feat: admin breadth via the registry/factory (inputs, outputs, knowledge objects, more) - #25
Merged
Merged
Conversation
…dge, more) Adds 14 admin resources as registry data -- no new imperative code -- using the Phase 3 factory. Advances #5, #6, #8, #9, #10. - Inputs/outputs (#6): monitor, tcp, udp, and scripted inputs; HEC tokens; and forwarder output servers and groups (all with enable/disable). - Knowledge objects (#8, namespaced): search macros, event types, field extractions, lookup definitions. - KV Store (#9): collection schemas (dynamic field.<name> types via --set). - Platform (#10): system bulletin messages. - Apps (#5): app lifecycle (list/get/delete/enable/disable). The hand-write remainder is noted in the registry: HEC token rotation, tags, data models, lookup-file upload, KV Store data records, platform cluster/restart actions, and app install-from-file/URL. Tests add namespaced-factory smokes (macro create requires --app and previews the /servicesNS path) and a global input-group smoke. 75 passing. Refs #5 Refs #6 Refs #8 Refs #9 Refs #10
This was referenced Jun 23, 2026
Every typed Field and out_map in the registry was a copy of a Splunk setting name -- a copy that drifts silently when Splunk changes and that no one tells us about. Delete them. Specs are now path-only (plus verbs/ namespacing); writes go through the generic --set KEY=VALUE and Splunk validates server-side, so the CLI is always current with the running version. The one kept field is the user password (secret, env-only, never a flag). Output now passes Splunk's keys through as-is. Also add a Keep-a-Changelog markdownlint config (MD024 siblings_only) so repeated version section headings are allowed.
JacobPEvans-personal
added a commit
that referenced
this pull request
Jun 23, 2026
## Summary Pins the **frozen, additive-only public contract** that scripts, AI agents, and the future API-Gateway/Lambda backend depend on. Stacked on #25. ## What it guards - **Exit codes** — the `SplunkError` subclass constants (0/1/2/3/4) match the documented table; they cannot drift. - **Success envelope** — `--output json` stdout parses as JSON with `data` + `meta`. - **Error envelope** — failures are `{"error": {"code", "message"}}` with the documented `code` (e.g. `not_found` on a 404, exit 4). - **Prompt-injection safety** — a malicious-looking result body never drives an extra request: a search is exactly one POST regardless of the response text. The README now states the contract is **additive-only** — fields and codes may be added over time, never renamed or removed — so the surface stays a versioned API. ## Testing `ruff`, `pyright` (0 errors), `pytest` (79 passed, 1 integration skipped) green. Stacked on #25 — review against the `feat/phase-4-admin-breadth` base. Closes #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds 14 admin resources as registry data — no new imperative code — using the
Phase 3 factory. Advances #5, #6, #8, #9, #10. Stacked on #24.
What landed (factory-generated groups)
monitor-input,tcp-input,udp-input,script-input,hec-token,output-server,output-group— all withenable/disable.macro,eventtype,extraction,lookup-definition— writes require an explicit--app(neversearch).kvstore-collectionschemas (dynamicfield.<name>=<type>via
--set).message(system bulletin).applifecycle (list/get/delete/enable/disable).The CLI now exposes 23 command groups; each new resource is ~6 lines of
Spec.Hand-write remainder (noted in the registry, tracked on the issues)
HEC token rotation, tags, data models, lookup-file upload, KV Store data records
(a document store), platform cluster/restart/peer actions, and app
install-from-file/URL (multipart). These do not fit the CRUD shape and stay
hand-written in later work.
Why "Refs", not "Closes"
The REST paths here are from the official 10.x reference but are not yet
validated against a live Splunk — that happens in the Dockerized CI integration
(#14). I have left the issues open for that confirmation and the hand-write
remainder; close them when satisfied.
Testing
ruff,pyright(0 errors),pytest(75 passed, 1 integration skipped) green.New smokes: namespaced factory write requires
--appand previews the/servicesNS/...path; a global input group lists. Adding aSpecadds no testburden — the engine is already covered.
Stacked on #24 — review against the
feat/phase-3-registry-factorybase.Refs #5, #6, #8, #9, #10