Skip to content
This repository was archived by the owner on Feb 26, 2024. It is now read-only.
This repository was archived by the owner on Feb 26, 2024. It is now read-only.

Support for Data Model objects #14

Description

@willgorman

Reports created through the Pivot tool in Splunk cannot be synced with splunk-pickaxe because the Data Model object created by the Pivot tool isn't supported by splunk-pickaxe. If you save the report and attempt to upload it to another Splunk environment that doesn't already have the Data Model you get an error like

.gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:460:in `request_by_url': HTTP 400 Bad Request:  (Splunk::SplunkHTTPError)
 In handler 'savedsearch': Error in 'PivotProcessor': Error in 'DataModelEvaluator': Data model 'marathon_api_requests_by_agent' was not found.
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/context.rb:355:in `request'
        from .gem/ruby/2.3.1/gems/splunk-sdk-ruby-1.0.5/lib/splunk-sdk-ruby/collection.rb:355:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:73:in `create'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:50:in `block in sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `each'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/objects.rb:29:in `sync'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/client.rb:28:in `sync_all'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/lib/splunk/pickaxe/cli.rb:55:in `sync'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/command.rb:27:in `run'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/invocation.rb:126:in `invoke_command'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor.rb:369:in `dispatch'
        from .gem/ruby/2.3.1/gems/thor-0.19.4/lib/thor/base.rb:444:in `start'
        from .gem/ruby/2.3.1/gems/splunk-pickaxe-2.4.0/bin/pickaxe:6:in `<top (required)>'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `load'
        from .gem/ruby/2.3.1/bin/pickaxe:23:in `<main>'

I think it would be a useful enhancement for splunk-pickaxe to be able to save and sync the Data Model objects.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions