Splunk Apps » Lookup Editor

Wondering if I could just whitelist the files:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Distsearchconf#REPLICATION_WHITELIST_OPTIONS

The files are being stored in /etc/apps/lookup_editor/lookup_file_backups

I could handle this by using allowRestReplay from https://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Restmapconf:

allowRestReplay=[true|false]
* POST/PUT/DELETE requests can be replayed on other nodes in the deployment.
* This enables centralized management.
* Turn on or off this feature. You can also control replay at each endpoint
  level. This feature is currently INTERNAL and should not be turned on witout
  consulting splunk support.
* Defaults to false

This is available on 6.3.0+ per https://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/restmapconf.

https://github.com/jrervin/splunk-rest-examples

APIs that need to be converted:

1. get_lookup_info: Get information about a lookup file (owner, size, etc.)
2. get_lookup_backups_list: Get a list of the lookup file backups rendered as JSON.
3. save: save the JSON contents to the lookup file (this is the only one that must be converted to support replication)
4. get_original_lookup_file: provides the lookup file in a way to be downloaded by the browser.
5. get_lookup_contents: Provides the contents of a lookup file as JSON.

This code could use some breaking up (not including the public functions above):

• Backups
  • get_backup_files (getBackupFiles)
  • get_backup_directory (getBackupDirectory)
  • backup_lookup_file (backupLookupFile)

• Shortcuts
  • append_if_not_none
  • flatten_dict
  • make_lookup_filename (makeLookupFilename)
  • is_lookup_in_users_path (isLookupInUsersPath)
  • convert_array_to_csv
  • escape_filename (escapeFilename)
  • is_file_name_valid

• Lookup
  • force_lookup_replication
  • getCapabilities4User
  • resolve_lookup_filename
  • get_kv_lookup
  • get_lookup (signature changed)

• Controller specific
  • render_error_json

• backup_lookup_file: function signature has changed (moved resolved_file_path)

I think I will need to break out the backups handler from the main handler so that allowRestReplay can be enabled only for backups.

• Get backups to work
• Clean up post_lookup_contents() which currently does too much and has to call lookupfiles directly