From 9c7453f05fed4edaa44bda37365adf57dae07de1 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Feb 2026 21:54:24 +0000 Subject: [PATCH 1/5] Fix AppInspect: Remove splunk_server=local and add [id] stanza - Remove splunk_server=local from all REST commands for cloud compatibility - Add [id] stanza to app.conf for proper semver validation https://claude.ai/code/session_014YNv3fKbpjQB5eMZCrHwzi --- default/app.conf | 4 ++++ default/savedsearches.conf | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/default/app.conf b/default/app.conf index c22c53c..cb02d46 100644 --- a/default/app.conf +++ b/default/app.conf @@ -14,3 +14,7 @@ version = 1.0.0 [package] id = caca check_for_updates = 1 + +[id] +name = caca +version = 1.0.0 diff --git a/default/savedsearches.conf b/default/savedsearches.conf index 13ed613..2985449 100644 --- a/default/savedsearches.conf +++ b/default/savedsearches.conf @@ -93,7 +93,7 @@ description = Collects dashboard load time and performance metrics via REST API. dispatch.earliest_time = -11m dispatch.latest_time = now enableSched = 1 -search = | rest /services/search/jobs splunk_server=local count=0 \ +search = | rest /services/search/jobs count=0 \ | rename eai:acl.app as app, author as user, runDuration as runtime, provenance as provenance \ | search provenance="UI:Dashboard*" OR provenance="scheduler__*" \ | rex field=provenance "UI:Dashboard:(?.+)" \ @@ -153,7 +153,7 @@ description = Automatically updates dashboard registry via REST API. Discovers n dispatch.earliest_time = -5m dispatch.latest_time = now enableSched = 1 -search = | rest /services/data/ui/views splunk_server=local count=0 \ +search = | rest /services/data/ui/views count=0 \ | search isDashboard=1 OR isVisible=1 \ | eval dashboard_uri="/app/".'eai:acl.app'."/".title \ | eval pretty_name=coalesce(label, title) \ @@ -184,7 +184,7 @@ dispatch.latest_time = now enableSched = 1 search = | inputlookup dashboard_registry \ | join type=left dashboard_uri \ - [| rest /services/data/ui/views splunk_server=local count=0 \ + [| rest /services/data/ui/views count=0 \ | eval dashboard_uri="/app/".'eai:acl.app'."/".title \ | eval exists="yes" \ | table dashboard_uri exists] \ From a30fae2ce1f1d9515e3efd7382c909919ca149b8 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Feb 2026 21:58:32 +0000 Subject: [PATCH 2/5] Fix version check: Remove duplicate version from [id] stanza The grep was matching version= in both [launcher] and [id] stanzas, causing version comparison to fail. Keep version only in [launcher]. https://claude.ai/code/session_014YNv3fKbpjQB5eMZCrHwzi --- default/app.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/default/app.conf b/default/app.conf index cb02d46..120cd60 100644 --- a/default/app.conf +++ b/default/app.conf @@ -17,4 +17,3 @@ check_for_updates = 1 [id] name = caca -version = 1.0.0 From 9c4c2e47b4de0eddea19176b172dd2ffc76ddd3f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Feb 2026 23:05:57 +0000 Subject: [PATCH 3/5] Restore indexes.conf and remove [id] stanza from app.conf Restore original working configuration: - Restore indexes.conf with paths (was working before) - Remove [id] stanza from app.conf (not needed, was causing issues) https://claude.ai/code/session_014YNv3fKbpjQB5eMZCrHwzi --- default/app.conf | 3 --- default/indexes.conf | 8 ++++++++ 2 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 default/indexes.conf diff --git a/default/app.conf b/default/app.conf index 120cd60..c22c53c 100644 --- a/default/app.conf +++ b/default/app.conf @@ -14,6 +14,3 @@ version = 1.0.0 [package] id = caca check_for_updates = 1 - -[id] -name = caca diff --git a/default/indexes.conf b/default/indexes.conf new file mode 100644 index 0000000..8db522b --- /dev/null +++ b/default/indexes.conf @@ -0,0 +1,8 @@ +# Metrics index for dashboard monitoring data +[caca_metrics] +datatype = metric +homePath = $SPLUNK_DB/caca_metrics/db +coldPath = $SPLUNK_DB/caca_metrics/colddb +thawedPath = $SPLUNK_DB/caca_metrics/thaweddb +# Retain metrics for 1 year by default +frozenTimePeriodInSecs = 31536000 From 6256f6883091f44382ba3076ad86e2ca368dcfb9 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Feb 2026 13:41:39 +0000 Subject: [PATCH 4/5] Add sc_admin role to metadata for Splunk Cloud compatibility This fixes AppInspect warning about needing sc_admin role for Splunk Cloud deployments. https://claude.ai/code/session_014YNv3fKbpjQB5eMZCrHwzi --- metadata/default.meta | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metadata/default.meta b/metadata/default.meta index 0b20ba2..744f4a2 100644 --- a/metadata/default.meta +++ b/metadata/default.meta @@ -1,5 +1,5 @@ # Application-level permissions [] -access = read : [ * ], write : [ admin ] +access = read : [ * ], write : [ admin, sc_admin ] export = system From c48881e96b9a2c2906ecd86dbbea98ce834816c9 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Feb 2026 14:45:50 +0000 Subject: [PATCH 5/5] Fix AppInspect: Set is_configured = 0 for Splunk Cloud AppInspect requires is_configured = 0 (false) in the [install] stanza to indicate the app has not already been configured. This is required for Splunk Cloud compatibility. https://claude.ai/code/session_014YNv3fKbpjQB5eMZCrHwzi --- default/app.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/default/app.conf b/default/app.conf index c22c53c..cc40621 100644 --- a/default/app.conf +++ b/default/app.conf @@ -1,5 +1,5 @@ [install] -is_configured = 1 +is_configured = 0 build = 1 [ui]