feat: add new transform and field extraction for runner logs

modules/integrations/splunk_cloud_conf_shared/props_billing_cur.tf

@@ -51,4 +51,8 @@ resource "splunk_configs_conf" "forgecicd_aws_billing_cur" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_billing_cur_instance_id,
+    splunk_configs_conf.forgecicd_billing_cur_volume_id
+  ]
 }

modules/integrations/splunk_cloud_conf_shared/props_cloudwatchlogs.tf

@@ -53,4 +53,9 @@ resource "splunk_configs_conf" "forgecicd_cloudwatchlogs" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_cloudwatchlogs_lambda_tenant_fields,
+    splunk_configs_conf.forgecicd_cloudwatchlogs_global_lambda_tenant_fields,
+    splunk_configs_conf.forgecicd_extra_lambda_tenant_fields
+  ]
 }

modules/integrations/splunk_cloud_conf_shared/props_ec2.tf

@@ -60,6 +60,13 @@ resource "splunk_configs_conf" "forgecicd_cloudwatchlogs_forgecicd" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_cloudwatchlogs_runner_tenant_fields,
+    splunk_configs_conf.forgecicd_cloudwatchlogs_extract_log_time_message,
+    splunk_configs_conf.forgecicd_cloudwatchlogs_runner_pages_github_repo_name,
+    splunk_configs_conf.forgecicd_cloudwatchlogs_runner_ci_result,
+    splunk_configs_conf.forgecicd_cloudwatchlogs_runner_gh_runner_version
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_metadata" {
@@ -118,4 +125,10 @@ resource "splunk_configs_conf" "forgecicd_metadata" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_metadata_tenant_fields,
+    splunk_configs_conf.forgecicd_metadata_instance_id,
+    splunk_configs_conf.forgecicd_metadata_image_id,
+    splunk_configs_conf.forgecicd_metadata_instance_type
+  ]
 }

modules/integrations/splunk_cloud_conf_shared/props_k8s.tf

@@ -58,6 +58,11 @@ resource "splunk_configs_conf" "forgecicd_kube_container_runner" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields,
+    splunk_configs_conf.forgecicd_kube_container_runner_ci_result,
+    splunk_configs_conf.forgecicd_kube_container_runner_gh_runner_version
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_init_docker_creds" {
@@ -118,6 +123,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_init_docker_creds" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_init_dind_rootless" {
@@ -178,6 +186,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_init_dind_rootless" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_init_work" {
@@ -238,6 +249,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_init_work" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_init_dind_externals" {
@@ -298,6 +312,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_init_dind_externals" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_dind" {
@@ -358,6 +375,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_dind" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_listener" {
@@ -418,6 +438,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_listener" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_listener_tenant_fields
+  ]
 }
 
 resource "splunk_configs_conf" "forgecicd_kube_container_manager" {
@@ -478,6 +501,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_manager" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_manager_tenant_fields
+  ]
 }
 resource "splunk_configs_conf" "forgecicd_kube_container_log_worker" {
   name = "props/kube:container:worker"
@@ -537,6 +563,9 @@ resource "splunk_configs_conf" "forgecicd_kube_container_log_worker" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }
 resource "splunk_configs_conf" "forgecicd_kube_container_log_hook" {
   name = "props/kube:container:hook"
@@ -596,4 +625,7 @@ resource "splunk_configs_conf" "forgecicd_kube_container_log_hook" {
       variables["unarchive_cmd_start_mode"],
     ]
   }
+  depends_on = [
+    splunk_configs_conf.forgecicd_kube_container_runner_tenant_fields
+  ]
 }

