Enforce that splunk is returning arrays for multivalues (even if there's only one value)

splunk_enforce_arrays.py

import os
import splunklib.client as client
import splunklib.results as results

service = client.connect(
    host=os.getenv('SPLUNK_HOST'),
    port=os.getenv('SPLUNK_PORT'),
    token=os.getenv('SPLUNK_TOKEN')
)


def toArray(reader):
    results = []
    for item in reader:
        results.append(item)
    return results


def enforceArrays(results, keys):
    for result in results:
        for key in keys:
            if not isinstance(result[key], list):
                result[key] = [result[key]]
    return results


def getValues():
    response = service.jobs.oneshot(
        '| makeresults count=10 | eval multi_value=split("1,2", ","), single_value=split("1", ",")')
    return enforceArrays(toArray(results.ResultsReader(response)), ["single_value"])


if __name__ == "__main__":

    print(getValues())