The Splunk schema extension repository
splunk / addonfactory-splunk-conf-parser-lib Goto Github PK
View Code? Open in Web Editor NEWLibrary to parse Splunk-specific .conf files.
License: Apache License 2.0
Library to parse Splunk-specific .conf files.
License: Apache License 2.0
When working with long searches with joins, it can be useful to indent subsearches to make it easier to follow the search:
index=foo
| join type=outer my_field [|makeresults
| eval thing="a"
| eval another_thing="b"]
| table my_field thing another_thing
The above example, when parsed by the module, loses all indentation leaving you with
index=foo
| join type=outer my_field [|makeresults
| eval thing="a"
| eval another_thing="b"]
| table my_field thing another_thing
Would there be any way for this module to support this sort of indentation?
Hello,
with help of this library i've created simple script to validate conf files:
import addonfactory_splunk_conf_parser_lib as conf_parser
import os
import argparse
def check_syntax(filename):
parser = conf_parser.TABConfigParser()
try:
with open(filename, 'r') as f:
parser.read_file(f)
print(f"Syntax of the file '{filename}' is correct.")
except conf_parser.Error as e: # Catching all configparser errors with a generic class
print(f"Syntax error in file '{filename}': {e}")
except FileNotFoundError:
print(f"File '{filename}' not found.")
except Exception as e:
print(f"An unexpected error occurred in file '{filename}': {e}")
def scan_directory_for_conf_files(directory):
for root, dirs, files in os.walk(directory):
for file in files:
if file.endswith('.conf'):
file_path = os.path.join(root, file)
check_syntax(file_path)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Syntax checker for .conf files.')
parser.add_argument('dir_path', type=str, help='Path to direcory to scan')
args = parser.parse_args()
# Determine the operation to perform
if args.dir_path:
scan_directory_for_conf_files(args.dir_path)
else:
directory_to_scan = input("Enter the directory path to scan for .conf files: ")
scan_directory_for_conf_files(directory_to_scan)
and in that script when file has syntax error - it thinks that all good.
example:
as you see, empty space is there, but it should be wiped.
Add support for new versions of python
Example:
[stanza_with_something]
key = value
[empty_stanza]
Reproduce:
import addonfactory_splunk_conf_parser_lib as conf_parser
conf = """
[stanza_with_something]
key = value
[empty_stanza]
"""
parser = conf_parser.TABConfigParser()
parser.read_string(conf)
print(parser.item_dict())
Current behaviour:
{'stanza_with_something': {'key': 'value'}}
Potential (?) behaviour:
{'empty_stanza': {}, 'stanza_with_something': {'key': 'value'}}
The main issue is again with splunk not obeying python conf file standard. The basic config parser requires that In a multiple line value, an indentation is needed at the beginning of all the following lines.
I have tried to use this conf file parser with no success. It can't even parse config file db_inputs.conf from the db connect app.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.