v2.0.0

querysplunk v2.0.0

This release turns querysplunk from a simple SPL-file runner into a more complete Splunk search CLI with structured YAML configs, safer job handling, richer diagnostics, and repeatable release packaging.

Highlights

Structured YAML search configs

querysplunk can now run searches from YAML config files with explicit fields for:

• Splunk app context
• output file
• execution mode
• dispatch parameters
• result parameters
• search log diagnostics

A starter config can be generated with:

querysplunk -write-config search.yml

Better Splunk job lifecycle handling

Search jobs now get clearer lifecycle handling, including state/progress logging, terminal-state errors, and remote cancellation when a local timeout or context cancellation occurs after a job has been created.

Search log diagnostics

The CLI can fetch and summarize search.log after a job completes. It reports warnings and errors found in the job log even when Splunk marks the job as DONE, which helps catch non-fatal execution problems that would otherwise be easy to miss.

Safer and more flexible result retrieval

This release adds configurable result endpoint selection:

• auto: try the v2 results endpoint first, then fall back to v1
• v2: force the v2 endpoint
• v1: force the v1 endpoint

It also adds streaming export mode for searches where writing results directly to disk is a better fit than creating and polling a normal search job.

Dispatch time bounds

Use -earliest and -latest for quick one-off dispatch bounds, or set dispatch.earliest_time and dispatch.latest_time in YAML. The CLI warns when a search appears to have no time bounds.

Health-check examples

The repo now includes example YAML searches under examples/health/ for common Splunk health checks, including splunkd health, scheduler status, internal warnings/errors, search concurrency, disk partitions, resource usage, and license warnings.

Live integration coverage

The GitHub Actions workflow now supports manual live Splunk integration runs. The integration path validates both the lower-level Splunk client and the CLI YAML config path using examples/health/splunkd-health.yml.

Release assets

Prebuilt binaries are attached for:

• macOS amd64
• macOS arm64
• Linux amd64
• Linux arm64
• Windows amd64

Use checksums.txt to verify downloaded assets.

Notable PRs

• #12 Add Splunk app context support and release automation
• #19 Improve Splunk job lifecycle diagnostics
• #20 Add structured YAML search config
• #21 Add dispatch time bound flags
• #22 Add configurable result endpoint selection
• #23 Add streaming export mode
• #24 Add Splunk health check example configs
• #25 Add live YAML config integration test
• #26 Refresh CLI documentation

Full changelog: v1.0.0...v2.0.0