feat: create field extraction forgecicd_trust_validation

Author: edersonbrilhante

modules/integrations/splunk_cloud_conf_shared/props_cloudwatchlogs.tf

@@ -6,6 +6,7 @@ resource "splunk_configs_conf" "forgecicd_cloudwatchlogs" {
     "REPORT-forgecicd_cloudwatchlogs_lambda_tenant_fields"        = "forgecicd_cloudwatchlogs_lambda_tenant_fields"
     "REPORT-forgecicd_cloudwatchlogs_global_lambda_tenant_fields" = "forgecicd_cloudwatchlogs_global_lambda_tenant_fields"
     "REPORT-forgecicd_extra_lambda_tenant_fields"                 = "forgecicd_extra_lambda_tenant_fields"
+    "REPORT-forgecicd_trust_validation"                           = "forgecicd_trust_validation"
   }
   lifecycle {
     ignore_changes = [

modules/integrations/splunk_cloud_conf_shared/transforms_lambda.tf

@@ -29,3 +29,37 @@ resource "splunk_configs_conf" "forgecicd_extra_lambda_tenant_fields" {
     ]
   }
 }
+
+
+resource "splunk_configs_conf" "forgecicd_trust_validation" {
+  name = "transforms/forgecicd_trust_validation"
+
+  variables = {
+    REGEX      = "Validation complete:\\s*(\\[[^\\r\\n]+])"
+    FORMAT     = "forgecicd_trust_validation::$1"
+    SOURCE_KEY = "_raw"
+    CLEAN_KEYS = "0"
+  }
+
+  acl {
+    app     = var.splunk_conf.acl.app
+    owner   = var.splunk_conf.acl.owner
+    sharing = var.splunk_conf.acl.sharing
+    read    = var.splunk_conf.acl.read
+    write   = var.splunk_conf.acl.write
+  }
+  lifecycle {
+    ignore_changes = [
+      variables["CAN_OPTIMIZE"],
+      variables["DEFAULT_VALUE"],
+      variables["DEPTH_LIMIT"],
+      variables["DEST_KEY"],
+      variables["KEEP_EMPTY_VALS"],
+      variables["LOOKAHEAD"],
+      variables["MATCH_LIMIT"],
+      variables["MV_ADD"],
+      variables["WRITE_META"],
+      variables["disabled"]
+    ]
+  }
+}