Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Scripted input support requirement test #442

Merged
merged 2 commits into from Nov 11, 2021

Conversation

nandinivij
Copy link
Contributor

@nandinivij nandinivij commented Nov 2, 2021

Please review following changes -

  • Transport type- scripted input support added for requirement test
  • Addon used for UF transport type is also utilized to test scripted input.
  • Added test_splunk_app_requirements_scripted for scripted input type
  • Uses HecRawEventIngestor class to ingest data

@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2021

Expected release notes (by @nandinivij)

features:
Scripted input support requirement test (ed3ee93)

others (will not be included in Semantic-Release notes):
b76294e added transport type file monitor

  • I hereby acknowledge these release notes are 🥙 AWESOME 🥙

@@ -162,6 +162,25 @@ def get_events(self):
LOGGER.info(
f"sending data transport_type:forwarder/uf_file_monitor filename:{filename} "
)
elif transport_type in (
"scripted_input",
"scripted input",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we have "scripted input" and "scripted_input"?
How are transport type values decided?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In requirement files we specify transport types- there are these two common variations in existing logs.
Transport type values are added by the dev team to requirement logs based on the ingestion type of the log in the addon

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we accept only 1 one of them?
Not to create options where we do not need to.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we will document only 1 version so that we don't use others in the future, but we are allowing multiple versions to avoid going back and changing existing log files. It is the case with modinput too

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nandinivij Can we ensure we document official usage for input types which is sync with PSA input types?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also just for a record are there too many addons which use variations if not we can have them to use same version and ensure consistency and remove unwanted support from here? Do we have a list?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bhargav-nariyani-crest I understand the concern, but this is beyond the scope of this PR. The logs exist before we supported them to work with the requirement test. These are lexical variations and this is to facilitate requirement test work without changing existing logs.
This does not change the transport type we are using in PSA it is the defined transport type in the requirement log.

<transport type="scripted input" host="sample_host" source="Unix:Service" sourcetype ="Unix:Service" />

Created a Jira to eliminate various variations in transport type from TA'sADDON-44372

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @nandinivij .

@nandinivij nandinivij merged commit 1756fc8 into main Nov 11, 2021
@nandinivij nandinivij deleted the req_test/scripted_input branch November 11, 2021 15:17
@github-actions github-actions bot locked and limited conversation to collaborators Nov 11, 2021
@ryanfaircloth
Copy link
Contributor

🎉 This PR is included in version 1.11.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants