Skip to content
This repository has been archived by the owner on Jul 18, 2022. It is now read-only.

Splunk app eating forensics even if not successfully polled #132

Closed
wfg opened this issue May 11, 2021 · 0 comments
Closed

Splunk app eating forensics even if not successfully polled #132

wfg opened this issue May 11, 2021 · 0 comments
Assignees
Milestone

Comments

@wfg
Copy link
Collaborator

wfg commented May 11, 2021

except (requests.exceptions.RequestException, ValueError) as req_err:
logger.warning("Failed getting forensics for incidentID {} from profileID {}. Error: {}. Continuing.".format(incident["_id"], incident["profileID"], req_err))
continue

This continues which leads to another pop(0), erasing the incident with the error.

  • Add the incident back to the file for retry later
  • Add field for number of retry attempts
  • Log successful ingestions
@wfg wfg self-assigned this May 11, 2021
@wfg wfg added this to the May H1 milestone May 11, 2021
@wfg wfg closed this as completed in c88a822 May 12, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant