splunkctl 0.1.0__py3-none-any.whl

splunkctl/commands/lookups.py

@@ -0,0 +1,217 @@
+"""Lookup table commands — raw REST (SDK gap)."""
+
+import json
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+import click
+
+from splunkctl import guard, output
+from splunkctl.client import get_client
+
+_READ_BASE = "/servicesNS/-/{app}/data/lookup-table-files"
+_WRITE_BASE = "/servicesNS/nobody/{app}/data/lookup-table-files"
+
+
+def _read_path(app: str, name: str | None = None) -> str:
+    base = _READ_BASE.format(app=quote(app, safe=""))
+    return f"{base}/{quote(name, safe='')}" if name else base
+
+
+def _write_path(app: str, name: str | None = None) -> str:
+    base = _WRITE_BASE.format(app=quote(app, safe=""))
+    return f"{base}/{quote(name, safe='')}" if name else base
+
+
+def _parse_entries(body: bytes) -> list[dict[str, Any]]:
+    """Extract flat rows from Splunk REST JSON response."""
+    data: dict[str, Any] = json.loads(body)
+    return [
+        {
+            "name": entry.get("name", ""),
+            "app": entry.get("acl", {}).get("app", ""),
+            "owner": entry.get("acl", {}).get("owner", ""),
+            "disabled": entry.get("content", {}).get("disabled", ""),
+            "eai:type": entry.get("content", {}).get("eai:type", ""),
+            "updated": entry.get("updated", ""),
+        }
+        for entry in data.get("entry", [])
+    ]
+
+
+def _parse_entry(body: bytes) -> dict[str, Any]:
+    """Extract a single entry from Splunk REST JSON response."""
+    data: dict[str, Any] = json.loads(body)
+    entries: list[dict[str, Any]] = data.get("entry", [])
+    if not entries:
+        return {}
+    entry = entries[0]
+    content: dict[str, Any] = entry.get("content", {})
+    return {
+        "name": entry.get("name", ""),
+        "app": entry.get("acl", {}).get("app", ""),
+        "owner": entry.get("acl", {}).get("owner", ""),
+        "disabled": content.get("disabled", ""),
+        "eai:type": content.get("eai:type", ""),
+        "eai:data": content.get("eai:data", ""),
+        "updated": entry.get("updated", ""),
+    }
+
+
+@click.group("lookups")
+def lookups_group() -> None:
+    """Manage lookup table files."""
+
+
+@lookups_group.command("list")
+@click.option("--app", default="-", help="Splunk app context (default: all).")
+@click.pass_context
+def list_lookups(ctx: click.Context, *, app: str) -> None:
+    """List lookup table files."""
+    client = get_client(ctx)
+    svc = client.service
+    resp = svc.get(_read_path(app), output_mode="json")
+    body: bytes = resp.body.read()
+    rows = _parse_entries(body)
+    if not rows:
+        output.info("No lookup tables found.")
+        return
+    output.render(ctx, rows)
+
+
+@lookups_group.command("get")
+@click.argument("name")
+@click.option("--app", default="-", help="Splunk app context (default: all).")
+@click.pass_context
+def get_lookup(ctx: click.Context, name: str, *, app: str) -> None:
+    """Get metadata for a lookup file."""
+    client = get_client(ctx)
+    svc = client.service
+    try:
+        resp = svc.get(_read_path(app, name), output_mode="json")
+    except Exception as exc:
+        output.error(f"Lookup '{name}' not found: {exc}")
+        ctx.exit(1)
+        return
+    body: bytes = resp.body.read()
+    row = _parse_entry(body)
+    if not row:
+        output.error(f"Lookup '{name}' not found.")
+        ctx.exit(1)
+        return
+    output.render(ctx, row)
+
+
+@lookups_group.command("upload")
+@click.argument("name")
+@click.option(
+    "--file",
+    "file_path",
+    required=True,
+    type=click.Path(exists=True),
+    help="CSV file to upload.",
+)
+@click.option("--app", default="search", help="Target app (default: search).")
+@click.pass_context
+def upload_lookup(ctx: click.Context, name: str, file_path: str, *, app: str) -> None:
+    """Upload a CSV file as a new lookup table."""
+    path = Path(file_path)
+    details = f"Upload '{path.name}' as lookup '{name}' in app '{app}'"
+    if not guard.check(ctx, details):
+        return
+
+    client = get_client(ctx)
+    svc = client.service
+    csv_data = path.read_text(encoding="utf-8")
+    try:
+        svc.post(
+            _write_path(app),
+            name=name,
+            **{"eai:data": csv_data},
+        )
+    except Exception as exc:
+        output.error(f"Upload failed: {exc}")
+        ctx.exit(1)
+        return
+    output.info(f"Uploaded lookup '{name}' to app '{app}'.")
+
+
+@lookups_group.command("download")
+@click.argument("name")
+@click.option("--app", default="search", help="Splunk app context.")
+@click.option("--out", type=click.Path(), default=None, help="Write CSV to file.")
+@click.pass_context
+def download_lookup(
+    ctx: click.Context, name: str, *, app: str, out: str | None
+) -> None:
+    """Download a lookup table as CSV."""
+    client = get_client(ctx)
+    svc = client.service
+    try:
+        stream = svc.jobs.oneshot(f"| inputlookup {name}", output_mode="csv", app=app)
+        csv_content = stream.read().decode("utf-8")
+    except Exception as exc:
+        output.error(f"Download failed: {exc}")
+        ctx.exit(1)
+        return
+
+    if out:
+        Path(out).write_text(csv_content, encoding="utf-8")
+        output.info(f"Written to {out}")
+    else:
+        click.echo(csv_content, nl=False)
+
+
+@lookups_group.command("update")
+@click.argument("name")
+@click.option(
+    "--file",
+    "file_path",
+    required=True,
+    type=click.Path(exists=True),
+    help="CSV file to upload.",
+)
+@click.option("--app", default="search", help="Target app (default: search).")
+@click.pass_context
+def update_lookup(ctx: click.Context, name: str, file_path: str, *, app: str) -> None:
+    """Overwrite an existing lookup table with new CSV data."""
+    path = Path(file_path)
+    details = f"Overwrite lookup '{name}' in app '{app}' with '{path.name}'"
+    if not guard.check(ctx, details):
+        return
+
+    client = get_client(ctx)
+    svc = client.service
+    csv_data = path.read_text(encoding="utf-8")
+    try:
+        svc.post(
+            _write_path(app, name),
+            **{"eai:data": csv_data},
+        )
+    except Exception as exc:
+        output.error(f"Update failed: {exc}")
+        ctx.exit(1)
+        return
+    output.info(f"Updated lookup '{name}' in app '{app}'.")
+
+
+@lookups_group.command("delete")
+@click.argument("name")
+@click.option("--app", default="search", help="Target app (default: search).")
+@click.pass_context
+def delete_lookup(ctx: click.Context, name: str, *, app: str) -> None:
+    """Delete a lookup table file."""
+    details = f"Delete lookup '{name}' from app '{app}'"
+    if not guard.check(ctx, details):
+        return
+
+    client = get_client(ctx)
+    svc = client.service
+    try:
+        svc.delete(_write_path(app, name))
+    except Exception as exc:
+        output.error(f"Delete failed: {exc}")
+        ctx.exit(1)
+        return
+    output.info(f"Deleted lookup '{name}' from app '{app}'.")

splunkctl/commands/parsers.py

@@ -0,0 +1,177 @@
+"""Parser / sourcetype commands — props.conf and transforms.conf via confs API."""
+
+from typing import Any
+
+import click
+
+from splunkctl import guard, output
+from splunkctl.client import get_client
+
+
+@click.group("parsers")
+def parsers_group() -> None:
+    """Manage source types and field extractions."""
+
+
+@parsers_group.command("sourcetypes")
+@click.pass_context
+def sourcetypes(ctx: click.Context) -> None:
+    """List source types from props.conf."""
+    client = get_client(ctx)
+    conf = client.service.confs["props"]
+    rows: list[dict[str, Any]] = [
+        {
+            "name": s.name,
+            "category": s.content.get("category", ""),
+            "description": s.content.get("description", ""),
+            "TRANSFORMS": s.content.get("TRANSFORMS", ""),
+        }
+        for s in conf.list()
+    ]
+    output.render(ctx, rows)
+
+
+@parsers_group.command("get")
+@click.argument("sourcetype")
+@click.pass_context
+def get_sourcetype(ctx: click.Context, sourcetype: str) -> None:
+    """Show full props.conf settings for a sourcetype."""
+    client = get_client(ctx)
+    conf = client.service.confs["props"]
+    try:
+        stanza = conf[sourcetype]
+    except KeyError:
+        output.error(f"Sourcetype '{sourcetype}' not found.")
+        ctx.exit(1)
+        return
+    row: dict[str, Any] = {"name": stanza.name, **dict(stanza.content)}
+    output.render(ctx, row)
+
+
+@parsers_group.command("extractions")
+@click.option("--sourcetype", default=None, help="Filter by name substring.")
+@click.pass_context
+def extractions(ctx: click.Context, sourcetype: str | None) -> None:
+    """List field extractions from transforms.conf."""
+    client = get_client(ctx)
+    conf = client.service.confs["transforms"]
+    rows: list[dict[str, Any]] = []
+    for stanza in conf.list():
+        if sourcetype and sourcetype not in stanza.name:
+            continue
+        rows.append(
+            {
+                "name": stanza.name,
+                "REGEX": stanza.content.get("REGEX", ""),
+                "FORMAT": stanza.content.get("FORMAT", ""),
+                "DEST_KEY": stanza.content.get("DEST_KEY", ""),
+            }
+        )
+    output.render(ctx, rows)
+
+
+@parsers_group.command("create")
+@click.option("--sourcetype", required=True, help="Sourcetype name.")
+@click.option("--category", default=None, help="Category value.")
+@click.option(
+    "--transforms",
+    "transforms_val",
+    default=None,
+    help="TRANSFORMS value.",
+)
+@click.pass_context
+def create_sourcetype(
+    ctx: click.Context,
+    sourcetype: str,
+    category: str | None,
+    transforms_val: str | None,
+) -> None:
+    """Create a props.conf stanza."""
+    kwargs: dict[str, str] = {}
+    if category:
+        kwargs["category"] = category
+    if transforms_val:
+        kwargs["TRANSFORMS"] = transforms_val
+
+    details = f"  sourcetype: {sourcetype}"
+    for k, v in kwargs.items():
+        details += f"\n  {k}: {v}"
+
+    if not guard.check(ctx, f"Create sourcetype '{sourcetype}'", details=details):
+        return
+
+    client = get_client(ctx)
+    conf = client.service.confs["props"]
+    conf.create(sourcetype, **kwargs)
+    output.info(f"Created sourcetype '{sourcetype}'.")
+
+
+@parsers_group.command("update")
+@click.argument("sourcetype")
+@click.option("--category", default=None, help="Category value.")
+@click.option(
+    "--transforms",
+    "transforms_val",
+    default=None,
+    help="TRANSFORMS value.",
+)
+@click.pass_context
+def update_sourcetype(
+    ctx: click.Context,
+    sourcetype: str,
+    category: str | None,
+    transforms_val: str | None,
+) -> None:
+    """Update a props.conf stanza."""
+    kwargs: dict[str, str] = {}
+    if category:
+        kwargs["category"] = category
+    if transforms_val:
+        kwargs["TRANSFORMS"] = transforms_val
+
+    if not kwargs:
+        output.error("Nothing to update — pass at least one option.")
+        ctx.exit(1)
+        return
+
+    details = f"  sourcetype: {sourcetype}"
+    for k, v in kwargs.items():
+        details += f"\n  {k}: {v}"
+
+    if not guard.check(ctx, f"Update sourcetype '{sourcetype}'", details=details):
+        return
+
+    client = get_client(ctx)
+    conf = client.service.confs["props"]
+    try:
+        stanza = conf[sourcetype]
+    except KeyError:
+        output.error(f"Sourcetype '{sourcetype}' not found.")
+        ctx.exit(1)
+        return
+    stanza.update(**kwargs).refresh()
+    output.info(f"Updated sourcetype '{sourcetype}'.")
+
+
+@parsers_group.command("delete")
+@click.argument("sourcetype")
+@click.pass_context
+def delete_sourcetype(ctx: click.Context, sourcetype: str) -> None:
+    """Delete a props.conf stanza."""
+    if not guard.check(
+        ctx,
+        f"Delete sourcetype '{sourcetype}'",
+        details=f"  sourcetype: {sourcetype}",
+    ):
+        return
+
+    client = get_client(ctx)
+    conf = client.service.confs["props"]
+    try:
+        stanza = conf[sourcetype]
+    except KeyError:
+        output.error(f"Sourcetype '{sourcetype}' not found.")
+        ctx.exit(1)
+        return
+    stanza.delete()
+    output.info(f"Deleted sourcetype '{sourcetype}'.")

splunkctl/commands/rules.py

@@ -0,0 +1,266 @@
+"""Saved searches / detection rules."""
+
+from typing import Any
+
+import click
+
+from splunkctl import guard, output
+from splunkctl.client import get_client
+
+
+def _summarize(ss: Any) -> dict[str, Any]:
+    c: dict[str, Any] = ss.content
+    acl: dict[str, Any] = ss.access
+    return {
+        "name": ss.name,
+        "app": acl.get("app", ""),
+        "is_scheduled": c.get("is_scheduled", "0"),
+        "cron": c.get("cron_schedule", ""),
+        "next_scheduled": c.get("next_scheduled_time", ""),
+        "disabled": c.get("disabled", "0"),
+        "actions": c.get("actions", ""),
+    }
+
+
+_DETAIL_FIELDS = (
+    "search",
+    "description",
+    "cron_schedule",
+    "is_scheduled",
+    "next_scheduled_time",
+    "disabled",
+    "actions",
+    "alert_type",
+    "alert.severity",
+    "alert.suppress",
+    "dispatch.earliest_time",
+    "dispatch.latest_time",
+    "max_concurrent",
+    "realtime_schedule",
+    "request.ui_dispatch_app",
+)
+
+
+def _detail(ss: Any) -> dict[str, Any]:
+    c: dict[str, Any] = ss.content
+    row: dict[str, Any] = {"name": ss.name}
+    row.update({f: c.get(f, "") for f in _DETAIL_FIELDS})
+    return row
+
+
+@click.group("rules")
+def rules_group() -> None:
+    """Manage detection rules (saved searches)."""
+
+
+@rules_group.command("list")
+@click.pass_context
+def list_rules(ctx: click.Context) -> None:
+    """List all saved searches."""
+    client = get_client(ctx)
+    items = client.service.saved_searches.list()
+    rows = [_summarize(ss) for ss in items]
+    output.render(ctx, rows)
+
+
+@rules_group.command()
+@click.argument("name")
+@click.pass_context
+def get(ctx: click.Context, name: str) -> None:
+    """Get a saved search by name."""
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    output.render(ctx, _detail(ss))
+
+
+@rules_group.command()
+@click.option("--name", required=True, help="Saved search name.")
+@click.option("--search", "spl", required=True, help="SPL query.")
+@click.option("--cron", default=None, help="Cron schedule.")
+@click.option("--app", default=None, help="Splunk app context.")
+@click.option("--description", default=None, help="Description.")
+@click.option("--actions", default=None, help="Alert actions (comma-separated).")
+@click.option("--disabled", is_flag=True, default=False, help="Create disabled.")
+@click.pass_context
+def create(
+    ctx: click.Context,
+    *,
+    name: str,
+    spl: str,
+    cron: str | None,
+    app: str | None,
+    description: str | None,
+    actions: str | None,
+    disabled: bool,
+) -> None:
+    """Create a saved search."""
+    kwargs: dict[str, Any] = {}
+    if cron is not None:
+        kwargs["cron_schedule"] = cron
+        kwargs["is_scheduled"] = "1"
+    if description is not None:
+        kwargs["description"] = description
+    if actions is not None:
+        kwargs["actions"] = actions
+    if disabled:
+        kwargs["disabled"] = "1"
+    if app is not None:
+        kwargs["app"] = app
+
+    detail = f"  name:   {name}\n  search: {spl}"
+    if kwargs:
+        detail += "\n  " + "\n  ".join(f"{k}: {v}" for k, v in kwargs.items())
+
+    if not guard.check(ctx, f"Create saved search '{name}'", details=detail):
+        return
+
+    client = get_client(ctx)
+    client.service.saved_searches.create(name, search=spl, **kwargs)
+    output.info(f"Created saved search '{name}'.")
+
+
+@rules_group.command()
+@click.argument("name")
+@click.option("--search", "spl", default=None, help="SPL query.")
+@click.option("--cron", default=None, help="Cron schedule.")
+@click.option("--description", default=None, help="Description.")
+@click.option("--actions", default=None, help="Alert actions (comma-separated).")
+@click.option(
+    "--enabled/--disabled",
+    default=None,
+    help="Enable or disable scheduling.",
+)
+@click.pass_context
+def update(
+    ctx: click.Context,
+    name: str,
+    *,
+    spl: str | None,
+    cron: str | None,
+    description: str | None,
+    actions: str | None,
+    enabled: bool | None,
+) -> None:
+    """Update a saved search."""
+    kwargs: dict[str, Any] = {}
+    if spl is not None:
+        kwargs["search"] = spl
+    if cron is not None:
+        kwargs["cron_schedule"] = cron
+    if description is not None:
+        kwargs["description"] = description
+    if actions is not None:
+        kwargs["actions"] = actions
+    if enabled is not None:
+        kwargs["disabled"] = "0" if enabled else "1"
+        if enabled:
+            kwargs["is_scheduled"] = "1"
+
+    if not kwargs:
+        output.error("No changes specified.")
+        ctx.exit(1)
+        return
+
+    detail = "\n".join(f"  {k}: {v}" for k, v in kwargs.items())
+    if not guard.check(ctx, f"Update saved search '{name}'", details=detail):
+        return
+
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    ss.update(**kwargs).refresh()
+    output.info(f"Updated saved search '{name}'.")
+
+
+@rules_group.command()
+@click.argument("name")
+@click.pass_context
+def delete(ctx: click.Context, name: str) -> None:
+    """Delete a saved search."""
+    if not guard.check(ctx, f"Delete saved search '{name}'"):
+        return
+
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    ss.delete()
+    output.info(f"Deleted saved search '{name}'.")
+
+
+@rules_group.command()
+@click.argument("name")
+@click.pass_context
+def enable(ctx: click.Context, name: str) -> None:
+    """Enable scheduling for a saved search."""
+    if not guard.check(ctx, f"Enable saved search '{name}'"):
+        return
+
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    ss.update(disabled="0", is_scheduled="1").refresh()
+    output.info(f"Enabled saved search '{name}'.")
+
+
+@rules_group.command()
+@click.argument("name")
+@click.pass_context
+def disable(ctx: click.Context, name: str) -> None:
+    """Disable scheduling for a saved search."""
+    if not guard.check(ctx, f"Disable saved search '{name}'"):
+        return
+
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    ss.update(disabled="1").refresh()
+    output.info(f"Disabled saved search '{name}'.")
+
+
+@rules_group.command()
+@click.argument("name")
+@click.pass_context
+def history(ctx: click.Context, name: str) -> None:
+    """Show run history for a saved search."""
+    client = get_client(ctx)
+    try:
+        ss = client.service.saved_searches[name]
+    except KeyError:
+        output.error(f"Saved search not found: {name}")
+        ctx.exit(1)
+        return
+    jobs = ss.history()
+    rows: list[dict[str, Any]] = []
+    for job in jobs:
+        c: dict[str, Any] = job.content
+        rows.append(
+            {
+                "sid": job.sid,
+                "dispatch_state": c.get("dispatchState", ""),
+                "run_duration": c.get("runDuration", ""),
+                "event_count": c.get("eventCount", ""),
+                "result_count": c.get("resultCount", ""),
+            }
+        )
+    output.render(ctx, rows)