splunk / addonfactory-splunk-conf-parser-lib

Library to parse Splunk-specific .conf files.

Splunk OCSF Extension

The Splunk schema extension repository

addonfactory-splunk-conf-parser-lib's Issues

Parser doesn't preserve multi-line search indentation

When working with long searches with joins, it can be useful to indent subsearches to make it easier to follow the search:

index=foo
| join type=outer my_field [|makeresults
  | eval thing="a"
  | eval another_thing="b"]
| table my_field thing another_thing

The above example, when parsed by the module, loses all indentation leaving you with

index=foo
| join type=outer my_field [|makeresults
| eval thing="a"
| eval another_thing="b"]
| table my_field thing another_thing

Would there be any way for this module to support this sort of indentation?

Library doesn't detect syntax issues in conf files.

Hello,

with help of this library i've created simple script to validate conf files:

import addonfactory_splunk_conf_parser_lib as conf_parser
import os
import argparse

def check_syntax(filename):
    parser = conf_parser.TABConfigParser()
    try:
        with open(filename, 'r') as f:
            parser.read_file(f)
        print(f"Syntax of the file '{filename}' is correct.")
    except conf_parser.Error as e:  # Catching all configparser errors with a generic class
        print(f"Syntax error in file '{filename}': {e}")
    except FileNotFoundError:
        print(f"File '{filename}' not found.")
    except Exception as e:
        print(f"An unexpected error occurred in file '{filename}': {e}")

def scan_directory_for_conf_files(directory):
    for root, dirs, files in os.walk(directory):
        for file in files:
            if file.endswith('.conf'):
                file_path = os.path.join(root, file)
                check_syntax(file_path)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Syntax checker for .conf files.')
    parser.add_argument('dir_path', type=str, help='Path to direcory to scan')

    args = parser.parse_args()

    # Determine the operation to perform
    if args.dir_path:
        scan_directory_for_conf_files(args.dir_path)
    else:
        directory_to_scan = input("Enter the directory path to scan for .conf files: ")
        scan_directory_for_conf_files(directory_to_scan)

and in that script when file has syntax error - it thinks that all good.

example:

as you see, empty space is there, but it should be wiped.

and it passes wrong multine search:

python multi version support

Add support for new versions of python

`item_dict` does not return a stanza if it's empty

Example:

[stanza_with_something]
key = value

[empty_stanza]

Reproduce:

import addonfactory_splunk_conf_parser_lib as conf_parser

conf = """
[stanza_with_something]
key = value

[empty_stanza]
"""
parser = conf_parser.TABConfigParser()
parser.read_string(conf)
print(parser.item_dict())

Current behaviour:

{'stanza_with_something': {'key': 'value'}}

Potential (?) behaviour:

{'empty_stanza': {}, 'stanza_with_something': {'key': 'value'}}

Doesn't parse db_inputs.conf from the db connect app.

The main issue is again with splunk not obeying python conf file standard. The basic config parser requires that In a multiple line value, an indentation is needed at the beginning of all the following lines.

I have tried to use this conf file parser with no success. It can't even parse config file db_inputs.conf from the db connect app.