From 1e42f6ac098b7b903c4caabc3c4f57449a3e178e Mon Sep 17 00:00:00 2001
From: etserend <ertserendavga@splunk.com>
Date: Thu, 9 Jul 2026 16:04:45 -0500
Subject: [PATCH] feat(export): add JSONL_FLAT export format (HYBIM-788)

Port upstream commit 6ccd06a from rungalileo/galileo-python (PR #621).
Adds LLMExportFormat.JSONL_FLAT enum value and treats it identically to
JSONL in the streaming decode path so callers can request flattened output.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 openapi.yaml                                  |  1 +
 src/splunk_ao/export.py                       |  2 +-
 .../resources/models/llm_export_format.py     |  1 +
 tests/test_export.py                          | 24 +++++++++++++++++++
 4 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/openapi.yaml b/openapi.yaml
index 5bcb41b..1023f8b 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -26606,6 +26606,7 @@ components:
       enum:
         - csv
         - jsonl
+        - jsonl_flat
       title: LLMExportFormat
     LLMIntegration:
       type: string
diff --git a/src/splunk_ao/export.py b/src/splunk_ao/export.py
index dc9be26..8c2319d 100644
--- a/src/splunk_ao/export.py
+++ b/src/splunk_ao/export.py
@@ -61,7 +61,7 @@ def records(
             ),
         )
 
-        if export_format == LLMExportFormat.JSONL:
+        if export_format in (LLMExportFormat.JSONL, LLMExportFormat.JSONL_FLAT):
             for line in response_iterator:
                 if line:
                     yield json.loads(line)
diff --git a/src/splunk_ao/resources/models/llm_export_format.py b/src/splunk_ao/resources/models/llm_export_format.py
index 5f69174..4a895b4 100644
--- a/src/splunk_ao/resources/models/llm_export_format.py
+++ b/src/splunk_ao/resources/models/llm_export_format.py
@@ -4,6 +4,7 @@
 class LLMExportFormat(str, Enum):
     CSV = "csv"
     JSONL = "jsonl"
+    JSONL_FLAT = "jsonl_flat"
 
     def __str__(self) -> str:
         return str(self.value)
diff --git a/tests/test_export.py b/tests/test_export.py
index c863e67..9678022 100644
--- a/tests/test_export.py
+++ b/tests/test_export.py
@@ -296,3 +296,27 @@ def test_export_records_include_code_metric_metadata_opt_in(mock_export_records_
     request_body = mock_export_records_stream.call_args.kwargs["body"]
     assert request_body.include_code_metric_metadata is True
     assert request_body.to_dict()["include_code_metric_metadata"] is True
+
+
+@patch("splunk_ao.export.export_records_stream")
+def test_export_records_jsonl_flat(mock_export_records_stream):
+    project_id = str(uuid4())
+    records = [{"id": "1", "type": "llm"}, {"id": "2", "type": "trace"}]
+    mock_export_records_stream.return_value = iter(json.dumps(r) for r in records)
+
+    result = list(
+        export_records(
+            project_id=project_id,
+            root_type=RootType.TRACE,
+            export_format=LLMExportFormat.JSONL_FLAT,
+            filters=[],
+            sort=LogRecordsSortClause(column_id="created_at", ascending=False),
+            log_stream_id=str(uuid4()),
+        )
+    )
+
+    assert len(result) == 2
+    assert result[0] == {"id": "1", "type": "llm"}
+    assert result[1] == {"id": "2", "type": "trace"}
+    request_body = mock_export_records_stream.call_args.kwargs["body"]
+    assert request_body.export_format == LLMExportFormat.JSONL_FLAT