Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error: This detection is required to have 2 drilldown_searches, but only has [0] #312

Open
Res260 opened this issue Oct 21, 2024 · 1 comment

Comments

@Res260
Copy link
Contributor

Res260 commented Oct 21, 2024

Hi, I updated contentctl to 4.4.0 from 4.2.2, and I now have brand new errors. One of them is:

This detection is required to have 2 drilldown_searches, but only has [0]

When I run contentctl test --enable-integration-testing --verbose mode:all.

I tried searching for documentation and found nothing. I checked source code, this error comes from this commit 9ba9300 which states

Add the possibility to automatically create drilldowns. We will likely remove this, but let's keep it now for purposes of discussion.

Since the commit message says "the possibility", this seems to imply that enforcing this is a mistake?

In any case I'm very lost and don't know how to deal with this error. Some documentation and/or guidance would be appreciated :)

Thanks!

@Res260 Res260 changed the title This detection is required to have 2 drilldown_searches, but only has [0] Error: This detection is required to have 2 drilldown_searches, but only has [0] Oct 21, 2024
@Res260
Copy link
Contributor Author

Res260 commented Nov 14, 2024

An ugly but working workaround is to add this snippet to a Detection YAML:

drilldown_searches:
- earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
  name: DummyDrilldown1
  search: '%original_detection_search%'
- earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
  name: DummyDrilldown2
  search: '%original_detection_search%'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant