Settings dashboard

[NonnoPinto]

The actual copycat produces lot of log for a testing env. i.e. a dev license has a 10MB/day license and the copycat default settings produces way more than that.
I propose a mini dashboard that allows to chose which index to populate and an estimate MB per day of ingestion.

[eden881]

Hi! Thanks for contributing, we'll look into this shortly.
Could you please first rebase your branch? We had to revert a commit from main that ended up being merged into your branch.
Do this on your branch please:

git remote add upstream https://github.com/trylynx-ai/copycat.git
git fetch upstream
git rebase upstream/main

[NonnoPinto]

Ok, I've rebased my branch. Thanks for considering my request. I'm the same guy who answered to your ad on Splunk Slack on mcp channel

[eden881]

Thanks for putting this together. You're right, the default config can definitely inflate Splunk's license usage (although I believe the dev license is 10GB and not 10MB). That's a real problem worth solving.

That said, the whole point of CopyCat is that you drop it into etc/apps and you're done - no UI, no knobs, no state files. Adding a dashboard, a lookup, and a JSON state tracker moves it in a direction we'd rather avoid.
There's also a practical issue with 10 scripted inputs racing to read/write the same state file with no locking.

If you're up for a simpler take: what about max_daily_mb and interval as inputs.conf parameters passed to the script?
Each event type has a roughly known size, so the script can just compute floor((max_daily_mb * 1048576 / (86400 / interval)) / event_size) to cap how many events to emit per run. No shared state, no dashboard - just arithmetic. Each input handles its own budget independently.

Let me know if you want to take a crack at that, happy to help think through the details.

[NonnoPinto]

You are right, it's 10GB, Splunk uses comma as thousand separator (10,000 MB), but my European mind read it wrong.

Leaving aside this, I've chose that approach because of Splunk Cloud. In that env, it's not easy to edit a .conf file. Few months ago Config Explorer has been released also in Cloud, but still it's not as easy as in an On Prem env. So said, since copycat package can be download, with a small documentation it could be easily updated as private app. I'll give it a try next days, thanks for the idea.

[eden881]

Hi! The PR was auto-closed by GitHub because it targeted the release branch in the repo, which we've just removed in #3 as we've moved to tag-based releases. Unfortunately, GitHub won't let me reopen a PR to a branch that no longer exists.
Feel free to open a new PR targeting the main branch when you're ready with the changes we discussed! 💪🏼