splunk / splunk/contentctl

Error: This detection is required to have 2 drilldown_searches, but only has [0]

Open
#312 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Description

Hi, I updated contentctl to 4.4.0 from 4.2.2, and I now have brand new errors. One of them is:

This detection is required to have 2 drilldown_searches, but only has [0]

When I run contentctl test --enable-integration-testing --verbose mode:all.

I tried searching for documentation and found nothing. I checked source code, this error comes from this commit 9ba93009 which states

Add the possibility to automatically create drilldowns. We will likely remove this, but let's keep it now for purposes of discussion.

Since the commit message says "the possibility", this seems to imply that enforcing this is a mistake?

In any case I'm very lost and don't know how to deal with this error. Some documentation and/or guidance would be appreciated :)

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the contentctl test --enable-integration-testing --verbose mode:all command and inspect commit 9ba93009, which introduced automatic drilldowns. Trace where the drilldown_searches count is checked for detections, then determine whether the behavior is intentional. Done means documenting the expected configuration or recording a confirmed correction for the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.