Developing for Splunk Platform

Why does slim validate complain about undefined setting python.version even though it is valid?

citruz
Loves-to-Learn

Hi,

I am trying to use the slim utility for validating and packaging my app. When running slim validate, it complains about undefined setting python.version in alert_actions.conf even though it is clearly documented:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Alertactionsconf

Did I miss something?

 

slim validate: Validating app at "<My App name>"...
slim validate: [WARNING] /path/to/<My App name>/default/alert_actions.conf, line 2: Undefined setting in stanza [default]: python.version

 

 

Labels (3)
Tags (1)
0 Karma

thehappydinoa
Loves-to-Learn

I am still experiencing this same issue, does anyone have any ideas for this? I think we may be able to do something with in the `README/input.conf.spec`? But any guidance would be much appreciated

Tags (3)
0 Karma

mcmaster
Communicator

Hey there!

There's no official solution right now, probably the best course of action for now is to follow the recommendation of updating the spec files within the slim installation path. This is a currently known issue but there's no ETA on a fix.

Hope this helps.

0 Karma

thehappydinoa
Loves-to-Learn

Hey, I was actually able to fix it by adding the following lines to the `Splunk_TA_my_addon/README/input.conf.spec`. Then I stopped getting that warning from slim.

```

[my_input://<name>]
# ... my other values
start_by_shell = <bool>
python.version = <string>
interval = <integer>

```

 

0 Karma

malvidin
Communicator

No, you didn't miss anything.

The splunk-packaging-toolkit (slim), splunk-appinspect, and the Splunk Python SDK are not perfectly aligned yet.

If you want slim to work better, you could update the files in ./venv/Lib/site-packages/slim/config/conf-specs/*.conf.spec to what you find in your target Splunk version's config files. If you don't have a Splunk installation, replace commands.conf.spec and others with a current version from Splunk docs (https://docs.splunk.com/Documentation/Splunk/Latest/Admin/Commandsconf#commands.conf.spec). 

Some of the other issues I've seen:

  • Options must be provided before the command documented slim options may not exist (e.g. --quiet)
  • Python SDK doesn't pass splunk-appinspect 
  • splunk-appinspect and slim raise conflicting errors
  • no slim option to set the location of inspect.yml
  • no option to return a non-zero code if any validations fail in splunk-appinspect or slim 

I'd recommend packaging the app with slim and using splunk-appinspect  to validate, rather than using the validation in slim.

0 Karma

citruz
Loves-to-Learn

Just to add to the list of issues:

Slim and AppInspect cannot even be installed in the same venv because the former depends on future>=0.18.2 while the latter depends on future==0.17.1

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...