splunk-pickaxe 2.0.0 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile +7 -0
- data/README.md +15 -10
- data/Rakefile +169 -1
- data/lib/splunk/pickaxe/cli.rb +15 -0
- data/lib/splunk/pickaxe/client.rb +9 -0
- data/lib/splunk/pickaxe/config.rb +0 -1
- data/lib/splunk/pickaxe/objects.rb +39 -0
- data/lib/splunk/pickaxe/objects/alerts.rb +12 -0
- data/lib/splunk/pickaxe/objects/dashboards.rb +24 -0
- data/lib/splunk/pickaxe/objects/eventtypes.rb +12 -1
- data/lib/splunk/pickaxe/objects/field_extractions.rb +42 -0
- data/lib/splunk/pickaxe/objects/reports.rb +12 -1
- data/lib/splunk/pickaxe/objects/supported_keys.rb +10 -0
- data/lib/splunk/pickaxe/objects/tags.rb +12 -1
- data/lib/splunk/pickaxe/version.rb +1 -1
- metadata +3 -3
- data/project.yml +0 -34
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: e55da5bc5897dd51554a5022a5f3e123a721be1f
|
4
|
+
data.tar.gz: 7a3143d708b70cc5d9cee018b0caecfd40a90e2b
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ec70d9d035c320c620c96ab4d00d02d77abc50abed86e2932297861e42446085fcb3a178578e4d8524c5aeb216c8ff64f0743651fea206b98b562e8e8c591dc3
|
7
|
+
data.tar.gz: 6d9d9dc450bf4c4833dcb9aec225e2f603e04d099119a5c99fa905309e1dc2beff82f163a983004653e27438dfaef2c547b7bd54031a57201c7463f46269d54c
|
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -1,9 +1,11 @@
|
|
1
1
|
Splunk-Pickaxe
|
2
2
|
==============
|
3
3
|
|
4
|
-
|
4
|
+
[](https://travis-ci.org/cerner/splunk-pickaxe)
|
5
5
|
|
6
|
-
|
6
|
+
A tool for serializing and syncing your repo of Splunk objects across Splunk instances.
|
7
|
+
|
8
|
+
This provides a development workflow for Splunk components (e.g., dashboards,
|
7
9
|
alerts, reports, etc) and an easy way to apply them consistently.
|
8
10
|
|
9
11
|
Getting Started
|
@@ -35,19 +37,22 @@ environments:
|
|
35
37
|
ENVIRONMENT_NAME: SPLUNK_API_URL (i.e. https://search-head.my-splunk.com:8089)
|
36
38
|
```
|
37
39
|
|
38
|
-
Add some Splunk objects
|
39
|
-
|
40
|
-
|
40
|
+
Add some Splunk objects; see [example repo](example-repo) or below for manually
|
41
|
+
defining Splunk objects. Alternatively, to retrieve _all_ Splunk objects from
|
42
|
+
an environment, run:
|
41
43
|
|
42
|
-
pickaxe
|
44
|
+
pickaxe get ENVIONMENT_NAME
|
43
45
|
|
44
46
|
Where `ENVIRONMENT_NAME` is the name of one of the environments configured in
|
45
47
|
your `.pickaxe.yml`. These map to different Splunk instances.
|
46
48
|
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
49
|
+
You may then modify any of these objects. Afterwards, sync your repo with Splunk:
|
50
|
+
|
51
|
+
pickaxe sync ENVIRONMENT_NAME
|
52
|
+
|
53
|
+
By default these commands assume the user has a Splunk account and access to make these
|
54
|
+
changes in the configured Splunk application. Your password will be requested when run.
|
55
|
+
Alternatively you can make use of the options `--user` and `--password`.
|
51
56
|
|
52
57
|
Splunk Objects
|
53
58
|
--------------
|
data/Rakefile
CHANGED
@@ -1,7 +1,175 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
|
-
|
2
|
+
require "rubygems"
|
3
3
|
require 'rspec/core/rake_task'
|
4
4
|
|
5
|
+
REPO = 'cerner/splunk-pickaxe'
|
6
|
+
|
5
7
|
RSpec::Core::RakeTask.new(:test) do |t|
|
6
8
|
t.rspec_opts = '--format documentation'
|
7
9
|
end
|
10
|
+
|
11
|
+
task :default => [:test]
|
12
|
+
|
13
|
+
task :release do
|
14
|
+
intialize_octokit
|
15
|
+
puts "Releasing the gem ..."
|
16
|
+
|
17
|
+
spec = Gem::Specification::load("splunk-pickaxe.gemspec")
|
18
|
+
version = spec.version.to_s
|
19
|
+
|
20
|
+
# Update change log
|
21
|
+
puts "Updating change log ..."
|
22
|
+
update_change_log version
|
23
|
+
puts "Change log updated!"
|
24
|
+
|
25
|
+
run_command 'gem build splunk-pickaxe.gemspec'
|
26
|
+
run_command "gem push splunk-pickaxe-#{version}.gem"
|
27
|
+
|
28
|
+
update_version version
|
29
|
+
end
|
30
|
+
|
31
|
+
task :build_change_log do
|
32
|
+
intialize_octokit
|
33
|
+
closed_milestones = @octokit.milestones REPO, {:state => "closed"}
|
34
|
+
|
35
|
+
version_to_milestone = Hash.new
|
36
|
+
versions = Array.new
|
37
|
+
|
38
|
+
closed_milestones.each do |milestone|
|
39
|
+
version = Gem::Version.new(milestone.title)
|
40
|
+
version_to_milestone.store version, milestone
|
41
|
+
versions.push version
|
42
|
+
end
|
43
|
+
|
44
|
+
versions = versions.sort.reverse
|
45
|
+
|
46
|
+
change_log = File.open('CHANGELOG.md', 'w')
|
47
|
+
|
48
|
+
begin
|
49
|
+
change_log.write "Change Log\n"
|
50
|
+
change_log.write "==========\n"
|
51
|
+
change_log.write "\n"
|
52
|
+
|
53
|
+
versions.each do |version|
|
54
|
+
milestone = version_to_milestone[version]
|
55
|
+
change_log.write generate_milestone_markdown(milestone)
|
56
|
+
change_log.write "\n"
|
57
|
+
end
|
58
|
+
ensure
|
59
|
+
change_log.close
|
60
|
+
end
|
61
|
+
end
|
62
|
+
|
63
|
+
def intialize_octokit
|
64
|
+
require 'octokit'
|
65
|
+
if ENV['GITHUB_API_TOKEN']
|
66
|
+
@octokit = Octokit::Client.new(:access_token => ENV['GITHUB_API_TOKEN'])
|
67
|
+
else
|
68
|
+
@octokit = Octokit::Client.new
|
69
|
+
end
|
70
|
+
end
|
71
|
+
|
72
|
+
def update_change_log version
|
73
|
+
change_log_lines = IO.read(File.join(File.dirname(__FILE__), 'CHANGELOG.md')).split("\n")
|
74
|
+
|
75
|
+
change_log = File.open('CHANGELOG.md', 'w')
|
76
|
+
|
77
|
+
begin
|
78
|
+
|
79
|
+
# Keep change log title
|
80
|
+
change_log.write change_log_lines.shift
|
81
|
+
change_log.write "\n"
|
82
|
+
change_log.write change_log_lines.shift
|
83
|
+
change_log.write "\n"
|
84
|
+
change_log.write "\n"
|
85
|
+
|
86
|
+
# Write new milestone info
|
87
|
+
change_log.write generate_milestone_markdown(milestone(version))
|
88
|
+
|
89
|
+
# Add previous change log info
|
90
|
+
change_log_lines.each do |line|
|
91
|
+
change_log.write line
|
92
|
+
change_log.write "\n"
|
93
|
+
end
|
94
|
+
|
95
|
+
ensure
|
96
|
+
change_log.close
|
97
|
+
end
|
98
|
+
|
99
|
+
run_command "git add CHANGELOG.md"
|
100
|
+
run_command "git commit -m 'Added #{version} to change log'"
|
101
|
+
run_command "git push origin HEAD"
|
102
|
+
end
|
103
|
+
|
104
|
+
def generate_milestone_markdown milestone
|
105
|
+
strings = Array.new
|
106
|
+
|
107
|
+
title = "[#{milestone.title} - #{milestone.updated_at.strftime("%m-%d-%Y")}](https://github.com/#{REPO}/issues?milestone=#{milestone.number}&state=closed)"
|
108
|
+
|
109
|
+
strings.push "#{title}"
|
110
|
+
strings.push "-" * title.length
|
111
|
+
strings.push ""
|
112
|
+
|
113
|
+
issues = @octokit.issues REPO, {:milestone => milestone.number, :state => "closed"}
|
114
|
+
|
115
|
+
issues.each do |issue|
|
116
|
+
strings.push " * [#{issue_type issue}] [Issue-#{issue.number}](https://github.com/#{REPO}/issues/#{issue.number}) : #{issue.title}"
|
117
|
+
end
|
118
|
+
|
119
|
+
strings.push ""
|
120
|
+
|
121
|
+
strings.join "\n"
|
122
|
+
end
|
123
|
+
|
124
|
+
def milestone version
|
125
|
+
closedMilestones = @octokit.milestones REPO, {:state => "closed"}
|
126
|
+
|
127
|
+
closedMilestones.each do |milestone|
|
128
|
+
if milestone["title"] == version
|
129
|
+
return milestone
|
130
|
+
end
|
131
|
+
end
|
132
|
+
|
133
|
+
openMilestones = @octokit.milestones REPO
|
134
|
+
|
135
|
+
openMilestones.each do |milestone|
|
136
|
+
if milestone["title"] == version
|
137
|
+
return milestone
|
138
|
+
end
|
139
|
+
end
|
140
|
+
|
141
|
+
raise "Unable to find milestone with title [#{version}]"
|
142
|
+
end
|
143
|
+
|
144
|
+
def issue_type issue
|
145
|
+
labels = Array.new
|
146
|
+
issue.labels.each do |label|
|
147
|
+
labels.push label.name.capitalize
|
148
|
+
end
|
149
|
+
labels.join "/"
|
150
|
+
end
|
151
|
+
|
152
|
+
def run_command command
|
153
|
+
output = `#{command}`
|
154
|
+
unless $?.success?
|
155
|
+
raise "Command : [#{command}] failed.\nOutput : \n#{output}"
|
156
|
+
end
|
157
|
+
end
|
158
|
+
|
159
|
+
def update_version version
|
160
|
+
version_splits = version.split('.')
|
161
|
+
version_splits[1] = (version_splits[1].to_i + 1).to_s
|
162
|
+
next_version = version_splits.join('.')
|
163
|
+
|
164
|
+
version_rb = IO.read('lib/splunk/pickaxe/version.rb')
|
165
|
+
new_version_rb = version_rb
|
166
|
+
.split("\n")
|
167
|
+
.map{|line| line.include?('VERSION =') ? " VERSION = '#{next_version}'" : line }
|
168
|
+
.join("\n")
|
169
|
+
|
170
|
+
File.write('lib/splunk/pickaxe/version.rb', new_version_rb)
|
171
|
+
|
172
|
+
run_command "git add lib/splunk/pickaxe/version.rb"
|
173
|
+
run_command "git commit -m 'Updated version to #{next_version}'"
|
174
|
+
run_command "git push origin HEAD"
|
175
|
+
end
|
data/lib/splunk/pickaxe/cli.rb
CHANGED
@@ -54,6 +54,21 @@ module Splunk
|
|
54
54
|
pickaxe = Pickaxe.configure environment, user, password, execution_path
|
55
55
|
pickaxe.sync_all
|
56
56
|
end
|
57
|
+
|
58
|
+
desc 'save ENVIRONMENT', 'save remote configurations from the given environment'
|
59
|
+
option :user, type: :string, desc: 'The user to login to splunk with. If this is not provide it will use the current user'
|
60
|
+
option :password, type: :string, desc: 'The password to login to splunk with. If this is not provided it will ask for a password'
|
61
|
+
option :repo_path, type: :string, desc: 'The path to the repo. If this is not specified it is assumed you are executing from within the repo'
|
62
|
+
def save(environment)
|
63
|
+
cli = HighLine.new
|
64
|
+
|
65
|
+
user = options[:user] || Etc.getlogin
|
66
|
+
password = options[:password] || cli.ask('Password: ') { |o| o.echo = '*' }
|
67
|
+
execution_path = options[:repo_path] || Dir.getwd
|
68
|
+
|
69
|
+
pickaxe = Pickaxe.configure environment, user, password, execution_path
|
70
|
+
pickaxe.save_all
|
71
|
+
end
|
57
72
|
end
|
58
73
|
end
|
59
74
|
end
|
@@ -31,6 +31,15 @@ module Splunk
|
|
31
31
|
@tags.sync
|
32
32
|
@field_extractions.sync
|
33
33
|
end
|
34
|
+
|
35
|
+
def save_all
|
36
|
+
@alerts.save
|
37
|
+
@dashboards.save
|
38
|
+
@eventtypes.save
|
39
|
+
@reports.save
|
40
|
+
# splunk-sdk doesn't seem to support iterating tags
|
41
|
+
@field_extractions.save
|
42
|
+
end
|
34
43
|
end
|
35
44
|
end
|
36
45
|
end
|
@@ -86,6 +86,30 @@ module Splunk
|
|
86
86
|
end
|
87
87
|
end
|
88
88
|
|
89
|
+
def save
|
90
|
+
puts "Saving all #{entity_dir.capitalize}"
|
91
|
+
|
92
|
+
Splunk::Collection.new(service, splunk_resource)
|
93
|
+
.map { |e| save_config e }
|
94
|
+
end
|
95
|
+
|
96
|
+
def save_config(splunk_entity)
|
97
|
+
file_path = entity_file_path splunk_entity
|
98
|
+
|
99
|
+
puts "- #{splunk_entity.name}"
|
100
|
+
if File.exist? file_path
|
101
|
+
puts ' Already exists'
|
102
|
+
else
|
103
|
+
File.write(file_path, {
|
104
|
+
'name' => splunk_entity.name,
|
105
|
+
'config' => splunk_entity_keys
|
106
|
+
.map { |k| { k => splunk_entity.fetch(k) } }
|
107
|
+
.reduce({}) { |memo, setting| memo.update(setting) }
|
108
|
+
}.to_yaml)
|
109
|
+
puts ' Created'
|
110
|
+
end
|
111
|
+
end
|
112
|
+
|
89
113
|
def needs_update?(splunk_entity, entity)
|
90
114
|
splunk_config(entity).each do |k, v|
|
91
115
|
return true if splunk_entity[k] != v
|
@@ -99,6 +123,7 @@ module Splunk
|
|
99
123
|
!entity['envs'].include?(environment)
|
100
124
|
end
|
101
125
|
|
126
|
+
# Saved Splunk object's name
|
102
127
|
def name(entity)
|
103
128
|
entity['name']
|
104
129
|
end
|
@@ -107,6 +132,10 @@ module Splunk
|
|
107
132
|
entity['config']
|
108
133
|
end
|
109
134
|
|
135
|
+
def entity_file_name(entity)
|
136
|
+
"#{entity.name}.yml".gsub(/[^a-z0-9_\-. ]/i, '')
|
137
|
+
end
|
138
|
+
|
110
139
|
def entity_file_extensions
|
111
140
|
['.yml', '.yaml']
|
112
141
|
end
|
@@ -120,6 +149,16 @@ module Splunk
|
|
120
149
|
# Must be implemented by child class
|
121
150
|
nil
|
122
151
|
end
|
152
|
+
|
153
|
+
def splunk_entity_keys
|
154
|
+
# Must be implemented by child class
|
155
|
+
nil
|
156
|
+
end
|
157
|
+
|
158
|
+
def entity_file_path
|
159
|
+
# Must be implemented by child class
|
160
|
+
nil
|
161
|
+
end
|
123
162
|
end
|
124
163
|
end
|
125
164
|
end
|
@@ -2,6 +2,7 @@
|
|
2
2
|
|
3
3
|
require 'yaml'
|
4
4
|
require 'splunk/pickaxe/objects'
|
5
|
+
require 'splunk/pickaxe/objects/supported_keys'
|
5
6
|
|
6
7
|
module Splunk
|
7
8
|
module Pickaxe
|
@@ -16,6 +17,13 @@ module Splunk
|
|
16
17
|
DIR
|
17
18
|
end
|
18
19
|
|
20
|
+
def entity_file_path(splunk_entity)
|
21
|
+
File.join(
|
22
|
+
pickaxe_config.execution_path, entity_dir,
|
23
|
+
entity_file_name(splunk_entity)
|
24
|
+
)
|
25
|
+
end
|
26
|
+
|
19
27
|
def name(entity)
|
20
28
|
# The alert name contains the environment name
|
21
29
|
"#{entity['name']} [#{environment.capitalize}]"
|
@@ -72,6 +80,10 @@ module Splunk
|
|
72
80
|
'alert.suppress' => '0'
|
73
81
|
}
|
74
82
|
end
|
83
|
+
|
84
|
+
def splunk_entity_keys
|
85
|
+
Splunk::Pickaxe::ALERT_KEYS
|
86
|
+
end
|
75
87
|
end
|
76
88
|
end
|
77
89
|
end
|
@@ -15,6 +15,18 @@ module Splunk
|
|
15
15
|
DIR
|
16
16
|
end
|
17
17
|
|
18
|
+
def entity_file_name(entity)
|
19
|
+
"#{entity['label']}.xml".gsub(/[^a-z0-9_\-. ]/i, '')
|
20
|
+
.tr(' ', '_')
|
21
|
+
end
|
22
|
+
|
23
|
+
def entity_file_path(splunk_entity)
|
24
|
+
File.join(
|
25
|
+
pickaxe_config.execution_path, entity_dir,
|
26
|
+
entity_file_name(splunk_entity)
|
27
|
+
)
|
28
|
+
end
|
29
|
+
|
18
30
|
def config(file_path)
|
19
31
|
# Dashboards don't have many properties just name and source XML
|
20
32
|
{
|
@@ -28,6 +40,18 @@ module Splunk
|
|
28
40
|
def entity_file_extensions
|
29
41
|
['.xml']
|
30
42
|
end
|
43
|
+
|
44
|
+
def save_config(splunk_entity)
|
45
|
+
file_path = entity_file_path splunk_entity
|
46
|
+
|
47
|
+
puts "- #{splunk_entity['label']}"
|
48
|
+
if File.exist? file_path
|
49
|
+
puts ' Already exists'
|
50
|
+
else
|
51
|
+
File.write(file_path, splunk_entity['eai:data'])
|
52
|
+
puts ' Created'
|
53
|
+
end
|
54
|
+
end
|
31
55
|
end
|
32
56
|
end
|
33
57
|
end
|
@@ -1,7 +1,7 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
-
require 'yaml'
|
4
3
|
require 'splunk/pickaxe/objects'
|
4
|
+
require 'splunk/pickaxe/objects/supported_keys'
|
5
5
|
|
6
6
|
module Splunk
|
7
7
|
module Pickaxe
|
@@ -15,6 +15,17 @@ module Splunk
|
|
15
15
|
def entity_dir
|
16
16
|
DIR
|
17
17
|
end
|
18
|
+
|
19
|
+
def entity_file_path(splunk_entity)
|
20
|
+
File.join(
|
21
|
+
pickaxe_config.execution_path, entity_dir,
|
22
|
+
entity_file_name(splunk_entity)
|
23
|
+
)
|
24
|
+
end
|
25
|
+
|
26
|
+
def splunk_entity_keys
|
27
|
+
Splunk::Pickaxe::EVENT_TYPES_KEYS
|
28
|
+
end
|
18
29
|
end
|
19
30
|
end
|
20
31
|
end
|
@@ -1,6 +1,7 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
3
|
require 'splunk/pickaxe/objects'
|
4
|
+
require 'splunk/pickaxe/objects/supported_keys'
|
4
5
|
|
5
6
|
module Splunk
|
6
7
|
module Pickaxe
|
@@ -15,6 +16,18 @@ module Splunk
|
|
15
16
|
DIR
|
16
17
|
end
|
17
18
|
|
19
|
+
def entity_file_name(splunk_entity)
|
20
|
+
"#{splunk_entity['stanza']}-#{splunk_entity['type']}-#{splunk_entity['attribute']}.yml"
|
21
|
+
.gsub(/[^a-z0-9_\-. ]/i, '')
|
22
|
+
end
|
23
|
+
|
24
|
+
def entity_file_path(splunk_entity)
|
25
|
+
File.join(
|
26
|
+
pickaxe_config.execution_path, entity_dir,
|
27
|
+
entity_file_name(splunk_entity)
|
28
|
+
)
|
29
|
+
end
|
30
|
+
|
18
31
|
def find(entity)
|
19
32
|
# Splunk does some fun things by re-naming our field extraction to include
|
20
33
|
# the stanza and type in the name when its created so do that here by
|
@@ -33,6 +46,35 @@ module Splunk
|
|
33
46
|
# When updating splunk only cares about this field
|
34
47
|
splunk_entity['value'] != splunk_config(entity)['value']
|
35
48
|
end
|
49
|
+
|
50
|
+
def save_config(splunk_entity)
|
51
|
+
file_path = entity_file_path splunk_entity
|
52
|
+
|
53
|
+
puts "- #{splunk_entity.name}"
|
54
|
+
if File.exist? file_path
|
55
|
+
puts ' Already exists'
|
56
|
+
else
|
57
|
+
config = splunk_entity_keys
|
58
|
+
.map { |k| { k => splunk_entity.fetch(k) } }
|
59
|
+
.reduce({}) { |memo, setting| memo.update(setting) }
|
60
|
+
# the POST api expects 'type' to be the first part of 'attribute'
|
61
|
+
# while the GET api returns 'type' within 'attribute'
|
62
|
+
# the GET api also command and space delimits values, it should only
|
63
|
+
# use commas OR spaces.
|
64
|
+
config['type'] = splunk_entity.fetch('attribute').split('-').first
|
65
|
+
config['value'].gsub!(/, /, ',')
|
66
|
+
|
67
|
+
File.write(file_path, {
|
68
|
+
'name' => splunk_entity.name,
|
69
|
+
'config' => config
|
70
|
+
}.to_yaml)
|
71
|
+
puts ' Created'
|
72
|
+
end
|
73
|
+
end
|
74
|
+
|
75
|
+
def splunk_entity_keys
|
76
|
+
Splunk::Pickaxe::FIELD_EXTRACTIONS_KEYS
|
77
|
+
end
|
36
78
|
end
|
37
79
|
end
|
38
80
|
end
|
@@ -1,7 +1,7 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
-
require 'yaml'
|
4
3
|
require 'splunk/pickaxe/objects'
|
4
|
+
require 'splunk/pickaxe/objects/supported_keys'
|
5
5
|
|
6
6
|
module Splunk
|
7
7
|
module Pickaxe
|
@@ -16,6 +16,13 @@ module Splunk
|
|
16
16
|
DIR
|
17
17
|
end
|
18
18
|
|
19
|
+
def entity_file_path(splunk_entity)
|
20
|
+
File.join(
|
21
|
+
pickaxe_config.execution_path, entity_dir,
|
22
|
+
entity_file_name(splunk_entity)
|
23
|
+
)
|
24
|
+
end
|
25
|
+
|
19
26
|
def name(entity)
|
20
27
|
# The report name contains the environment name
|
21
28
|
"#{entity['name']} [#{environment.capitalize}]"
|
@@ -61,6 +68,10 @@ module Splunk
|
|
61
68
|
'dispatch.latest_time' => 'now'
|
62
69
|
}
|
63
70
|
end
|
71
|
+
|
72
|
+
def splunk_entity_keys
|
73
|
+
Splunk::Pickaxe::REPORT_KEYS
|
74
|
+
end
|
64
75
|
end
|
65
76
|
end
|
66
77
|
end
|
@@ -0,0 +1,10 @@
|
|
1
|
+
# rubocop:disable Metrics/LineLength
|
2
|
+
|
3
|
+
module Splunk
|
4
|
+
module Pickaxe
|
5
|
+
ALERT_KEYS = %w[action.email action.email.sendresults action.email.to action.populate_lookup action.rss action.script action.summary_index actions alert.digest_mode alert.expires alert.severity alert.suppress alert.suppress.fields alert.suppress.period alert.track alert_comparator alert_condition alert_threshold alert_type auto_summarize auto_summarize.command auto_summarize.cron_schedule auto_summarize.dispatch.earliest_time auto_summarize.dispatch.latest_time auto_summarize.dispatch.time_format auto_summarize.dispatch.ttl auto_summarize.max_concurrent auto_summarize.max_disabled_buckets auto_summarize.max_summary_ratio auto_summarize.max_summary_size auto_summarize.max_time auto_summarize.suspend_period auto_summarize.timespan cron_schedule description disabled dispatch.auto_cancel dispatch.auto_pause dispatch.buckets dispatch.earliest_time dispatch.index_earliest dispatch.index_latest dispatch.indexedRealtime dispatch.latest_time dispatch.lookups dispatch.max_count dispatch.max_time dispatch.reduce_freq dispatch.rt_backfill dispatch.spawn_process dispatch.time_format dispatch.ttl dispatchAs display.events.fields display.events.list.drilldown display.events.list.wrap display.events.maxLines display.events.raw.drilldown display.events.rowNumbers display.events.table.drilldown display.events.table.wrap display.events.type display.general.enablePreview display.general.migratedFromViewState display.general.timeRangePicker.show display.general.type display.page.search.mode display.page.search.patterns.sensitivity display.page.search.showFields display.page.search.tab display.page.search.timeline.format display.page.search.timeline.scale display.statistics.drilldown display.statistics.overlay display.statistics.rowNumbers display.statistics.show display.statistics.wrap display.visualizations.chartHeight display.visualizations.charting.axisLabelsX.majorLabelStyle.overflowMode display.visualizations.charting.axisLabelsX.majorLabelStyle.rotation display.visualizations.charting.axisLabelsX.majorUnit display.visualizations.charting.axisLabelsY.majorUnit display.visualizations.charting.axisLabelsY2.majorUnit display.visualizations.charting.axisTitleX.text display.visualizations.charting.axisTitleX.visibility display.visualizations.charting.axisTitleY.text display.visualizations.charting.axisTitleY.visibility display.visualizations.charting.axisTitleY2.text display.visualizations.charting.axisTitleY2.visibility display.visualizations.charting.axisX.maximumNumber display.visualizations.charting.axisX.minimumNumber display.visualizations.charting.axisX.scale display.visualizations.charting.axisY.maximumNumber display.visualizations.charting.axisY.minimumNumber display.visualizations.charting.axisY.scale display.visualizations.charting.axisY2.enabled display.visualizations.charting.axisY2.maximumNumber display.visualizations.charting.axisY2.minimumNumber display.visualizations.charting.axisY2.scale display.visualizations.charting.chart display.visualizations.charting.chart.bubbleMaximumSize display.visualizations.charting.chart.bubbleMinimumSize display.visualizations.charting.chart.bubbleSizeBy display.visualizations.charting.chart.nullValueMode display.visualizations.charting.chart.overlayFields display.visualizations.charting.chart.rangeValues display.visualizations.charting.chart.showDataLabels display.visualizations.charting.chart.sliceCollapsingThreshold display.visualizations.charting.chart.stackMode display.visualizations.charting.chart.style display.visualizations.charting.drilldown display.visualizations.charting.gaugeColors display.visualizations.charting.layout.splitSeries display.visualizations.charting.layout.splitSeries.allowIndependentYRanges display.visualizations.charting.legend.labelStyle.overflowMode display.visualizations.charting.legend.placement display.visualizations.mapHeight display.visualizations.mapping.choroplethLayer.colorBins display.visualizations.mapping.choroplethLayer.colorMode display.visualizations.mapping.choroplethLayer.maximumColor display.visualizations.mapping.choroplethLayer.minimumColor display.visualizations.mapping.choroplethLayer.neutralPoint display.visualizations.mapping.choroplethLayer.shapeOpacity display.visualizations.mapping.choroplethLayer.showBorder display.visualizations.mapping.data.maxClusters display.visualizations.mapping.drilldown display.visualizations.mapping.map.center display.visualizations.mapping.map.panning display.visualizations.mapping.map.scrollZoom display.visualizations.mapping.map.zoom display.visualizations.mapping.markerLayer.markerMaxSize display.visualizations.mapping.markerLayer.markerMinSize display.visualizations.mapping.markerLayer.markerOpacity display.visualizations.mapping.showTiles display.visualizations.mapping.tileLayer.maxZoom display.visualizations.mapping.tileLayer.minZoom display.visualizations.mapping.tileLayer.tileOpacity display.visualizations.mapping.tileLayer.url display.visualizations.mapping.type display.visualizations.show display.visualizations.singlevalue.afterLabel display.visualizations.singlevalue.beforeLabel display.visualizations.singlevalue.colorBy display.visualizations.singlevalue.colorMode display.visualizations.singlevalue.numberPrecision display.visualizations.singlevalue.rangeColors display.visualizations.singlevalue.rangeValues display.visualizations.singlevalue.showSparkline display.visualizations.singlevalue.showTrendIndicator display.visualizations.singlevalue.trendColorInterpretation display.visualizations.singlevalue.trendDisplayMode display.visualizations.singlevalue.trendInterval display.visualizations.singlevalue.underLabel display.visualizations.singlevalue.useColors display.visualizations.singlevalue.useThousandSeparators display.visualizations.singlevalueHeight display.visualizations.type displayview is_scheduled is_visible max_concurrent next_scheduled_time qualifiedSearch realtime_schedule request.ui_dispatch_app request.ui_dispatch_view restart_on_searchpeer_add run_n_times run_on_startup schedule_window search vsid].freeze
|
6
|
+
EVENT_TYPES_KEYS = %w[description disabled priority search tags].freeze
|
7
|
+
FIELD_EXTRACTIONS_KEYS = %w[stanza type value].freeze
|
8
|
+
REPORT_KEYS = %w[action.email action.email.sendresults action.email.to action.populate_lookup action.rss action.script action.summary_index actions alert.digest_mode alert.expires alert.severity alert.suppress alert.suppress.fields alert.suppress.period alert.track alert_comparator alert_condition alert_threshold alert_type auto_summarize auto_summarize.command auto_summarize.cron_schedule auto_summarize.dispatch.earliest_time auto_summarize.dispatch.latest_time auto_summarize.dispatch.time_format auto_summarize.dispatch.ttl auto_summarize.max_concurrent auto_summarize.max_disabled_buckets auto_summarize.max_summary_ratio auto_summarize.max_summary_size auto_summarize.max_time auto_summarize.suspend_period auto_summarize.timespan cron_schedule description disabled dispatch.auto_cancel dispatch.auto_pause dispatch.buckets dispatch.earliest_time dispatch.index_earliest dispatch.index_latest dispatch.indexedRealtime dispatch.latest_time dispatch.lookups dispatch.max_count dispatch.max_time dispatch.reduce_freq dispatch.rt_backfill dispatch.spawn_process dispatch.time_format dispatch.ttl dispatchAs display.events.fields display.events.list.drilldown display.events.list.wrap display.events.maxLines display.events.raw.drilldown display.events.rowNumbers display.events.table.drilldown display.events.table.wrap display.events.type display.general.enablePreview display.general.migratedFromViewState display.general.timeRangePicker.show display.general.type display.page.search.mode display.page.search.patterns.sensitivity display.page.search.showFields display.page.search.tab display.page.search.timeline.format display.page.search.timeline.scale display.statistics.drilldown display.statistics.overlay display.statistics.rowNumbers display.statistics.show display.statistics.wrap display.visualizations.chartHeight display.visualizations.charting.axisLabelsX.majorLabelStyle.overflowMode display.visualizations.charting.axisLabelsX.majorLabelStyle.rotation display.visualizations.charting.axisLabelsX.majorUnit display.visualizations.charting.axisLabelsY.majorUnit display.visualizations.charting.axisLabelsY2.majorUnit display.visualizations.charting.axisTitleX.text display.visualizations.charting.axisTitleX.visibility display.visualizations.charting.axisTitleY.text display.visualizations.charting.axisTitleY.visibility display.visualizations.charting.axisTitleY2.text display.visualizations.charting.axisTitleY2.visibility display.visualizations.charting.axisX.maximumNumber display.visualizations.charting.axisX.minimumNumber display.visualizations.charting.axisX.scale display.visualizations.charting.axisY.maximumNumber display.visualizations.charting.axisY.minimumNumber display.visualizations.charting.axisY.scale display.visualizations.charting.axisY2.enabled display.visualizations.charting.axisY2.maximumNumber display.visualizations.charting.axisY2.minimumNumber display.visualizations.charting.axisY2.scale display.visualizations.charting.chart display.visualizations.charting.chart.bubbleMaximumSize display.visualizations.charting.chart.bubbleMinimumSize display.visualizations.charting.chart.bubbleSizeBy display.visualizations.charting.chart.nullValueMode display.visualizations.charting.chart.overlayFields display.visualizations.charting.chart.rangeValues display.visualizations.charting.chart.showDataLabels display.visualizations.charting.chart.sliceCollapsingThreshold display.visualizations.charting.chart.stackMode display.visualizations.charting.chart.style display.visualizations.charting.drilldown display.visualizations.charting.gaugeColors display.visualizations.charting.layout.splitSeries display.visualizations.charting.layout.splitSeries.allowIndependentYRanges display.visualizations.charting.legend.labelStyle.overflowMode display.visualizations.charting.legend.placement display.visualizations.mapHeight display.visualizations.mapping.choroplethLayer.colorBins display.visualizations.mapping.choroplethLayer.colorMode display.visualizations.mapping.choroplethLayer.maximumColor display.visualizations.mapping.choroplethLayer.minimumColor display.visualizations.mapping.choroplethLayer.neutralPoint display.visualizations.mapping.choroplethLayer.shapeOpacity display.visualizations.mapping.choroplethLayer.showBorder display.visualizations.mapping.data.maxClusters display.visualizations.mapping.drilldown display.visualizations.mapping.map.center display.visualizations.mapping.map.panning display.visualizations.mapping.map.scrollZoom display.visualizations.mapping.map.zoom display.visualizations.mapping.markerLayer.markerMaxSize display.visualizations.mapping.markerLayer.markerMinSize display.visualizations.mapping.markerLayer.markerOpacity display.visualizations.mapping.showTiles display.visualizations.mapping.tileLayer.maxZoom display.visualizations.mapping.tileLayer.minZoom display.visualizations.mapping.tileLayer.tileOpacity display.visualizations.mapping.tileLayer.url display.visualizations.mapping.type display.visualizations.show display.visualizations.singlevalue.afterLabel display.visualizations.singlevalue.beforeLabel display.visualizations.singlevalue.colorBy display.visualizations.singlevalue.colorMode display.visualizations.singlevalue.numberPrecision display.visualizations.singlevalue.rangeColors display.visualizations.singlevalue.rangeValues display.visualizations.singlevalue.showSparkline display.visualizations.singlevalue.showTrendIndicator display.visualizations.singlevalue.trendColorInterpretation display.visualizations.singlevalue.trendDisplayMode display.visualizations.singlevalue.trendInterval display.visualizations.singlevalue.underLabel display.visualizations.singlevalue.useColors display.visualizations.singlevalue.useThousandSeparators display.visualizations.singlevalueHeight display.visualizations.type displayview is_scheduled is_visible max_concurrent next_scheduled_time qualifiedSearch realtime_schedule request.ui_dispatch_app request.ui_dispatch_view restart_on_searchpeer_add run_n_times run_on_startup schedule_window search vsid].freeze
|
9
|
+
end
|
10
|
+
end
|
@@ -1,7 +1,7 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
-
require 'yaml'
|
4
3
|
require 'splunk/pickaxe/objects'
|
4
|
+
require 'splunk/pickaxe/objects/supported_keys'
|
5
5
|
|
6
6
|
module Splunk
|
7
7
|
module Pickaxe
|
@@ -16,6 +16,13 @@ module Splunk
|
|
16
16
|
DIR
|
17
17
|
end
|
18
18
|
|
19
|
+
def entity_file_path(splunk_entity)
|
20
|
+
File.join(
|
21
|
+
pickaxe_config.execution_path, entity_dir,
|
22
|
+
entity_file_name(splunk_entity)
|
23
|
+
)
|
24
|
+
end
|
25
|
+
|
19
26
|
# Tags do not follow the typical conventions that other splunk resources do
|
20
27
|
# so we have to change the find/create/update methods
|
21
28
|
def find(entity)
|
@@ -60,6 +67,10 @@ module Splunk
|
|
60
67
|
# Compares the fields in our config vs whats in splunk
|
61
68
|
splunk_config(entity).uniq.sort != splunk_entity.uniq.sort
|
62
69
|
end
|
70
|
+
|
71
|
+
def splunk_entity_keys
|
72
|
+
Splunk::Pickaxe::TAGS_KEYS
|
73
|
+
end
|
63
74
|
end
|
64
75
|
end
|
65
76
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: splunk-pickaxe
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.
|
4
|
+
version: 2.1.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Bryan Baugher
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2017-07
|
11
|
+
date: 2017-12-07 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: splunk-sdk-ruby
|
@@ -102,9 +102,9 @@ files:
|
|
102
102
|
- lib/splunk/pickaxe/objects/eventtypes.rb
|
103
103
|
- lib/splunk/pickaxe/objects/field_extractions.rb
|
104
104
|
- lib/splunk/pickaxe/objects/reports.rb
|
105
|
+
- lib/splunk/pickaxe/objects/supported_keys.rb
|
105
106
|
- lib/splunk/pickaxe/objects/tags.rb
|
106
107
|
- lib/splunk/pickaxe/version.rb
|
107
|
-
- project.yml
|
108
108
|
homepage: http://github.com/Cerner/splunk-pickaxe
|
109
109
|
licenses:
|
110
110
|
- Apache-2.0
|
data/project.yml
DELETED
@@ -1,34 +0,0 @@
|
|
1
|
-
name: splunk-pickaxe
|
2
|
-
group_id: com.cerner.bigdata
|
3
|
-
artifact_id: splunk-pickaxe
|
4
|
-
github:
|
5
|
-
project_url: http://github.cerner.com/bigdata/splunk-pickaxe
|
6
|
-
|
7
|
-
doc: rdoc
|
8
|
-
test: rake
|
9
|
-
|
10
|
-
philter:
|
11
|
-
linters:
|
12
|
-
- ruby
|
13
|
-
ruby:
|
14
|
-
exclusions:
|
15
|
-
- target/**/*
|
16
|
-
- vendor/**/*
|
17
|
-
- spec/**/*
|
18
|
-
|
19
|
-
jira:
|
20
|
-
url: https://jira.cerner.com
|
21
|
-
component: 25899
|
22
|
-
|
23
|
-
snapshot_repository:
|
24
|
-
id: cerner-rubygems-snapshot
|
25
|
-
url: http://repo.snapshot.cerner.corp/rubygems/
|
26
|
-
snapshot_site_repository:
|
27
|
-
id: bigdata-snapshot-site
|
28
|
-
url: http://repo.bigdata.cerner.corp/nexus/content/repositories/bigdata-snapshot-site/
|
29
|
-
repository:
|
30
|
-
id: cerner-rubygems-internal
|
31
|
-
url: http://repo.release.cerner.corp/internal/rubygems/
|
32
|
-
site_repository:
|
33
|
-
id: cerner-main-internal-site
|
34
|
-
url: http://repo.release.cerner.corp/internal/site/
|