visible is_scheduled max_concurrent realtime_schedule run_on_startup cron_schedule alert_type alert_threshold alert_comparator actions action.<action_type>.<custom_key>. dispatch.ttl dispatch.buckets dispatch.max_count dispatch.max_time dispatch.lookups dispatch.spawn_process dispatch.time_format dispatch.earliest_time dispatch.latest_time alert.expires alert.severity alert.supress alert.supress_keys alert.supress.period alert.digest output_mode operation N/A flags help N/A --name <required for all> name of search name to be created N/A flags help N/A --search <required for create> splunk search string N/A flags help N/A --is_visible <optional for create> Should the saved search appear under the Seaches & Report menu (defaults to true) N/A flags help N/A --is_scheduled <optional for create> Does the saved search run on the saved schedule. N/A flags help N/A --max_concurrent <optional for create> If the search is ran by the scheduler how many concurrent instances of this search is the scheduler allowed to run (defaults to 1) N/A flags help N/A --realtime_schedule <optional for create> Is the scheduler allowed to skip executions of this saved search, if there is not enough search bandwidtch (defaults to true), set to false only for summary index populating searches N/A flags help N/A --run_on_startup <optional for create> Should the scheduler run this saved search on splunkd start up (defaults to false) N/A flags help N/A --cron_schedule <optional for create> The cron formatted schedule of the saved search. Required for Alerts N/A flags help N/A --alert_type <optional for create> The thing to count a quantity of in relation to relation. Required for Alerts. (huh?) N/A flags help N/A --alert_threshold <optional for create> The quantity of counttype must exceed in relation to relation. Required for Alerts. (huh?) N/A flags help N/A --alert_comparator <optional for create> The relation the count type has to the quantity. Required for Alerts. (huh?) N/A flags help N/A --actions <optional for create> A list of the actions to fire on alert; supported values are {(email, rss) | script}. For example, actions = rss,email would enable both RSS feed and email sending. Or if you want to just fire a script: actions = script N/A flags help N/A --action.<action_type>.<custom_key> <optional for create> A key/value pair that is specific to the action_type. For example, if actions contains email, then the following keys would be necessary: action.email.to=foo@splunk.com  and action.email.sender=splunkbot. For scripts: action.script.filename=doodle.py (note: script is run from $SPLUNK_HOME/bin/scripts/) N/A flags help N/A --dispatch.ttl <optional for create> The TTL of the search job created N/A flags help N/A --dispatch.buckets <optional for create> The number of event buckets (huh?) N/A flags help N/A --dispatch.max_count <optional for create> Maximum number of results N/A flags help N/A --dispatch.max_time <optional for create> Maximum amount of time in seconds before finalizing the search N/A flags help N/A --dispatch.lookups <optional for create> Boolean flag indicating whether to enable lookups in this search N/A flags help N/A --dispatch.spawn_process <optional for create> Boolean flag whether to spawn the search as a separate process N/A flags help N/A --dispatch.time_format <optional for create> Format string for earliest/latest times N/A flags help N/A --dispatch.earliest_time <optional for create> The earliest time for the search N/A flags help N/A --dispatch.latest_time <optional for create> The latest time for the search N/A flags help N/A --alert.expires <optional for create> [time-specifier] The period of time for which the alert will be shown in the alert's dashboard N/A flags help N/A --alert.severity <optional for create> [int] Specifies the alert severity level, valid values are: 1-debug, 2-info, 3-warn, 4-error, 5-severe, 6-fatal N/A flags help N/A --alert.supress <optional for create> [bool]whether alert suppression is enabled for this scheduled search N/A flags help N/A --alert.supress_keys <optional for create> [string] comma delimited list of keys to use for suppress, to access result values use result.<field-name> syntax N/A flags help N/A --alert.supress.period <optional for create> [time-specifier] suppression period, use ack to suppress until acknowledgment is received N/A flags help N/A --alert.digest <optional for create> [bool] whether the alert actions are executed on the entire result set or on each individual result (defaults to true) N/A flags help N/A --output_mode <optional for all> type of output (atom, xml) N/A flags help N/A --operation <optional for create> type of splunk operation: list-all, list, create, delete (defaults to list-all) main N/A N/A argv N/A N/A N/A  main entry  N/A usage usage: %prog --help for options N/A opts N/A N/A utils parse argv RULES .splunkrc usage usage N/A context N/A N/A binding connect N/A opts kwargs N/A operation None N/A kwargs N/A N/A key N/A N/A RULES keys N/A N/A N/A N/A N/A opts kwargs has_key key N/A N/A N/A key operation N/A N/A operation N/A N/A opts kwargs N/A key N/A N/A N/A kwargs N/A key N/A N/A opts kwargs N/A key N/A N/A operation N/A N/A N/A N/A kwargs has_key name N/A N/A operation list N/A N/A operation list-all N/A N/A N/A operation list N/A operation create N/A operation delete N/A operation list-all N/A N/A N/A operation %s not one of list-all, list, create, delete operation N/A N/A N/A sys exit 0 N/A N/A N/A N/A N/A kwargs has_key name N/A operation list-all N/A N/A operation requires a name N/A N/A N/A sys exit 0 N/A N/A N/A operation create N/A operation list-all N/A N/A name N/A kwargs N/A name N/A N/A N/A kwargs pop name N/A N/A operation list-all N/A N/A result N/A N/A context get saved/searches kwargs N/A N/A N/A operation list N/A N/A result N/A N/A context get N/A saved/searches/%s name kwargs N/A N/A N/A operation create N/A N/A result N/A N/A context post saved/searches kwargs N/A N/A result N/A N/A context delete N/A saved/searches/%s name kwargs N/A N/A HTTP STATUS: %d N/A result status N/A xml_data N/A N/A N/A result body read N/A N/A N/A N/A sys stdout write xml_data N/A N/A N/A __name__ __main__ N/A N/A N/A main N/A N/A sys argv N/A 1