You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 lines
1.7 KiB
45 lines
1.7 KiB
# Copyright (C) 2005-2025 Splunk Inc. All Rights Reserved.
|
|
"""
|
|
Represents a clause in a Notable Event Aggregation Policy.
|
|
An Aggregation Policy doesnt really refer to this guy directly, but via one of
|
|
the many possible criterion.
|
|
"""
|
|
from ..notable_event_error import NotableEventBadRequest
|
|
|
|
from .item import ClauseItem
|
|
|
|
|
|
class Clause(object):
|
|
'''
|
|
A generic clause. Has a condition with a bunch of items to operate on.
|
|
Schema:
|
|
{
|
|
"condition": <string>, // permitted values "OR", "AND"
|
|
"items": [ <Item* object> ]
|
|
}
|
|
'''
|
|
def __init__(self, **kwargs):
|
|
raise TypeError('Cannot instantiate this class. Call `Clause.validate(condition, items)`')
|
|
|
|
@staticmethod
|
|
def validate (clause, supported_item_types=None):
|
|
'''
|
|
Use this method to get a clause type. Does validations
|
|
'''
|
|
if not isinstance(clause, dict):
|
|
raise NotableEventBadRequest('Invalid type for `clause`. expecting: dict received type=%s.' % type(clause).__name__)
|
|
|
|
if 'condition' not in clause or 'items' not in clause:
|
|
raise NotableEventBadRequest('Missing key. Required: `condition`, `items`')
|
|
|
|
if clause['condition'] not in ('AND', 'OR'):
|
|
raise NotableEventBadRequest(('Bad Request. Expecting either "AND" or "OR"'
|
|
'. Received "%s"') % clause)
|
|
|
|
if not isinstance(clause['items'], list):
|
|
raise NotableEventBadRequest(('Bad Request. Expecting type=list. Received type='
|
|
'%s') % type(clause).__name__)
|
|
|
|
for item in clause['items']:
|
|
ClauseItem.validate(item, supported_item_types)
|