Validating a Splunk App: Undefined setting in transforms.conf, stanza: INGEST_EVAL

[wowbaggerHU]

Hello Everyone,

I am at the stage of considering to submit a Splunk app to SplunkBase, and before submitting our code, I am running validation steps via `slim validate`:

docker run --volume /home/USER/Development/WORK/SPLUNK-ingest/splunk-app:/apps slim-pip:latest slim package /apps/APP_NAME
slim package: Packaging app at "/apps/APP_NAME"
slim package: [WARNING] /apps/APP_NAME/default/app.conf, line 12: Undefined setting in app.conf, stanza [ui]: supported_themes
slim package: [WARNING] /apps/APP_NAME/default/transforms.conf, line 30: Undefined setting in transforms.conf, stanza [all_in_one]: INGEST_EVAL
slim package: [WARNING] /apps/APP_NAME/default/transforms.conf, line 33: Undefined setting in transforms.conf, stanza [syslog_octet_count]: INGEST_EVAL
slim package: [WARNING] /apps/APP_NAME/default/transforms.conf, line 36: Undefined setting in transforms.conf, stanza [octet_count_prepend]: INGEST_EVAL
slim package: [WARNING] /apps/APP_NAME/default/transforms.conf, line 39: Undefined setting in transforms.conf, stanza [discard_empty_msg]: INGEST_EVAL
slim package: [WARNING] /apps/APP_NAME/default/transforms.conf, line 42: Undefined setting in transforms.conf, stanza [discard_internals]: INGEST_EVAL
slim package: [INFO] Source package exported to "/apps/APP_NAME-0.7.1.tar.gz"
docker run --volume /home/USER/Development/WORK/SPLUNK-ingest/splunk-app:/apps slim-pip:latest slim validate /apps/APP_NAME-0.7.1.tar.gz
slim validate: Validating app at "/apps/APP_NAME-0.7.1.tar.gz"...
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/app.conf, line 12: Undefined setting in app.conf, stanza [ui]: supported_themes
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/transforms.conf, line 30: Undefined setting in transforms.conf, stanza [all_in_one]: INGEST_EVAL
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/transforms.conf, line 33: Undefined setting in transforms.conf, stanza [syslog_octet_count]: INGEST_EVAL
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/transforms.conf, line 36: Undefined setting in transforms.conf, stanza [octet_count_prepend]: INGEST_EVAL
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/transforms.conf, line 39: Undefined setting in transforms.conf, stanza [discard_empty_msg]: INGEST_EVAL
slim validate: [WARNING] /root/.config/slim/repository/slim.cache_xndmoh9d/APP_NAME-0.7.1.source/APP_NAME/default/transforms.conf, line 42: Undefined setting in transforms.conf, stanza [discard_internals]: INGEST_EVAL
slim validate: [INFO] App validation complete

 What may be the reason of `slim validate` complaining about `INGEST_EVAL`? On my 9.2.1+ Splunk instance that I tested the app with, seem to work fine as is.
Any ideas?

[livehybrid · Accepted solution]

Hi @wowbaggerHU 

Unfortunately the SLIM packaging toolkit hasnt been updated with the latest spec files, they are from 2017! therefore they dont have some of the latest settings in place for validation such as INGEST_EVAL. 

This forked version of the repo tool shows the transforms.conf spec which is in use for the slim tool: https://github.com/khulnasoft/khulnasoft-packaging-toolkit/blob/master/slim/config/conf-specs/transf... 

If you really wanted to you could overwrite the spec files in your local instance of slim, or you could ignore the INGEST_EVAL errors (which is what I do!)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[wowbaggerHU]

@livehybrid Thanks for the suggestion and help!
I opted for the hard way: I have updated the necessary spec files, and the Dockerfile that I have in place for building slim.
It works now as expected!