splunk / splunk/contentctl

Rule: 'Config' object has no attribute 'detection_configuration'

Open
#118 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Description

Hi team I am unable to deploy any content pack via api_deploy command. contentctl api_deploy will produces the following errors below. If I do contentctl build command and manually upload the output of dist it does installed on the splunk instance. Any reason for this error? Tested this on both splunk installed on windows machine and linux machine

Error deploying saved search ContentPack - Investigate Failed Logins for Multiple Destinations - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Network Traffic From src ip - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Okta Activity by app - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Okta Activity by IP Address - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Pass the Hash Attempts - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Pass the Ticket Attempts - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Previous Unseen User - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Successful Remote Desktop Authentications - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Suspicious Strings in HTTP Header - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate User Activities In Okta - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Web POSTs From src - Response Task: 'Config' object has no attribute 'detection_configuration'

image

Splunk Version
image

Config file

image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the contentctl api_deploy command and the reported Config object error; compare its behavior with the successful contentctl build path and the supplied config file. Reproduce the deployment on the stated Windows and Linux Splunk setups, with completion meaning the content pack installs without the detection_configuration error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.