modules/integrations/splunk_cloud_conf_shared/props_runner_logs.tf

@@ -0,0 +1,132 @@
+resource "splunk_configs_conf" "forgecicd_runner_logs_json" {
+  name = "props/forgecicd:runner-logs:json"
+
+  variables = {
+    "REPORT-forgecicd_runner_logs_tenant_fields_event" = "forgecicd_runner_logs_tenant_fields_event"
+    "REPORT-forgecicd_runner_ec2"                      = "forgecicd_runner_ec2"
+    "REPORT-forgecicd_runner_arc"                      = "forgecicd_runner_arc"
+  }
+  acl {
+    app     = var.splunk_conf.acl.app
+    owner   = var.splunk_conf.acl.owner
+    sharing = var.splunk_conf.acl.sharing
+    read    = var.splunk_conf.acl.read
+    write   = var.splunk_conf.acl.write
+  }
+  lifecycle {
+    ignore_changes = [
+      variables["ADD_EXTRA_TIME_FIELDS"],
+      variables["ANNOTATE_PUNCT"],
+      variables["AUTO_KV_JSON"],
+      variables["BREAK_ONLY_BEFORE"],
+      variables["BREAK_ONLY_BEFORE_DATE"],
+      variables["CHARSET"],
+      variables["DATETIME_CONFIG"],
+      variables["DEPTH_LIMIT"],
+      variables["DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME"],
+      variables["HEADER_MODE"],
+      variables["LB_CHUNK_BREAKER_TRUNCATE"],
+      variables["LEARN_MODEL"],
+      variables["LEARN_SOURCETYPE"],
+      variables["LINE_BREAKER_LOOKBEHIND"],
+      variables["MATCH_LIMIT"],
+      variables["MAX_DAYS_AGO"],
+      variables["MAX_DAYS_HENCE"],
+      variables["MAX_DIFF_SECS_AGO"],
+      variables["MAX_DIFF_SECS_HENCE"],
+      variables["MAX_EVENTS"],
+      variables["MAX_EXPECTED_EVENT_LINES"],
+      variables["MAX_TIMESTAMP_LOOKAHEAD"],
+      variables["MUST_BREAK_AFTER"],
+      variables["MUST_NOT_BREAK_AFTER"],
+      variables["MUST_NOT_BREAK_BEFORE"],
+      variables["SEGMENTATION"],
+      variables["SEGMENTATION-all"],
+      variables["SEGMENTATION-inner"],
+      variables["SEGMENTATION-outer"],
+      variables["SEGMENTATION-raw"],
+      variables["SEGMENTATION-standard"],
+      variables["SHOULD_LINEMERGE"],
+      variables["TRANSFORMS"],
+      variables["TRUNCATE"],
+      variables["detect_trailing_nulls"],
+      variables["disabled"],
+      variables["maxDist"],
+      variables["priority"],
+      variables["sourcetype"],
+      variables["termFrequencyWeightedDist"],
+      variables["unarchive_cmd_start_mode"],
+    ]
+  }
+  depends_on = [
+    splunk_configs_conf.forgecicd_runner_logs_tenant_fields_event,
+    splunk_configs_conf.forgecicd_runner_ec2,
+    splunk_configs_conf.forgecicd_runner_arc
+  ]
+}
+resource "splunk_configs_conf" "forgecicd_runner_logs_logs" {
+  name = "props/forgecicd:runner-logs:logs"
+
+  variables = {
+    "REPORT-forgecicd_runner_logs_tenant_fields_logs" = "forgecicd_runner_logs_tenant_fields_logs"
+    "REPORT-forgecicd_runner_ec2"                     = "forgecicd_runner_ec2"
+    "REPORT-forgecicd_runner_arc"                     = "forgecicd_runner_arc"
+  }
+  acl {
+    app     = var.splunk_conf.acl.app
+    owner   = var.splunk_conf.acl.owner
+    sharing = var.splunk_conf.acl.sharing
+    read    = var.splunk_conf.acl.read
+    write   = var.splunk_conf.acl.write
+  }
+  lifecycle {
+    ignore_changes = [
+      variables["ADD_EXTRA_TIME_FIELDS"],
+      variables["ANNOTATE_PUNCT"],
+      variables["AUTO_KV_JSON"],
+      variables["BREAK_ONLY_BEFORE"],
+      variables["BREAK_ONLY_BEFORE_DATE"],
+      variables["CHARSET"],
+      variables["DATETIME_CONFIG"],
+      variables["DEPTH_LIMIT"],
+      variables["DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME"],
+      variables["HEADER_MODE"],
+      variables["LB_CHUNK_BREAKER_TRUNCATE"],
+      variables["LEARN_MODEL"],
+      variables["LEARN_SOURCETYPE"],
+      variables["LINE_BREAKER_LOOKBEHIND"],
+      variables["MATCH_LIMIT"],
+      variables["MAX_DAYS_AGO"],
+      variables["MAX_DAYS_HENCE"],
+      variables["MAX_DIFF_SECS_AGO"],
+      variables["MAX_DIFF_SECS_HENCE"],
+      variables["MAX_EVENTS"],
+      variables["MAX_EXPECTED_EVENT_LINES"],
+      variables["MAX_TIMESTAMP_LOOKAHEAD"],
+      variables["MUST_BREAK_AFTER"],
+      variables["MUST_NOT_BREAK_AFTER"],
+      variables["MUST_NOT_BREAK_BEFORE"],
+      variables["SEGMENTATION"],
+      variables["SEGMENTATION-all"],
+      variables["SEGMENTATION-inner"],
+      variables["SEGMENTATION-outer"],
+      variables["SEGMENTATION-raw"],
+      variables["SEGMENTATION-standard"],
+      variables["SHOULD_LINEMERGE"],
+      variables["TRANSFORMS"],
+      variables["TRUNCATE"],
+      variables["detect_trailing_nulls"],
+      variables["disabled"],
+      variables["maxDist"],
+      variables["priority"],
+      variables["sourcetype"],
+      variables["termFrequencyWeightedDist"],
+      variables["unarchive_cmd_start_mode"],
+    ]
+  }
+  depends_on = [
+    splunk_configs_conf.forgecicd_runner_logs_tenant_fields_logs,
+    splunk_configs_conf.forgecicd_runner_ec2,
+    splunk_configs_conf.forgecicd_runner_arc
+  ]
+}