Python2.7特殊的splunk对象到数据帧的转换

Question

我正在从splunk读取一些数据，我想将该格式转换为pandas数据帧。在

Splunk blog question

result = results.ResultsReader(service.jobs.export(SEARCH_COMMAND))
for rr in result:
    print(rr)

OrderedDict([('H', '123'), ('U', 'aaa@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537360524/-86840158')])
OrderedDict([('H', '456'), ('U', 'sss@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537367876/-765151654')])
OrderedDict([('H', '145'), ('U', 'ddd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537367571/540003017')])
OrderedDict([('H', '111'), ('U', 'asd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537376045/540216322')])
OrderedDict([('H', '222'), ('U', 'asd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537383484/-86104258')])

Answer 1

pandas.DataFrame直接接受字典列表。在

您可以通过lst = list(result)创建一个列表，并按如下方式构建数据帧。在

from collections import OrderedDict
import pandas as pd

lst = [OrderedDict([('H', '123'), ('U', 'aaa@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537360524/-86840158')]),
       OrderedDict([('H', '456'), ('U', 'sss@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537367876/-765151654')]),
       OrderedDict([('H', '145'), ('U', 'ddd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537367571/540003017')]),
       OrderedDict([('H', '111'), ('U', 'asd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537376045/540216322')]),
       OrderedDict([('H', '222'), ('U', 'asd@global-bilgi.entp'), ('S', 'motv:SMP_SESSION_ID/1523537383484/-86104258')])]

df = pd.DataFrame(lst)

print(df)

#      H                      U                                             S
# 0  123  aaa@global-bilgi.entp   motv:SMP_SESSION_ID/1523537360524/-86840158
# 1  456  sss@global-bilgi.entp  motv:SMP_SESSION_ID/1523537367876/-765151654
# 2  145  ddd@global-bilgi.entp   motv:SMP_SESSION_ID/1523537367571/540003017
# 3  111  asd@global-bilgi.entp   motv:SMP_SESSION_ID/1523537376045/540216322
# 4  222  asd@global-bilgi.entp   motv:SMP_SESSION_ID/1523537383484/-86104258