Python：如何根据特定键值仅打印字典中的实际值？

Question

I have a dictionary that is dynamically generated from the results of a Splunk search. The content of the dictionary looks like this:

SiteID     Reporting   Total
FLNGAASF1  3           9  
MSNGAASF2  14          26  
PANGAASF1  31          40 

Here is my Python code that generates the dictionary:

SiteIDs = defaultdict(list)
SiteIDs.clear()

Splunk search goes here

for result in results.ResultsReader(jobC.results(segmentation='none')):
   SiteID=result["SiteID"]
   Reporting=result["Reporting"]
   Total=result["Total"]
   SiteIDs[SiteID].append(('Reporting',Reporting))
   SiteIDs[SiteID].append(('Total',Total))

Now what I need to do is get the Reporting and Total numbers for specific SiteIDs. For Example, suppose I want the Reporting and Total numbers for MSNGAASF2, so that I can print them in an HTML table as:

14 / 26

or like this

SiteID     Clients
FLNGAASF1  0/9  
MSNGAASF2  14/26  
PANGAASF1  0/40 

So I break out my dictionary entry like this:

Client=(SiteIDs['MSNGAASF2'])

Doing this:

print Client,"<br />"

results in this:

[('Reporting', '14'), ('Total', '26')]

If I try the replace function I get an error that replace is not a suported attribute in the list object. No matter what I try I get an error stating that the attribute is not supported.

I've tried things like this but have had absolutely no luck.

print Client.get('MSNGAASF2ULLSA',0)," / ",Client.get('MSNGAASF2ULLSA',1)

and get this:

print Client.get('MSNGAASF2',0)," / ",Client.get('MSNGAASF2',1) AttributeError: 'list' object has no attribute 'get'

All I want to do is print the values, and only the values, for the selected SiteID. This can't be that hard but as a noob python developer I just can't seem to figure it out.

I need to do this because I have a second Splunk search that lists all SiteIDs and I need specific counts for each. Looping though the first Splunk search results takes forever. I'm hoping that using a dictionary will be significantly faster.

Answer 1

You are appending two separate tuples; replace those two tuples with a new dictionary:

for result in results.ResultsReader(jobC.results(segmentation='none')):
    site_id = result["SiteID"]
    reporting = result["Reporting"]
    total = result["Total"]
    SiteIDs[site_id].append({'Reporting': reporting, 'Total': total})

You could even just append the whole result dictionary rather than extract two keys.

You can then reference those keys in your code; each value in SiteIDs is a list, so you'd loop over the list to get at each individual dictionary:

results = SiteIDs['MSNGAASF2']
for result in results:
    print '<td> {Reporting} </td><td> {Total} </td>'.format(**result)

I used a str.format() template here; that allows you to use the keys in result in the template to pull out specific values into a string.

Now, if your SiteID values in the Splunk result set are always going to be unique, then using a defaultdict(list) is overkill; you could just use a regular dictionary and just store the result dictionary per SiteID in there:

for result in results.ResultsReader(jobC.results(segmentation='none')):
    SiteIDs[result["SiteID"]] = result

then forgo the loop per id:

result = SiteIDs['MSNGAASF2']
print '<td> {Reporting} </td><td> {Total} </td>'.format(**result)

Answer 2

the default dictionary makes a dictionary of lists. if you want a true dictionary you should structure it like so:

mydict = {'FLNGAASF1': {'Reporting': 3, 'Total': 9}}

you could also go:

mydict['FLNGAASF1'] = {'Reporting': 3, 'Total': 9}

then to retrieve the data:

print(mydict['FLNGAASF1'])
>>> {'Reporting': 3, 'Total': 9}

full example (assuming your splunk search results is iterable):

mydict = {}
for row in splunk:
    mydict[row['SiteID']] = {'Reporting': row['Reporting'], 'Total': row['Total']

then just print your print your values:

for k, v in mydict.items():  
    print("Client: %s: %d/%d" % (k, v['Reporting'], v['Total']))

>>>Client: FLNGAASF1: 3/9
>>>Client: MSNGAASF2: 14/26