All Apps and Add-ons

Splunk add-on Builder: Why does the add-on complains when using pretrained sourcetypes in saved searches?

charliesfx
Explorer

I have the following saved search in a Technology Add-on built with the add on builder:
sourcetype=access_combined | stats count as metric_value by method, host

When I run the splunk add-on builder's validation, it warns against using underscores in sourcetype.

Is there a way to alias the access_combined source type to a name that will pass validation, but will still preserve the access_combined source type. Or is there a way to escape the _ so that validation won't complain?

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

I believe Add-on builder uses the naming convention of using ":", e.g. vendor:mysourcetype, so it could complain. ]
In your props.conf, you could try something like to force to use rename [ not a good practice]
[access:combined]
rename = access_combined

View solution in original post

0 Karma

chli_splunk
Splunk Employee
Splunk Employee

I'm not sure what is "pretrained" sourcetype. Is it provided by Splunk? So you create an add-on without any data input & field extraction s but only saved search?
Firstly the best practice is from Splunk Add-on factory rather than AoB. AoB never creates any rules. That's the best practice how Splunk build add-ons in recent 4 years, and AoB helps your add-ons look like more "Splunk".
Secondly AoB is used to validate new sourcetypes you created in your case. If you are not the owner of the sourcetypes, please just ignore this warning, since it's not an error. Thanks.

0 Karma

charliesfx
Explorer

I'm trying to write searches against the built in "pretrained" source types. Almost all of the splunk pretrained sourcetypes have "_" in the name. Renaming is destructive beyond the plugin so I don't want to do that either. It seems odd that the built in source types directly contradict an add on builder "best practice".

0 Karma

chli_splunk
Splunk Employee
Splunk Employee

Yes this is just a naming rule of sourcetypes: use ":" instead of "_". If it's a legacy add-on, please ignore this warning since your data already indexed, or rename it in stanza as @lakshman239 mentioned

0 Karma

lakshman239
SplunkTrust
SplunkTrust

I believe Add-on builder uses the naming convention of using ":", e.g. vendor:mysourcetype, so it could complain. ]
In your props.conf, you could try something like to force to use rename [ not a good practice]
[access:combined]
rename = access_combined

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...