I'm trying to pull a list of incidents that meet a certain search criteria and send them in an email using a JSON like the following. 

{"filters":[{"conditions":[{"field_name":"properties.group","method":"in","value":[xxxxx]},{"field_name":"plan_status","method":"not_in","value":["C"]},{"field_name":"properties.mgmt_escalation","method":"has_a_value"}]}],"sorts":[]}

Currently I'm running this using a command like - 

gadget --list --query email.json

So far, so good, it returns the incident id and the description. But I need to add a column to the output for incident owner.  I don't see a way to do this using gadget. 

Any help with doing with gadget or from Python would be greatly appreciated.

------------------------------
Sean Ebeling
------------------------------

Hi Sean,

Checking the script "/usr/local/lib/python2.7/site-packages/resilient/bin/gadget.py" which contains:
# Print the incident names
for inc in incidents:
print(u'{0}: {1}'.format(inc['id'], inc['name']))
around line 84. It seems you can not print more column without modifying the script. 
But you can always using REST API with "POST /query_paged" endpoint to return all incidents data you need. An example of using query the incident data is on github here.

------------------------------
LILY WANG
------------------------------

Thanks Lily! Great idea pulling the code directly from gadget. 

I modified the routine to add a bit that pulls the user email into the output of all my gadget requests now.  Unfortunately the inc json only includes owner_id and not a human readable name. So I used the owner_id to query.

# Print the incident names
for inc in incidents:
		#inc query does not return user names. You need to translate owner_id to email by doing a GET on the user info from list of query
		inc_user_owner = client.get('/users/'+(str(inc['owner_id'])))
		print(u'{0}: Owner Email:{1} Description:{2}'.format(inc['id'], inc_user_owner['email'], inc['name']))​

------------------------------
Sean Ebeling
------------------------------

Original Message:
Sent: Tue June 11, 2019 08:46 PM
From: LILY WANG
Subject: Gadget or Python to send Email

Hi Sean,

Checking the script "/usr/local/lib/python2.7/site-packages/resilient/bin/gadget.py" which contains:
# Print the incident names
for inc in incidents:
print(u'{0}: {1}'.format(inc['id'], inc['name']))
around line 84. It seems you can not print more column without modifying the script. 
But you can always using REST API with "POST /query_paged" endpoint to return all incidents data you need. An example of using query the incident data is on github here.

------------------------------
LILY WANG
------------------------------

In testing, I noticed that groups threw a curveball. I tweaked my code to look like this - 

    # Print the incident names
    for inc in incidents:
		#inc query does not return user names. You need to translate owner_id to email by doing a GET on the user info from list of query
		try:
			inc_user_owner = client.get('/users/'+(str(inc['owner_id'])))
		except:
			#inc_user_owner = "FAILD to Get User ID" because it is a group
			inc_user_owner = client.get('/groups/'+(str(inc['owner_id'])))
		
		try: 
			print(u'{0}: Owner Email:{1} Description:{2}'.format(inc['id'], inc_user_owner['email'], inc['name']))
		except:
			
			print "something went wrong"​

------------------------------
Sean Ebeling
------------------------------

Original Message:
Sent: Wed June 12, 2019 01:22 PM
From: Sean Ebeling
Subject: Gadget or Python to send Email

Thanks Lily! Great idea pulling the code directly from gadget. 

I modified the routine to add a bit that pulls the user email into the output of all my gadget requests now.  Unfortunately the inc json only includes owner_id and not a human readable name. So I used the owner_id to query.

# Print the incident namesfor inc in incidents:		#inc query does not return user names. You need to translate owner_id to email by doing a GET on the user info from list of query		inc_user_owner = client.get('/users/'+(str(inc['owner_id'])))		print(u'{0}: Owner Email:{1} Description:{2}'.format(inc['id'], inc_user_owner['email'], inc['name']))​

------------------------------
Sean Ebeling
------------------------------


Original Message:
Sent: Tue June 11, 2019 08:46 PM
From: LILY WANG
Subject: Gadget or Python to send Email

Hi Sean,

Checking the script "/usr/local/lib/python2.7/site-packages/resilient/bin/gadget.py" which contains:
# Print the incident names
for inc in incidents:
print(u'{0}: {1}'.format(inc['id'], inc['name']))
around line 84. It seems you can not print more column without modifying the script. 
But you can always using REST API with "POST /query_paged" endpoint to return all incidents data you need. An example of using query the incident data is on github here.

------------------------------
LILY WANG

Hi Sean,

To get the value instead of id, if you are using "/query" or "/query_paged" api, you could add "?handle_format=names".
For example "POST /rest/orgs/201/incidents/query_paged?handle_format=names".

------------------------------
LILY WANG
------------------------------

Original Message:
Sent: Wed June 12, 2019 01:22 PM
From: Sean Ebeling
Subject: Gadget or Python to send Email

Thanks Lily! Great idea pulling the code directly from gadget. 

I modified the routine to add a bit that pulls the user email into the output of all my gadget requests now.  Unfortunately the inc json only includes owner_id and not a human readable name. So I used the owner_id to query.

# Print the incident namesfor inc in incidents:		#inc query does not return user names. You need to translate owner_id to email by doing a GET on the user info from list of query		inc_user_owner = client.get('/users/'+(str(inc['owner_id'])))		print(u'{0}: Owner Email:{1} Description:{2}'.format(inc['id'], inc_user_owner['email'], inc['name']))​

------------------------------
Sean Ebeling
------------------------------


Original Message:
Sent: Tue June 11, 2019 08:46 PM
From: LILY WANG
Subject: Gadget or Python to send Email

Hi Sean,

Checking the script "/usr/local/lib/python2.7/site-packages/resilient/bin/gadget.py" which contains:
# Print the incident names
for inc in incidents:
print(u'{0}: {1}'.format(inc['id'], inc['name']))
around line 84. It seems you can not print more column without modifying the script. 
But you can always using REST API with "POST /query_paged" endpoint to return all incidents data you need. An example of using query the incident data is on github here.

------------------------------
LILY WANG