Expose `published` and `author` fields

[nicolas-rdgs]

Describe the bug

When I call service.jobs.list(search="my_savedsearch") and I look at the returned Job object, I can't find the published and author keys.

To Reproduce
Steps to reproduce the behavior:

job = service.jobs.list(search="my_savedsearch")[0]
job.state.published -> raise AttributeError
job.state.author -> raise AttributeError

Expected behavior

Must return the date and the user who launched the search

Logs or Screenshots

In comparison, I get the values by making the query manually:

print(json.loads(s.get("/services/search/v2/jobs", output_mode="json", search="search=my_savedsearch").body.read().decode()))

Also, there's a lot more information in the searchTelemetry key than the Job object.

It's possible that the “state” processing doesn't take everything into account.

Splunk (please complete the following information):

• Version: 9.3.2
• OS: Fedora 41
• Deployment: Single instance

SDK (please complete the following information):

• Version: 2.1.0
• Language Runtime Version: python 3.13
• OS: Mac 15.5

[nicolas-rdgs]

I finally got these fields by rewriting “client.py:_parse_atom_entry” and instantiating it by rewriting Service, Jobs and Job like this:

from splunklib.client import (
    PATH_JOBS,
    PATH_JOBS_V2,
    Collection,
    Job,
    Jobs,
    Service,
    _parse_atom_metadata,
    record,
)

def _custom_parse_atom_entry(entry: dict) -> record:
    title = entry.get("title", None)

    elink = entry.get("link", [])
    elink = elink if isinstance(elink, list) else [elink]
    links = record((link.rel, link.href) for link in elink)

    # Retrieve entity content values
    content = entry.get("content", {})

    # Host entry metadata
    metadata = _parse_atom_metadata(content)

    # Filter some of the noise out of the content record
    content = record(
        (k, v) for k, v in content.items() if k not in ["eai:acl", "eai:attributes"]
    )

    if "type" in content:
        if isinstance(content["type"], list):
            content["type"] = [t for t in content["type"] if t != "text/xml"]
            # Unset type if it was only 'text/xml'
            if len(content["type"]) == 0:
                content.pop("type", None)
            # Flatten 1 element list
            if len(content["type"]) == 1:
                content["type"] = content["type"][0]
        else:
            content.pop("type", None)

    return record(
        {
            "title": title,
            "links": links,
            "access": metadata.access,
            "fields": metadata.fields,
            "published": entry.get("published"),            # Added
            "author": entry.get("author", {}).get("name"),  # Added
            "content": content,
            "updated": entry.get("updated"),
        }
    )


class JobFixed(Job):
    """This class represents a search job."""

    def __init__(self, service, sid, **kwargs):
        super().__init__(service, sid, **kwargs)

    # Load the entity state record from the given response
    def _load_state(self, response):
        entry = self._load_atom_entry(response)
        return _custom_parse_atom_entry(entry)


class JobsFixed(Jobs):
    def __init__(self, service):
        # Splunk 9 introduces the v2 endpoint
        if not service.disable_v2_api:
            path = PATH_JOBS_V2
        else:
            path = PATH_JOBS
        Collection.__init__(self, service, path, item=JobFixed)
        # The count value to say list all the contents of this
        # Collection is 0, not -1 as it is on most.
        self.null_count = 0


class NewService(Service):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)

    @property
    def jobs(self):
        return JobsFixed(self)

# connection:
service = NewService(host="..", token="..")
service.login()

I think it would be interesting to have these fields there for each entity when possible, no?

[mateusz834]

Hi,

This is something that we should support, would you like to send a PR, with the above changes + test?