Kintyre / ksconf

Kintyre's Splunk Configuration tool
Apache License 2.0
50 stars 13 forks source link

Ksconf promote doesn't handle empty stanzas correctly #78

Closed lowell80 closed 3 years ago

lowell80 commented 3 years ago

The problem

Attempting to promote an empty stanza can result in the target stanza having content removed. This is undesirable. Likely due to 0.7.9 bug fixed where empty stanzas where previously ignored.

Environment

Details

Steps To Reproduce Issue

Example local/eventtypes.conf:

[existing-eventtype]

[new-eventtype]
search = some terms to search for

Example default/eventtypes.conf

[existing-eventtype]
search = sourcetype=mysourcetype

Command:

ksconf promote local/eventtypes.conf default -i
-[existing-eventtype]
-search = sourcetype=mysourcetype

+[existing-eventtype]

Apply [existing-eventtype] (y/n) n
+[new-eventtype]
+search = some terms to search for

Apply [new-eventtype] (y/n) n

Note that search = sourcetype=mysourcetype is shown for removal. This is incorrect. If applied, the values from default are removed, just as the preview/diff suggests.

lowell80 commented 3 years ago

Fixed in d811597