Skip to content
This repository was archived by the owner on Feb 26, 2024. It is now read-only.
This repository was archived by the owner on Feb 26, 2024. It is now read-only.

Support for Data Model objects #14

@willgorman

Description

@willgorman

Reports created through the Pivot tool in Splunk cannot be synced with splunk-pickaxe because the Data Model object created by the Pivot tool isn't supported by splunk-pickaxe. If you save the report and attempt to upload it to another Splunk environment that doesn't already have the Data Model you get an error like

.gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:460:in `request_by_url': HTTP 400 Bad Request:  (Splunk::SplunkHTTPError)
 In handler 'savedsearch': Error in 'PivotProcessor': Error in 'DataModelEvaluator': Data model 'marathon_api_requests_by_agent' was not found.
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:355:in `request'
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/collection.rb:355:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:73:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:50:in `block in sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `each'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/client.rb:28:in `sync_all'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/cli.rb:55:in `sync'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/command.rb:27:in `run'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/invocation.rb:126:in `invoke_command'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor.rb:369:in `dispatch'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/base.rb:444:in `start'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/bin/pickaxe:6:in `<top (required)>'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `load'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `<main>'

I think it would be a useful enhancement for splunk-pickaxe to be able to save and sync the Data Model objects.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions