splunk-pickaxe icon indicating copy to clipboard operation
splunk-pickaxe copied to clipboard

Support for Data Model objects

Open willgorman opened this issue 6 years ago • 1 comments

Reports created through the Pivot tool in Splunk cannot be synced with splunk-pickaxe because the Data Model object created by the Pivot tool isn't supported by splunk-pickaxe. If you save the report and attempt to upload it to another Splunk environment that doesn't already have the Data Model you get an error like

.gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:460:in `request_by_url': HTTP 400 Bad Request:  (Splunk::SplunkHTTPError)
 In handler 'savedsearch': Error in 'PivotProcessor': Error in 'DataModelEvaluator': Data model 'marathon_api_requests_by_agent' was not found.
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:355:in `request'
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/collection.rb:355:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:73:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:50:in `block in sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `each'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/client.rb:28:in `sync_all'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/cli.rb:55:in `sync'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/command.rb:27:in `run'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/invocation.rb:126:in `invoke_command'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor.rb:369:in `dispatch'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/base.rb:444:in `start'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/bin/pickaxe:6:in `<top (required)>'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `load'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `<main>'

I think it would be a useful enhancement for splunk-pickaxe to be able to save and sync the Data Model objects.

willgorman avatar Mar 27 '18 19:03 willgorman

Feel free to put out a PR and we can review it. I don't think I would be able to get to this

bbaugher avatar Mar 27 '18 20:03 bbaugher