diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 00a5fa7..c751147 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -16,8 +16,9 @@ permissions: jobs: test: - # Skip on the template repo itself; consumer repos have is_template: false. - if: github.event.repository.is_template == false + # Runs on the template too — the template now ships a working demo + # passthrough pipeline + fixture so the harness gets exercised here + # before consumer repos inherit it. uses: dryvist/cc-edge-pack-template/.github/workflows/cribl-pack-test.yml@main with: # CHANGE per pack: 'edge' for Cribl Edge packs, 'stream' for Cribl Stream packs. diff --git a/default/pipelines/passthrough/conf.yml b/default/pipelines/passthrough/conf.yml new file mode 100644 index 0000000..54f8347 --- /dev/null +++ b/default/pipelines/passthrough/conf.yml @@ -0,0 +1,20 @@ +output: default +streamtags: [] +groups: {} +asyncFuncTimeout: 1000 +description: >- + Demo passthrough pipeline. Stamps Splunk-canonical fields + (sourcetype, index, datatype) on every event. Replace this + with your real pipeline logic when scaffolding a new pack. +functions: + - id: eval + filter: "true" + disabled: false + conf: + add: + - name: sourcetype + value: "'cribl:demo'" + - name: index + value: "'main'" + - name: datatype + value: "'cribl-demo'" diff --git a/default/pipelines/route.yml b/default/pipelines/route.yml index 0ba8123..5098a82 100644 --- a/default/pipelines/route.yml +++ b/default/pipelines/route.yml @@ -2,19 +2,19 @@ id: default groups: {} comments: [] routes: - # Replace this placeholder route with your real routes. + # Demo route. Replace with your real routes when scaffolding a new pack. # Validator rules: # - id and pipeline must be descriptive (no 'main', no 'route1') # - filter must be a real expression (not literally 'false' / '0') # - output MUST be __group (not input_id) - - id: REPLACE_ROUTE_ID - name: Replace With Route Name + - id: passthrough + name: Demo Passthrough final: true disabled: false - pipeline: REPLACE_PIPELINE_NAME - description: "Placeholder — replace id, name, pipeline, and filter." + pipeline: passthrough + description: "Demo route — replace when scaffolding a new pack." enableOutputExpression: false targetContext: group - filter: "datatype=='replace-with-your-datatype'" + filter: "datatype=='cribl-demo'" clones: [] output: __group diff --git a/package.json b/package.json index 63dabf7..e86ba3d 100644 --- a/package.json +++ b/package.json @@ -1,10 +1,10 @@ { - "name": "REPLACE-WITH-PACK-NAME", + "name": "cc-edge-demo-io", "version": "0.0.1", "minLogStreamVersion": "4.17.0", - "author": "Your Name ", - "description": "REPLACE: Brief description of what this pack does.", - "displayName": "REPLACE With Display Name", + "author": "dryvist ", + "description": "Demo passthrough pack — replace name/displayName/description/author when scaffolding from this template.", + "displayName": "Cribl Edge Demo Pack", "tags": { "streamtags": [ "replace", diff --git a/tests/fixtures/passthrough/sample.expected.json b/tests/fixtures/passthrough/sample.expected.json new file mode 100644 index 0000000..9573b8b --- /dev/null +++ b/tests/fixtures/passthrough/sample.expected.json @@ -0,0 +1,8 @@ +[ + { + "sourcetype": "cribl:demo", + "index": "main", + "datatype": "cribl-demo", + "_raw": "demo event" + } +] diff --git a/tests/fixtures/passthrough/sample.json b/tests/fixtures/passthrough/sample.json new file mode 100644 index 0000000..ec57193 --- /dev/null +++ b/tests/fixtures/passthrough/sample.json @@ -0,0 +1,7 @@ +[ + { + "_raw": "demo event", + "_time": 1714137600, + "datatype": "cribl-demo" + } +]