(property_name, column_id=None, datatype=None)
return {
        "type": "expression",
        "column_id": column_id or property_name,
        "datatype": datatype,
        "display_name": property_name,
        "expression": expression,
    }
Return a data source indicator configuration (a dict) for the given case
    property.  This will expand index case references if provided in the format
    parent/host/foo
Return a data source indicator configuration (a dict) for the given case
    property.  This will expand index case references if provided in the format
    parent/host/foo
Return a data source indicator configuration ( a dict ) for the given case property . This will expand index case references if provided in the format parent / host / foo
def make_case_property_indicator(property_name, column_id=None, datatype=None):
    """
    Return a data source indicator configuration (a dict) for the given case
    property.  This will expand index case references if provided in the format
    parent/host/foo
    """
    datatype = datatype or DEFAULT_CASE_PROPERTY_DATATYPES.get(property_name, "string")

    parts = property_name.split('/')
    root_field = parts.pop()

    expression = {
        'type': 'property_name',
        'property_name': root_field,
    }
    if parts:
        case_expression = {
            'type': 'identity',
        }
        for index in parts:
            case_expression = {
                'type': 'indexed_case',
                'case_expression': case_expression,
                'index': index
            }

        expression = {
            'type': 'nested',
            'argument_expression': case_expression,
            'value_expression': expression
        }

    return {
        "type": "expression",
        "column_id": column_id or property_name,
        "datatype": datatype,
        "display_name": property_name,
        "expression": expression,
    }
def make_case_property_indicator ( property_name , column_id = None , datatype = None ) : datatype = datatype or DEFAULT_CASE_PROPERTY_DATATYPES . get ( property_name , "string" ) parts = property_name . split ( '/' ) root_field = parts . pop ( ) expression = { 'type' : 'property_name' , 'property_name' : root_field , } if parts : case_expression = { 'type' : 'identity' , } for index in parts : case_expression = { 'type' : 'indexed_case' , 'case_expression' : case_expression , 'index' : index } expression = { 'type' : 'nested' , 'argument_expression' : case_expression , 'value_expression' : expression } return { "type" : "expression" , "column_id" : column_id or property_name , "datatype" : datatype , "display_name" : property_name , "expression" : expression , }