Splunk-Apps icon indicating copy to clipboard operation
Splunk-Apps copied to clipboard

Specfile inputs.conf.spec from Splunk_TA_paloalto contains parameter with invalid characters

Open mflpopescu opened this issue 4 years ago • 1 comments

Describe the bug

Parameter python.version in file in file inputs.conf.spec is not valid name as it doesn't match validation regex ([0-9a-zA-Z][0-9a-zA-Z_-]*) . This leads to warnings in splunkd.log

12-28-2021 10:46:22.765 +0100 WARN  SpecFiles - Found parameter "python.version" inside "/apps/Splunk_TA_paloalto/README/inputs.conf.spec", scheme "iot_security://", but this parameter will be ignored as it does not contain the correct sequence of characters (a parameter name must match the regex "([0-9a-zA-Z][0-9a-zA-Z_-]*)".

Expected behavior

The TA should be shipped with a valid spec file that does not cause warnings. inputs.conf.spec should contain parameters with valid names

Current behavior

Invalid parameter names in inputs.conf.spec fail regex validation and leads to warnings in splunkd.log

Steps to reproduce

  1. install the TA on an indexer
  2. look for SpecFiles warnings in index _internal

Your Environment

PaloAlto TA version 7.0.1 Splunk version 8.1.6

mflpopescu avatar Dec 28 '21 10:12 mflpopescu

:tada: Thanks for opening your first issue here! Welcome to the community!