contentctl
contentctl copied to clipboard
Add import command
This PR adds support for importing updated searches from an existing savedsearches.conf.
contentctl -p <path_to_content> import -c <path_to_savedsearches.conf>
For the sake of simplicity I opted to read the detection rules, update the search string and write the updated yml back. Whilst it's not perfect, at the very least it's idempotent and only updates detections with updated searches.
I'd value any feedback or contributions (from Splunk and customers) for the next round of updates to this feature branch 🙂
Updated to use YmlReader and YmlWriter, do some cleanup of imports and add some useful console output.
Unfortunately, we have sat on this PR for a long time and there are a number of other changes we'd like to make to support it. There have been huge changes to the contentctl codebase in that time. As such, I am going to close this PR, but have opened an issue to track this as a requested feature and linked back to this PR for visibility (and so that we have a clear record of the implementation work that's already been done).
Linked issue for tracking: https://github.com/splunk/contentctl/issues/275