feat: namespace (owner+app) support and the full search lifecycle - #22
Merged
Conversation
Pointing SPLUNK_URL at the web UI (or any non-management port) made `server info` return all-null fields with exit 0. It now raises a usage error (exit 2) naming the likely cause. Also adds the unit coverage flagged in review and bumps the dev version: - tests for `_request` explicit-timeout passthrough and `_table` column union across heterogeneous rows (#19) - isolated CliRunner tests for the command adapters: server info, index list/get, api get (namespaced path), search run, health-check non-zero exit, and error-to-exit-code mapping (#20) - VERSION -> 0.2.0 with a CHANGELOG entry Closes #18 Closes #19 Closes #20
Adds the owner+app namespace foundation and completes the search surface (#3). Namespaces: - core/namespace.py: ns_path() builds /servicesNS/<owner>/<app>/...; resolve_ns() applies a safe policy -- reads default to the "-" wildcard, writes require an explicit app and never fall back to "search", write-owner defaults to "nobody". - Universal --app/--owner options (and SPLUNK_APP/SPLUNK_OWNER), resolved on Ctx with precedence flag > env > policy. Output surfaces app/owner/sharing. Search: - search list/get/cancel for the job lifecycle (core/jobs.py); cancel is gated. - search run --export streams from the export endpoint, bounded by --max-rows (parses newline-delimited JSON), so a caller cannot trigger an unbounded export. Saved searches (namespaced): - saved-search list/get/create/update/delete/run (core/saved_searches.py). update sends only changed fields (Splunk merges server-side); run dispatches the search and returns the new job's SID. Tests cover the namespace policy, job lifecycle, saved-search CRUD + dispatch, export parsing/bounding, and CLI smokes (52 passing total). README, CHANGELOG, and .env.example updated. Closes #3
This was referenced Jun 23, 2026
# Conflicts: # CHANGELOG.md # tests/unit/test_commands.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Owner's #1 priority for 0.2.0: makes Splunk namespaces first-class and
completes the search surface. Stacked on #21 (Phase 0).
Namespaces (owner + app)
core/namespace.py:ns_path()builds/servicesNS/<owner>/<app>/...;resolve_ns()applies a safe policy:-wildcard (every owner and app),searchapp, with owner defaulting tonobody.--app/--owneroptions (andSPLUNK_APP/SPLUNK_OWNER),resolved on
Ctxwith precedence flag > env > policy. These mirror Splunk'sown
-app/-owneruniversal parameters; the official field namesappand
ownerare used throughout, and output surfacesapp/owner/sharing.Search (#3)
search list/get/cancelfor the job lifecycle (core/jobs.py);cancelis a gated write.search run --exportstreams from the export endpoint (no job created),bounded by
--max-rows, parsing the newline-delimited JSON it returns — so acaller cannot trigger an unbounded export.
Saved searches (namespaced)
saved-search list/get/create/update/delete/run(
core/saved_searches.py).updatesends only the fields you pass (Splunkmerges server-side);
rundispatches the search and returns the new SID.Testing
ruff,pyright(0 errors), andpytest(52 passed, 1 integration skipped) allgreen. New tests cover the namespace policy, job lifecycle, saved-search CRUD +
dispatch, and export parsing/bounding. README, CHANGELOG, and
.env.exampleupdated.Note: stacked on #21 — review/merge that first, or review this diff against the
feat/phase-0-foundationbase.Closes #3