I'm trying to get contentctl to download apps from splunkbase, but there is no documentation as to how to do that, so I have to keep guessing, but I'm running out of ideas.
Here is my command: contentctl test --verbose mode:all
Here is my contentctl.yml:
splunk_api_username: someone@someone.comsplunk_api_password: hihiversion: 20240925.16.111path: .app:
uid: 42123title: 'MyAPP'appid: myappversion: 20240925.16.111description: "MyAPP"prefix: MAlabel: 'MyAPP'author_name: "MyAPP"author_email: MyAPP@MyAPP.comauthor_company: "MyAPP"verbose: falseenrichments: falsebuild_app: truebuild_api: falsebuild_ssa: falsebuild_path: distmode: {}post_test_behavior: pause_on_failureenable_integration_testing: falseapps:
- uid: 263title: Enterprise Securityappid: Splunk_Enterprise_Securityversion: 7.3.2description: Splunk Enterprise Security
- uid: 1621title: Splunk Common Information Model (CIM)appid: Splunk_SA_CIMversion: 5.2.0description: Splunk Common Information Modelhardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_520.tgz
- uid: 5579title: Splunk Add-on for CrowdStrike FDRappid: Splunk_TA_CrowdStrike_FDRversion: 1.5.0description: description of apphardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_150.tgzcontainer_settings:
leave_running: truenum_containers: 1full_image_path: registry.hub.docker.com/splunk/splunk:latestI get this error:
Error validating 'contentctl.yml':
Error validating test apps: 'version'
It doesn't matter if I remove the version key from the contentctl.yml file, the error is the same.
Is this a bug or I'm doing something wrong?
I'm trying to get contentctl to download apps from splunkbase, but there is no documentation as to how to do that, so I have to keep guessing, but I'm running out of ideas.
Here is my command:
contentctl test --verbose mode:allHere is my
contentctl.yml:I get this error:
It doesn't matter if I remove the
versionkey from the contentctl.yml file, the error is the same.Is this a bug or I'm doing something wrong?