Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lookup validation - Ignore local=true #82

Closed
wants to merge 3 commits into from

Conversation

0xC0FFEEEE
Copy link
Contributor

We've modified a couple of our Azure AD rules to use local=true as the ESCU searches fail on our cloud ES search head.

After converting our savedsearches.conf search back to YAML and running validation over the rules, contentctl complains that the local=true lookup doesn't exist. This simple change adds an an additional non-capture group to ignore this option.

@pyth0n1c
Copy link
Contributor

pyth0n1c commented Apr 5, 2024

I think we will have to make this (and the larger lookup matching regex) a bit more robust against reordering parameters: https://github.com/splunk/contentctl/pull/82/files#diff-4ade9637ffaa744323786af0102ad18f3f46ea560f36f867aba8cc66c05d171aR51
It will be a fairly complicated regex and will take a bit of experimentation. I'll reach out to someone on my team who is far better at regexes than I am to refine it :)

@pyth0n1c
Copy link
Contributor

This has turned into a much larger PR than I originally thought. We will work towards supporting things like reordering, inputlookup, and outputlook as well.
As such, I am closing this one out in favor of the new one: #274

@pyth0n1c pyth0n1c closed this Aug 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants