7
3%
master: 3%

Ran 08 Mar 2017 06:34AM UTC

Files 344

Run time 18s

Badge

Embed ▾

Committed 08 Mar 2017 05:48AM UTC coverage: 90.747% (+0.03%) from 90.721%

Job # TEST_SUITE=backend

Build Type

push

travis-ci

Committed by Tim Abbott

Commit Message

Add a Splunk webhook integration.

Add a webhook to create messages from Splunk search alerts. The search
alert JSON includes the first search result and a link to view the full
results. The following fields are used:

* search_name - the name of the saved search
* results_link - URL of the full search results
* host - the host the search result came from
* source - the source file on that host
* _raw - the raw text of the logged event.

The Zulip message contains:
* search name
* host
* source
* raw

The destination stream and message topic are configurable: the default
stream is "splunk" and the default topic "Splunk Alert". If the topic is
not provided in the URL, the search name is used instead (truncated if too
long. If a needed field is missing, a default value is used instead.

Example: "Missing source"

It is possible to configure a Splunk search to not include some values,
so I've provided defaults rather than return an error for missing data.
In practice, these fields are unlikely to be deliberately suppressed.

Note: alerts are only available for Splunk servers using a valid trial,
developer, or paid license.

I've added tests for the normal case of one search result, the topic from
the search name, and for a search missing one of the fields used. Tested
using Splunk Enterprise 6.5.1.

Fixes #3477

Run Details

28126 of 30994 relevant lines covered (90.75%)

0.91 hits per line

zulip / zulip / 13614 / 7
3%
master: 3%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 13614.7 (TEST_SUITE=backend)

zulip / zulip / 13614 / 7 3% master: 3%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 13614.7 (TEST_SUITE=backend)

zulip / zulip / 13614 / 7
3%
master: 3%

README BADGES
x