Skip to content

Comments

Default Stanza to prevent issues post-search-removal#421

Merged
pyth0n1c merged 17 commits intomainfrom
default_search_stanza
Feb 2, 2026
Merged

Default Stanza to prevent issues post-search-removal#421
pyth0n1c merged 17 commits intomainfrom
default_search_stanza

Conversation

@ljstella
Copy link
Contributor

Spoke w/ @pyth0n1c about this approach to prevent catching unwanted defaults from the system level. Creating this as a start.

@ljstella ljstella requested a review from pyth0n1c July 17, 2025 18:43
pyth0n1c

This comment was marked as outdated.

@ljstella ljstella requested a review from pyth0n1c February 2, 2026 19:30
Copy link
Contributor

@pyth0n1c pyth0n1c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have done lots of offline discussion, review, and testing around this. So approving, even though CICD is having some issues due to Github infrastrcuture problems at the moment

@pyth0n1c pyth0n1c merged commit 569a5e9 into main Feb 2, 2026
12 of 32 checks passed
@cob16
Copy link

cob16 commented Feb 20, 2026

For future readers upgrading to v5.5.11 please note if you are moving to this version you will need to update your app_template the same way as splunk/security_content#3815
Otherwise the defaults will become global and this will disable all non contentctl saved searches in your instance.

@ljstella
I think it would help if the example change in splunk/security_content#3815 was linked in the v5.5.11 release notes. Yes we should have seen this coming when reviewing the changelog but I think this is going to catch quite a few people out that don't realize that app configs can pollute global configuration in this way and adds a bit of a nice warning to help others from making the same mistake in a similar way to #472 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants