splunkctl 0.4.0__tar.gz → 0.4.1__tar.gz

{splunkctl-0.4.0 → splunkctl-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunkctl
-Version: 0.4.0
+Version: 0.4.1
 Summary: CLI tool for Splunk Enterprise SIEM operations.
 Author: dannyota
 License-Expression: Apache-2.0

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/__init__.py

@@ -1,3 +1,3 @@
 """CLI tool for Splunk Enterprise SIEM operations."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/common.py

@@ -354,6 +354,29 @@ _REQUIRED_ACTION_FIELDS: dict[str, str] = {
 }
 
 
+def app_scope(app: str | None) -> dict[str, str]:
+    """Build the ``app``/``owner`` kwargs for an app-scoped list call.
+
+    Unscoped by default (the connection's current namespace); ``owner="-"``
+    when an app is given so app-private stanzas owned by other users aren't
+    silently excluded.
+    """
+    return {} if app is None else {"app": app, "owner": "-"}
+
+
+def trunc(value: str, limit: int = 60) -> str:
+    """Shorten a long text field for table display.
+
+    Never emits a bare ellipsis — a truncated value always says how many
+    characters were hidden, e.g. ``foo… [+57 chars]``.
+    """
+    if len(value) <= limit:
+        return value
+    kept = value[: limit - 1]
+    hidden = len(value) - len(kept)
+    return f"{kept}… [+{hidden} chars]"
+
+
 def warn_missing_action_fields(
     actions: str,
     kwargs: dict[str, Any],

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/conf.py

@@ -15,7 +15,7 @@ import click
 from splunkctl import guard, output
 from splunkctl.client import get_client
 from splunkctl.commands import conf_ops
-from splunkctl.commands.common import fetch_page, list_options, parse_set
+from splunkctl.commands.common import app_scope, fetch_page, list_options, parse_set
 
 
 def _not_found_message(exc: KeyError, file: str, stanza: str) -> str:
@@ -35,18 +35,6 @@ def _not_found_message(exc: KeyError, file: str, stanza: str) -> str:
     return f"Stanza '{stanza}' not found in {file}.conf."
 
 
-def _app_scope(app: str | None) -> dict[str, str]:
-    """Build the ``app``/``owner`` kwargs for an app-scoped list call.
-
-    Mirrors the ``rules``/``dashboards`` scoping convention: unscoped by
-    default (matches ``parsers``' existing default, i.e. whatever the
-    connection's current namespace resolves to), ``owner="-"`` when an
-    app is given so app-private stanzas owned by other users aren't
-    silently excluded.
-    """
-    return {} if app is None else {"app": app, "owner": "-"}
-
-
 @click.group("conf")
 def conf_group() -> None:
     """Generic conf file/stanza editor (any conf, including sensitive ones)."""
@@ -70,7 +58,7 @@ def files(
 ) -> None:
     """List conf files known to the server."""
     client = get_client(ctx)
-    scope = _app_scope(app)
+    scope = app_scope(app)
     items = fetch_page(
         lambda **pg: client.service.confs.list(**scope, **pg),
         limit=limit,
@@ -102,7 +90,7 @@ def list_stanzas(
 ) -> None:
     """List stanzas in a conf file."""
     client = get_client(ctx)
-    scope = _app_scope(app)
+    scope = app_scope(app)
     items = fetch_page(
         lambda **pg: client.service.confs[file].list(**scope, **pg),
         limit=limit,
@@ -123,13 +111,21 @@ def list_stanzas(
 @conf_group.command("get")
 @click.argument("file")
 @click.argument("stanza")
+@click.option(
+    "--app",
+    default=None,
+    help="App to resolve the stanza in, when the same stanza exists in "
+    "more than one app (default: current namespace).",
+)
 @click.option("--key", default=None, help="Show only this key's value.")
 @click.pass_context
-def get(ctx: click.Context, file: str, stanza: str, key: str | None) -> None:
+def get(
+    ctx: click.Context, file: str, stanza: str, app: str | None, key: str | None
+) -> None:
     """Show a conf stanza's keys, or one key's value with --key."""
     client = get_client(ctx)
     try:
-        entity = conf_ops.get_stanza(client, file, stanza)
+        entity = conf_ops.get_stanza(client, file, stanza, app=app)
     except KeyError as exc:
         output.error(_not_found_message(exc, file, stanza), kind="not_found")
         ctx.exit(1)

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/knowledge.py

@@ -24,37 +24,12 @@ import click
 from splunkctl import guard, output
 from splunkctl.client import get_client
 from splunkctl.commands import conf_ops
-from splunkctl.commands.common import fetch_page, list_options
+from splunkctl.commands.common import app_scope, fetch_page, list_options, trunc
 
-_TRUNC = 60
 # Splunk's own naming for a parameterized macro stanza: `name(argcount)`.
 _ARG_FORM = re.compile(r"^(?P<base>.+)\((?P<n>\d+)\)$")
 
 
-def _trunc(value: str, *, truncate: bool) -> str:
-    """Shorten a long text field for table display; never for JSON.
-
-    Never emits a bare ellipsis — a truncated value always says how
-    many characters were hidden, matching the house style used for
-    rule-diff previews.
-    """
-    if not truncate or len(value) <= _TRUNC:
-        return value
-    kept = value[: _TRUNC - 1]
-    hidden = len(value) - len(kept)
-    return f"{kept}… [+{hidden} chars]"
-
-
-def _app_scope(app: str | None) -> dict[str, str]:
-    """Build the ``app``/``owner`` kwargs for an app-scoped list call.
-
-    Unscoped by default (matches the connection's current namespace);
-    ``owner="-"`` when an app is given so app-private stanzas owned by
-    other users aren't silently excluded — same convention as `conf`.
-    """
-    return {} if app is None else {"app": app, "owner": "-"}
-
-
 # --------------------------------------------------------------------------
 # macros
 # --------------------------------------------------------------------------
@@ -84,7 +59,7 @@ def macros_list(
 ) -> None:
     """List macros with their definitions."""
     client = get_client(ctx)
-    scope = _app_scope(app)
+    scope = app_scope(app)
     items = fetch_page(
         lambda **pg: client.service.confs["macros"].list(**scope, **pg),
         limit=limit,
@@ -95,7 +70,11 @@ def macros_list(
     rows: list[dict[str, Any]] = [
         {
             "name": s.name,
-            "definition": _trunc(s.content.get("definition", ""), truncate=truncate),
+            "definition": (
+                trunc(s.content.get("definition", ""))
+                if truncate
+                else s.content.get("definition", "")
+            ),
             "args": s.content.get("args", ""),
             "app": dict(s.access).get("app", ""),
         }
@@ -125,7 +104,7 @@ def _resolve_macro(client: Any, name: str, app: str | None) -> Any:
             raise
         candidates = [
             (int(m["n"]), s)
-            for s in client.service.confs["macros"].list(**_app_scope(app))
+            for s in client.service.confs["macros"].list(**app_scope(app))
             if (m := _ARG_FORM.match(s.name)) and m["base"] == name
         ]
         if not candidates:
@@ -241,7 +220,7 @@ def eventtypes_list(
 ) -> None:
     """List eventtypes with their search and disabled state."""
     client = get_client(ctx)
-    scope = _app_scope(app)
+    scope = app_scope(app)
     items = fetch_page(
         lambda **pg: client.service.confs["eventtypes"].list(**scope, **pg),
         limit=limit,
@@ -252,7 +231,11 @@ def eventtypes_list(
     rows: list[dict[str, Any]] = [
         {
             "name": s.name,
-            "search": _trunc(s.content.get("search", ""), truncate=truncate),
+            "search": (
+                trunc(s.content.get("search", ""))
+                if truncate
+                else s.content.get("search", "")
+            ),
             "app": dict(s.access).get("app", ""),
             "disabled": s.content.get("disabled", ""),
         }
@@ -343,7 +326,7 @@ def tags_list(
     use ``tags get`` for a stanza's full enabled/disabled breakdown.
     """
     client = get_client(ctx)
-    scope = _app_scope(app)
+    scope = app_scope(app)
     items = fetch_page(
         lambda **pg: client.service.confs["tags"].list(**scope, **pg),
         limit=limit,

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/lookups.py

@@ -18,17 +18,7 @@ import click
 from splunkctl import guard, output
 from splunkctl.client import get_client
 from splunkctl.commands import conf_ops, lookups_wiring
-from splunkctl.commands.common import fetch_page, list_options
-
-
-def _app_scope(app: str | None) -> dict[str, str]:
-    """Build the ``app``/``owner`` kwargs for an app-scoped list call.
-
-    Mirrors ``conf``/``knowledge``'s convention: unscoped by default
-    (current namespace), ``owner="-"`` when an app is given so
-    app-private stanzas owned by other users aren't silently excluded.
-    """
-    return {} if app is None else {"app": app, "owner": "-"}
+from splunkctl.commands.common import app_scope, fetch_page, list_options
 
 
 @click.group("lookups")
@@ -247,7 +237,7 @@ def _warn_if_file_missing(client: Any, file_name: str, app: str | None) -> None:
     """
     try:
         matches = client.service.lookup_table_files.list(
-            search=f"name={file_name}", count=1, **_app_scope(app)
+            search=f"name={file_name}", count=1, **app_scope(app)
         )
     except Exception:
         return
@@ -459,7 +449,7 @@ def list_definitions(
     """
     client = get_client(ctx)
     items = fetch_page(
-        lambda **pg: client.service.confs["transforms"].list(**_app_scope(app), **pg),
+        lambda **pg: client.service.confs["transforms"].list(**app_scope(app), **pg),
         limit=limit,
         offset=offset,
         name_filter=name_filter,

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/rules.py

@@ -423,7 +423,7 @@ def test_rule(
     while not job.is_done():
         if time.monotonic() > deadline:
             job.cancel()
-            output.error(f"Test run timed out after {timeout}s.")
+            output.error(f"Test run timed out after {timeout}s.", kind="timeout")
             ctx.exit(1)
             return
         time.sleep(0.5)

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/rules_io.py

@@ -10,6 +10,7 @@ import yaml
 
 from splunkctl import guard, output
 from splunkctl.client import get_client
+from splunkctl.commands.common import trunc
 
 _EXPORT_FIELDS = (
     "search",
@@ -47,21 +48,6 @@ _READONLY_KEYS = frozenset(
     }
 )
 
-_TRUNC = 60
-
-
-def _trunc(val: str) -> str:
-    """Truncate for the text preview, with an explicit hidden-length marker.
-
-    Never emits a bare ``…`` — a truncated value always says how many
-    characters were hidden, e.g. ``foo… [+57 chars]``.
-    """
-    if len(val) <= _TRUNC:
-        return val
-    kept = val[: _TRUNC - 1]
-    hidden = len(val) - len(kept)
-    return f"{kept}… [+{hidden} chars]"
-
 
 class FieldChange(TypedDict):
     """One field's before/after value in a rule diff."""
@@ -243,7 +229,7 @@ def _preview_lines(d: RuleDiff) -> list[str]:
     if kind == "update":
         lines = [f"  update: {name}"]
         lines.extend(
-            f"    {c['field']}: {_trunc(str(c['old']))} -> {_trunc(c['new'])}"
+            f"    {c['field']}: {trunc(str(c['old']))} -> {trunc(c['new'])}"
             for c in d["changes"]
         )
         return lines
@@ -291,7 +277,7 @@ def _plan_rule(svc: Any, rule: Any, *, update: bool) -> tuple[str, list[str]]:
     diff = _changes(ss, spl, kwargs)
     if not diff:
         return f"unchanged:{name}", []
-    lines = [f"  {k}: {_trunc(old)} -> {_trunc(new)}" for k, (old, new) in diff.items()]
+    lines = [f"  {k}: {trunc(old)} -> {trunc(new)}" for k, (old, new) in diff.items()]
     return f"update:{name}", lines
 
 

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/search.py

@@ -114,7 +114,7 @@ def run_search(
     while not job.is_done():
         if time.monotonic() > deadline:
             job.cancel()
-            output.error(f"Search timed out after {timeout}s.")
+            output.error(f"Search timed out after {timeout}s.", kind="timeout")
             ctx.exit(1)
             return
         time.sleep(0.5)

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/state_io.py

@@ -86,7 +86,8 @@ def _drift_from_rule_diff(rd: RuleDiff) -> DriftEntry:
     name = rd["name"]
     if name is None:
         raise ValueError("cannot build a drift entry for a skipped (nameless) rule doc")
-    entry: DriftEntry = {"name": name, "change": _RULE_CHANGE[rd["kind"]]}
+    change = _RULE_CHANGE.get(rd["kind"], "unchanged")
+    entry: DriftEntry = {"name": name, "change": change}
     if rd["changes"]:
         entry["fields"] = rd["changes"]
     return entry

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/commands/users.py

@@ -121,28 +121,33 @@ def get_user(ctx: click.Context, name: str) -> None:
 # --- roles sub-group ---
 
 
-@users_group.group("roles", invoke_without_command=True)
+@users_group.group("roles")
+@click.pass_context
+def roles_group(ctx: click.Context) -> None:
+    """Manage roles."""
+
+
+@roles_group.command("list")
 @list_options
 @click.pass_context
-def roles_group(
+def list_roles(
     ctx: click.Context,
     *,
     limit: int | None,
     offset: int,
     name_filter: str | None,
 ) -> None:
-    """Manage roles (bare invocation lists all roles)."""
-    if ctx.invoked_subcommand is None:
-        client = get_client(ctx)
-        roles = fetch_page(
-            client.service.roles.list,
-            limit=limit,
-            offset=offset,
-            name_filter=name_filter,
-        )
-        truncate = output.is_table(ctx)
-        rows = [_role_row(r, truncate=truncate) for r in roles]
-        output.render(ctx, rows, empty="No roles found.")
+    """List all roles."""
+    client = get_client(ctx)
+    roles = fetch_page(
+        client.service.roles.list,
+        limit=limit,
+        offset=offset,
+        name_filter=name_filter,
+    )
+    truncate = output.is_table(ctx)
+    rows = [_role_row(r, truncate=truncate) for r in roles]
+    output.render(ctx, rows, empty="No roles found.")
 
 
 @roles_group.command("get")

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl/skill/SKILL.md

@@ -118,7 +118,7 @@ connection, preserving lazy auth even for a blocked dry-run.
 
 Every list surface (`rules list`, `alerts list`, `dashboards list`,
 `indexes list`, `inputs list`, `lookups list`, `hec list`, `apps list`,
-`users list`, `users roles`, `parsers sourcetypes`, `parsers extractions`,
+`users list`, `users roles list`, `parsers sourcetypes`, `parsers extractions`,
 `search jobs`) accepts three uniform options:
 
 | Option | Meaning |
@@ -494,6 +494,7 @@ splunkctl conf files                        # list conf files
 splunkctl conf list macros                  # list stanzas in a conf file
 splunkctl conf list macros --app my_app     # scope to one app's stanzas
 splunkctl conf get macros my_macro          # full stanza config
+splunkctl conf get macros my_macro --app SES  # scope to one app
 splunkctl conf get macros my_macro --key definition  # one key only
 splunkctl conf set macros my_macro definition='index=main' --yes  # create/update
 splunkctl conf unset macros my_macro definition --yes  # clear a key (sets empty)
@@ -664,7 +665,7 @@ splunkctl users create --name newuser --password 'pass' \
 splunkctl users update newuser --roles 'user,power' --yes
 splunkctl users update newuser --password 'newpass' --yes
 splunkctl users delete newuser --yes
-splunkctl users roles                   # list all roles
+splunkctl users roles list               # list all roles
 splunkctl users roles get admin         # role details
 splunkctl users roles create --name myrole --imported-roles user \
     --capabilities 'search,list_inputs' --yes
@@ -927,7 +928,7 @@ splunkctl indexes list --json \
 
 ```bash
 splunkctl users list --json | jq '.[] | {name, roles, email}'
-splunkctl users roles --json | jq '.[] | {name, capabilities}'
+splunkctl users roles list --json | jq '.[] | {name, capabilities}'
 ```
 
 ### Periodic access recertification (RBAC attestation)

{splunkctl-0.4.0 → splunkctl-0.4.1}/splunkctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunkctl
-Version: 0.4.0
+Version: 0.4.1
 Summary: CLI tool for Splunk Enterprise SIEM operations.
 Author: dannyota
 License-Expression: Apache-2.0

{splunkctl-0.4.0 → splunkctl-0.4.1}/tests/test_version.py

@@ -4,4 +4,4 @@ from splunkctl import __version__
 
 
 def test_version() -> None:
-    assert __version__ == "0.4.0"
+    assert __version__ == "0.4.1"