Move local splunk to a dockerized setup (#97)

* Move local splunk to a dockerized setup
* Address review comments

Author: xvaier

.gitignore

@@ -21,3 +21,4 @@ functional-temp
 splunktional-temp
 
 output/
+logs/

Makefile

@@ -32,7 +32,6 @@ clean:
 	rm -rf venv
 	rm -rf venv-tools
 	rm -rf packages/flare/bin/vendor
-	@unlink "/Applications/Splunk/etc/apps/flare" || true
 	@find . -type d -name "node_modules" -exec rm -rf {} +
 	rm -rf output/flare
 	@rm -f output/flare.tar.gz
@@ -105,6 +104,5 @@ sl: splunk-local
 
 .PHONY: splunk-local
 splunk-local: venv setup-web
-	@echo "Create symlink from app to Splunk Enterprise and start watching files"
-	SPLUNK_HOME="/Applications/Splunk" yarn run link
+	docker compose up -d
 	yarn run start

README.md

@@ -19,21 +19,14 @@ managing and publishing multiple packages in the same repository.
 
 
 ## Development
+We use an official splunk docker image for development, by binding the local folder to a folder in the container. In order for this to work, you need to have build the application before starting the docker.
 
-If you have your own Splunk Enterprise installed locally, you can use
-
-```
-make splunk-local
+```bash
+make build
 ```
 
-to download the required dependencies, watch the file changes to re-compile on the fly and generate a symlink between the Splunk app and the Splunk Enterprise applications folder.
+Then you can start the local docker and the frontend runner.
 
-To be able to see your changes when refreshing, add this at the end of this file:
-```
-File: /Applications/Splunk/etc/system/local/web.conf
-
-[settings]
-cacheEntriesLimit = 0
-cacheBytesLimit = 0
+```bash
+make splunk-local
 ```
-Then restart your Splunk Enterprise instance.

compose.yml

@@ -0,0 +1,15 @@
+services:
+  splunk:
+    image: splunk/splunk:latest
+    container_name: splunk
+    platform: linux/amd64
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+    environment:
+      - SPLUNK_START_ARGS=--accept-license
+      - SPLUNK_PASSWORD=a_password
+    volumes:
+      - ./output/flare:/opt/splunk/etc/apps/flare
+      - ./splunk/default.yml:/tmp/defaults/default.yml
+      - ./logs:/opt/splunk/var/log/splunk

package.json

@@ -9,8 +9,6 @@
     "lint": "lerna run lint --no-sort",
     "setup": "yarn && lerna run build",
     "start": "lerna run start --stream --no-sort --concurrency 100",
-    "unlink": "cd packages/flare && node build.js unlink",
-    "link": "cd packages/flare && node build.js unlink && node build.js link",
     "test": "cd packages/react-components && yarn run test",
     "test:ci": "cd packages/react-components && yarn run test:ci"
   },

packages/flare/bin/__init__.py

@@ -6,7 +6,6 @@
 HOST = "localhost"
 SPLUNK_PORT = 8089
 REALM = APP_NAME + "_realm"
-KV_COLLECTION_NAME = "event_ingestion_collection"
 CRON_JOB_THRESHOLD_SINCE_LAST_FETCH = timedelta(minutes=10)
 
 
@@ -18,11 +17,11 @@ class PasswordKeys(Enum):
     SOURCE_TYPES_FILTER = "source_types_filter"
 
 
-class CollectionKeys(Enum):
+class DataStoreKeys(Enum):
     LAST_INGESTED_TENANT_ID = "last_ingested_tenant_id"
     START_DATE = "start_date"
     TIMESTAMP_LAST_FETCH = "timestamp_last_fetch"
 
     @staticmethod
-    def get_next_token(tenantId: int) -> str:
-        return f"next_{tenantId}"
+    def get_next_token(tenant_id: int) -> str:
+        return f"next_{tenant_id}"