cloudmarker / cloudmarker

90%

master: 84%

LAST BUILD ON BRANCH splunkfixes

branch: splunkfixes

CHANGE BRANCH

x

Reset

• splunkfixes
• 0.1.0
• alertdocs
• apidocindent
• audit-version
• auditemails
• azcloud
• azstorage
• azurecloud
• azurecloud-exception
• azvm_record_type
• azwebapp
• badges
• baseconfig
• bracket
• buckets
• build-matrix
• changelog
• clioptions
• clouderror
• common-plugins-config
• consistency
• copy-ext
• copyext
• cov_clean
• dependabot/pip/cryptography-3.3.2
• dependabot/pip/httplib2-0.18.0
• dependabot/pip/httplib2-0.19.0
• dependabot/pip/pyyaml-5.4
• dependabot/pip/rsa-4.7
• dependabot/pip/urllib3-1.26.5
• dist
• docfixes
• doctest-fix
• email_debug_param_from_config
• emailbody
• emaildocs
• empty-port
• esstore
• firewalleventtest
• firewallnorm
• firewallruleevent
• fix-esstore-done
• fix-unused-input-queue
• fix_cloud_worker
• fixbuild
• fixcoverage
• fixindent
• freeze
• gcpcloudlogs
• gcpcloudtest
• iam_policy
• ignore-virtual-machines
• ioworkers
• key_file_name_fix
• lint
• load_yaml_safely
• log
• logfixes
• logger-defaults
• logging-levels
• master
• maxrecs
• mock-records
• mockplugins
• mongodbdefaults
• mongodbfix
• mongodbtests
• multiprocessing
• pluginframework
• pluginloader
• readable-version
• readme
• remove-email-config
• removefirewallevent
• rename_logger
• renameparams
• requirements
• rest
• reuse-mock
• rm-venv
• slackalert
• smtpssl
• sphinx
• sphinx-rst-update
• splunkhecstore_docs
• splunkhectokentest
• splunkstore
• sub_id_rename
• tests
• travis
• userconfig
• userdoc
• userecordterm
• verdev
• webapp
• worker-com-fields
• worker-error-handling
• workerlogs

Build # 662

Build Type

Pull #116

travis-ci-com

Committed by web-flow

Commit Message

Do not post empty list of records to Splunk

Prior to this fix, when there are no records to index, SplunkHECStore
logs the following error:

    ERROR cloudmarker.stores.splunkhecstore:81 - Failed to index 0
    records; HTTP status code indicates error; URI:
    https://localhost:8088/services/collector; index: main; response
    status: 400; response content: {"text":"No data","code":5}

This error can be reproduced with a configuration like this where
`MockCloud` is configured to yield no records:

    plugins:
      mockcloud:
        plugin: cloudmarker.clouds.mockcloud.MockCloud
        params:
          record_count: 0

      splunkstore:
        plugin: cloudmarker.stores.splunkhecstore.SplunkHECStore
        params:
          uri: https://localhost:8088/services/collector
          token: token123
          index: main
          ca_cert: false

    audits:
      mockaudit:
        stores:
          - filestore
          - splunkstore
        alerts:
          - filestore
          - splunkstore

This fix ensures that when there are no records to index, no attempt is
made to post an empty list of records to Splunk.

Pull Request Pull Request #116: Make SplunkHECStore logs detailed and handle empty list of records

Run Details

328 of 374 branches covered (87.7%)

Branch coverage included in aggregate %.

28 of 28 new or added lines in 2 files covered. (100.0%)

1609 of 1771 relevant lines covered (90.85%)

2.73 hits per line