# Copyright (C) 2005-2025 Splunk Inc. All Rights Reserved. # A collection of constants pertinent to backup-restore used across the code base # automatic mode does zipping, unzipping and cleanups automatically BACKUP_RESTORE_ADVANCED_MODE = 'advanced' # object list to find searches for missing macros # NOTE: Do not change the order of CHECK_OBJECT_TYPES list # If changes are required than validate 'get_backup_file_macros' and 'get_backup_file_savedsearches' # function present in backup_restore_rest_provider.py CHECK_OBJECT_TYPES = ['service', 'correlation_search', 'kpi_base_search', 'deep_dive', 'glass_table'] # Preview for backup ITSI_APPS_LIST = ['itsi', 'SA-ITOA'] # Regex constants REGEX_FOR_JSON_FILE = r'.*\/(itsi_.*).json$' # Regex to find the saved searches name from the search query # Few Example: ss1, "ss1", "ss\"1", "ss\\1", "ss@1", "ss]", "ss|", ss1\\ REGEX_TO_FETCH_SAVEDSEARCHES_FROM_SEARCH = r'\|\s*savedsearch\s*\"((?:\\.|[^"])*)\"|\|\s*savedsearch\s+([^\s\|\]]+)' REGEX_TO_FETCH_MACROS_FROM_SEARCH = r'(?\s*[a-zA-Z0-9_-]+(?:\([^`]*\))?\s*)`' NON_ITSI_OBJECT_CONF_FILE_REGEX = r'\/(savedsearches|macros|transforms).conf$' REGEX_FOR_MACROS_AND_PARAMETER = r'(?P[a-zA-Z0-9_-]+)\((?P(?:[^()]*|\([^()]*\))*)\)' REGEX_TO_SPLIT_MACRO_PARAMETERS = r'(?![^()]*\))(?=(?:(?:[^"]*"){2})*[^"]*$),\s*' # conf file list to show the count of each object present in local files CONF_FILE_FOR_OBJECT_COUNT = ['macros.conf', 'savedsearches.conf', 'transforms.conf'] # Excludes macros from being marked as missing if they are default macros from any of the specified apps. # All of the listed apps are shipped by default with ITSI, so their macros will always be present in the environment where the backup is restored. APPS_NAME_TO_EXCLUDE_DEFAULT_MACRO = ['SA-ITOA', 'DA-ITSI-EUEM', 'DA-ITSI-OS', 'DA-ITSI-STORAGE'] # Excludes saved searches from being marked as missing if they are default saved searches from any of the specified apps. # All of the listed apps are shipped by default with ITSI, so their saved searches will always be present in the environment where the backup is restored. APPS_NAME_TO_EXCLUDE_DEFAULT_SAVED_SEARCH = ['itsi', 'SA-ITOA', 'DA-ITSI-APPSERVER', 'DA-ITSI-DATABASE', 'DA-ITSI-EUEM', 'DA-ITSI-LB', 'DA-ITSI-OS', 'DA-ITSI-STORAGE', 'DA-ITSI-VIRTUALIZATION', 'DA-ITSI-WEBSERVER', 'SA-ITSI-AT-Recommendations', 'SA-ITSI-CustomModuleViz', 'SA-ITSI-DriftDetection', 'SA-ITSI-AlertCorrelation']