splunk-pickaxe
splunk-pickaxe copied to clipboard
Support for Data Model objects
Reports created through the Pivot tool in Splunk cannot be synced with splunk-pickaxe because the Data Model object created by the Pivot tool isn't supported by splunk-pickaxe. If you save the report and attempt to upload it to another Splunk environment that doesn't already have the Data Model you get an error like
.gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:460:in `request_by_url': HTTP 400 Bad Request: (Splunk::SplunkHTTPError)
In handler 'savedsearch': Error in 'PivotProcessor': Error in 'DataModelEvaluator': Data model 'marathon_api_requests_by_agent' was not found.
from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:355:in `request'
from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/collection.rb:355:in `create'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:73:in `create'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:50:in `block in sync'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `each'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `sync'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/client.rb:28:in `sync_all'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/cli.rb:55:in `sync'
from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/command.rb:27:in `run'
from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/invocation.rb:126:in `invoke_command'
from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor.rb:369:in `dispatch'
from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/base.rb:444:in `start'
from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/bin/pickaxe:6:in `<top (required)>'
from .gem/ruby/2.3.1/bin/pickaxe:23:in `load'
from .gem/ruby/2.3.1/bin/pickaxe:23:in `<main>'
I think it would be a useful enhancement for splunk-pickaxe to be able to save and sync the Data Model objects.
Feel free to put out a PR and we can review it. I don't think I would be able to get to this