splunk-sdk
Version:
SDK for usage with the Splunk REST API
336 lines (333 loc) • 12.2 kB
JSON
{
"displayName":"pivot test data",
"description":"",
"modelName":"pivot_test_data",
"objectSummary":{
"Transaction-Based":0,
"Interfaces":0,
"Interface Implementations":0,
"Search-Based":0,
"Event-Based":2
},
"objects":[
{
"fields":[
{
"editable":false,
"fieldSearch":"",
"fieldName":"_time",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"timestamp",
"displayName":"_time"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"host",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"host"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"source",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"source"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"sourcetype",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"sourcetype"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"test_data",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"objectCount",
"displayName":"test data"
}
],
"objectSearchNoFields":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\", \"test_data.is_child\" AS \"is_child\", \"test_data.is_not_child\" AS \"is_not_child\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25 | eval \"is_child\"=if(searchmatch(\"\"),1,0) | eval \"is_not_child\"=if(searchmatch(\"NOT( )\"),1,0) | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\"",
"constraints":[
],
"displayName":"test data",
"previewSearch":" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25",
"objectSearch":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\", \"test_data.is_child\" AS \"is_child\", \"test_data.is_not_child\" AS \"is_not_child\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25 | eval \"is_child\"=if(searchmatch(\"\"),1,0) | eval \"is_not_child\"=if(searchmatch(\"NOT( )\"),1,0) | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\", \"is_child\" AS \"test_data.is_child\", \"is_not_child\" AS \"test_data.is_not_child\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"test_data.has_boris\", \"test_data.hostip\", \"test_data.epsilon\", \"test_data.is_child\", \"test_data.is_not_child\"",
"objectName":"test_data",
"calculations":[
{
"editable":true,
"outputFields":[
{
"editable":true,
"fieldSearch":"",
"fieldName":"has_boris",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"boolean",
"displayName":"has_boris"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"2f8rvff3gsm",
"expression":"if(boris != null, \"true\", \"false\")",
"calculationType":"Eval"
},
{
"editable":true,
"outputFields":[
{
"editable":true,
"fieldSearch":"",
"fieldName":"hostip",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"ipv4",
"displayName":"hostip"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"bs7krya32co",
"expression":"129.0.0.1",
"calculationType":"Eval"
},
{
"editable":true,
"outputFields":[
{
"editable":true,
"fieldSearch":"",
"fieldName":"epsilon",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"number",
"displayName":"epsilon"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"bsbno65h5v",
"expression":"25",
"calculationType":"Eval"
},
{
"editable":false,
"outputFields":[
{
"editable":false,
"fieldSearch":"",
"fieldName":"is_child",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"childCount",
"displayName":"is_child"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"ec9664b60b8de96cd9d7a0114e89e358d1620c19",
"expression":"if(searchmatch(\"\"),1,0)",
"calculationType":"Eval"
},
{
"editable":false,
"outputFields":[
{
"editable":false,
"fieldSearch":"",
"fieldName":"is_not_child",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"childCount",
"displayName":"is_not_child"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"64f71e104ac3b7cdbf665046891b79adb58ddf6d",
"expression":"if(searchmatch(\"NOT( )\"),1,0)",
"calculationType":"Eval"
}
],
"autoextractSearch":"",
"comment":"",
"parentName":"BaseEvent",
"children":[
"child"
],
"lineage":"test_data",
"tsidxNamespace":""
},
{
"fields":[
{
"editable":false,
"fieldSearch":"",
"fieldName":"_time",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"timestamp",
"displayName":"_time"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"host",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"host"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"source",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"source"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"sourcetype",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"BaseEvent",
"comment":"",
"type":"string",
"displayName":"sourcetype"
},
{
"editable":false,
"fieldSearch":"",
"fieldName":"child",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data.child",
"comment":"",
"type":"objectCount",
"displayName":"child"
}
],
"objectSearchNoFields":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25 | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\"",
"constraints":[
],
"displayName":"child",
"previewSearch":" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25",
"objectSearch":"| rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | rename \"test_data.has_boris\" AS \"has_boris\", \"test_data.hostip\" AS \"hostip\", \"test_data.epsilon\" AS \"epsilon\" | eval \"has_boris\"=if(boris != null, \"true\", \"false\") | eval \"hostip\"=\"129.0.0.1\" | eval \"epsilon\"=25 | rename \"has_boris\" AS \"test_data.has_boris\", \"hostip\" AS \"test_data.hostip\", \"epsilon\" AS \"test_data.epsilon\" | fields \"_time\", \"host\", \"source\", \"sourcetype\", \"test_data.has_boris\", \"test_data.hostip\", \"test_data.epsilon\"",
"objectName":"child",
"calculations":[
{
"editable":true,
"outputFields":[
{
"editable":true,
"fieldSearch":"",
"fieldName":"hostip",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"ipv4",
"displayName":"hostip"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"bs7krya32co",
"expression":"129.0.0.1",
"calculationType":"Eval"
},
{
"editable":true,
"outputFields":[
{
"editable":true,
"fieldSearch":"",
"fieldName":"epsilon",
"required":false,
"multivalue":false,
"hidden":false,
"owner":"test_data",
"comment":"",
"type":"number",
"displayName":"epsilon"
}
],
"owner":"test_data",
"comment":"",
"calculationID":"bsbno65h5v",
"expression":"25",
"calculationType":"Eval"
}
],
"autoextractSearch":"",
"comment":"",
"parentName":"test_data",
"children":[
],
"lineage":"test_data.child",
"tsidxNamespace":""
}
],
"objectNameList":[
"test_data",
"child"
]
}