Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Splunk TypeError jobResult["resultCount"] implicit int cast #896

Closed
ipfyx opened this issue Nov 13, 2020 · 2 comments · Fixed by #897
Closed

[Bug] Splunk TypeError jobResult["resultCount"] implicit int cast #896

ipfyx opened this issue Nov 13, 2020 · 2 comments · Fixed by #897
Labels
category:bug Issue is related to a bug scope:analyzer Issue is analyzer related status:merged

Comments

@ipfyx
Copy link

ipfyx commented Nov 13, 2020

Hi, here is a simple bug, i don't know if opening an issue was necessary, maybe a pull request may have done it but here it is :

Describe the bug
File "/path/Cortex-Analyzers/analyzers/Splunk/splunk.py", line 141, in SplunkSearch jobResult["note"] = "Only the first "+str(self.MAX_COUNT)+" results were recovered over "+jobResult["resultCount"]+" to avoid any trouble on TheHive/Cortex. This parameter (max_count) can be changed in the analyzer configuration."TypeError: Can't convert 'int' object to str implicitly

To Reproduce
Steps to reproduce the behavior:

  1. Using any of Splunk_Search_*, use a splunk search that returns more results than MAX.COUNT

Expected behavior
No TypeError

Work environment

  • Client OS: Chrome
  • Server OS: Ubuntu 20.04
  • Browse type and version:
  • Cortex version: 3.0.1-1
  • Cortex Analyzer/Responder name: Splunk
  • Cortex Analyzer/Responder version: 3.0

Possible solutions
On Cortex-Analyzers/analyzers/Splunk/splunk.py:141 :
str(jobResult["resultCount"])
instead of
jobResult["resultCount"]

I will make a pull request asap linked to this issue. I hope I'm doing everything right...

@ipfyx ipfyx added the category:bug Issue is related to a bug label Nov 13, 2020
@dadokkio
Copy link
Contributor

maybe an format is a better option?

jobResult["note"] = "Only the first {} results were recovered over {} to avoid any trouble on TheHive/Cortex. This parameter (max_count) can be changed in the analyzer configuration.".format(self.MAX_COUNT, jobResult["resultCount"])

@ipfyx
Copy link
Author

ipfyx commented Nov 13, 2020

Sure, i agree, i will do that.

ipfyx pushed a commit to ipfyx/Cortex-Analyzers that referenced this issue Nov 13, 2020
TypeError in Splunk Analyzer
dadokkio added a commit that referenced this issue Nov 13, 2020
@ipfyx ipfyx changed the title [Bug] TypeError jobResult["resultCount"] implicit int cast [Bug] Splunk TypeError jobResult["resultCount"] implicit int cast Nov 13, 2020
@jeromeleonard jeromeleonard linked a pull request Nov 18, 2020 that will close this issue
@jeromeleonard jeromeleonard added scope:analyzer Issue is analyzer related status:merged labels Nov 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:bug Issue is related to a bug scope:analyzer Issue is analyzer related status:merged
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants