pe_event_forwarding will soon have the ability to disable rbac event
collection for performance reasons. The is denoted in the index file
with a -1 value. We need to cover the case where rbac events are
enabled in splunk_hec but disabled in pe_event_forwarding. This check
will skip indicies with negative values.
Summary
Detailed Description
Checklist
[ ] Draft PR?
[ ] Ensure README is updated
[ ] Any changes to existing documentation
[ ] Anything new added
[ ] Link to external Puppet documentation
[ ] Review Support Playbook for any needed updates
[ ] Tags
[ ] Unit Tests
[ ] Acceptance Tests
[ ] PR title is "(Ticket|Maint) Short Description"
[ ] Commit title matches PR title
pe_event_forwarding will soon have the ability to disable rbac event collection for performance reasons. The is denoted in the index file with a -1 value. We need to cover the case where rbac events are enabled in splunk_hec but disabled in pe_event_forwarding. This check will skip indicies with negative values.
Summary
Detailed Description
Checklist
[ ] Draft PR? [ ] Ensure README is updated [ ] Any changes to existing documentation [ ] Anything new added [ ] Link to external Puppet documentation [ ] Review Support Playbook for any needed updates [ ] Tags [ ] Unit Tests [ ] Acceptance Tests [ ] PR title is "(Ticket|Maint) Short Description" [ ] Commit title matches PR title