Skip to content

Feature/cross file validation#171

Open
jtgreen86 wants to merge 4 commits into
splunk:masterfrom
jtgreen86:feature/cross-file-validation
Open

Feature/cross file validation#171
jtgreen86 wants to merge 4 commits into
splunk:masterfrom
jtgreen86:feature/cross-file-validation

Conversation

@jtgreen86

Copy link
Copy Markdown

What this adds

Cross-file validation for Splunk .conf files: catches broken references between related configuration files before deployment. These issues are syntactically valid but cause silent runtime failures or unexpected behavior in production.

Problems it catches

  • Broken transform references (e.g. REPORT-foo = my_transform in props.conf but [my_transform] doesn't exist in transforms.conf)
  • Missing lookup files (e.g. filename = users.csv in transforms.conf but the file doesn't exist in lookups/)
  • Invalid index references (e.g. index = custom_index but the index isn't defined in indexes.conf)
  • Undefined sourcetypes (data inputs with sourcetypes that have no parsing rules defined)
  • Orphaned configurations (transform stanzas that are defined but never referenced)

Files added

File Purpose
out/crossFileValidator.js All cross-file validation logic
out/workspaceScanner.js Utilities for navigating Splunk app directory structures
test/crossFileValidator.test.js Unit tests for all validators (70 total)
test/workspaceScanner.test.js Unit tests for workspace scanner
test/setup.js Global test setup with VS Code mocks
test/mocks/vscode.js Mock VS Code API for testing

Files modified

File What changed
out/extension.js Added crossFileValidator import, integrated all validators into getDiagnostics()
out/codeActionProvider.js Added createCrossFileActions() method with quick fixes for each diagnostic type
package.json Added 7 cross-file validation configuration settings
README.md Added cross-file validation to feature list with configuration docs
CHANGELOG.md Added cross-file validation features to 0.4.0 entry

Notes

  • Respects Splunk's default/ and local/ configuration layering to prevent false positives
  • Master toggle plus individual toggles for each validator via splunk.crossFileValidation.* settings
  • splunkHome setting enables validation against system-level configurations
  • Orphaned stanzas use VS Code's DiagnosticTag.Unnecessary for subtle faded styling
  • All 70 tests passing
  • No existing functionality was modified (syntax validation, semantic linting, etc. unchanged)

jtgreen86 added 4 commits May 4, 2026 09:07
The [sourcetype::name] format is used when the sourcetype name contains
a colon (e.g., technology:logtype). Extract the actual sourcetype name from
these stanzas to avoid false positive 'missing sourcetype' warnings.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant