cloudmarker / cloudmarker / 667

84%

push

travis-ci-com

Do not post empty list of records to Splunk

Prior to this fix, when there are no records to index, SplunkHECStore
logs the following error:

    ERROR cloudmarker.stores.splunkhecstore:81 - Failed to index 0
    records; HTTP status code indicates error; URI:
    https://localhost:8088/services/collector; index: main; response
    status: 400; response content: {"text":"No data","code":5}

This error can be reproduced with a configuration like this where
`MockCloud` is configured to yield no records:

    plugins:
      mockcloud:
        plugin: cloudmarker.clouds.mockcloud.MockCloud
        params:
          record_count: 0

      splunkstore:
        plugin: cloudmarker.stores.splunkhecstore.SplunkHECStore
        params:
          uri: https://localhost:8088/services/collector
          token: token123
          index: main
          ca_cert: false

    audits:
      mockaudit:
        stores:
          - filestore
          - splunkstore
        alerts:
          - filestore
          - splunkstore

This fix ensures that when there are no records to index, no attempt is
made to post an empty list of records to Splunk.

328 of 374 branches covered (87.7%)

Branch coverage included in aggregate %.

1609 of 1771 relevant lines covered (90.85%)

2.73 hits per line