Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lookup validation - Ignore local=true #82

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

0xC0FFEEEE
Copy link
Contributor

We've modified a couple of our Azure AD rules to use local=true as the ESCU searches fail on our cloud ES search head.

After converting our savedsearches.conf search back to YAML and running validation over the rules, contentctl complains that the local=true lookup doesn't exist. This simple change adds an an additional non-capture group to ignore this option.

@pyth0n1c
Copy link
Contributor

pyth0n1c commented Apr 5, 2024

I think we will have to make this (and the larger lookup matching regex) a bit more robust against reordering parameters: https://github.com/splunk/contentctl/pull/82/files#diff-4ade9637ffaa744323786af0102ad18f3f46ea560f36f867aba8cc66c05d171aR51
It will be a fairly complicated regex and will take a bit of experimentation. I'll reach out to someone on my team who is far better at regexes than I am to refine it :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants