Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update wait_time assign logic
  • Loading branch information
xqi-splunk committed Jul 8, 2025
commit 290a5f49b87c2b76dceb8c50c3811e78a01e5762
17 changes: 3 additions & 14 deletions contentctl/objects/correlation_search.py
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,6 @@ class TimeoutConfig(IntEnum):
# base amount to sleep for before beginning exponential backoff during testing
BASE_SLEEP = 2

# Max amount to wait before timing out during exponential backoff in each iteration
MAX_SLEEP_PER_TRY = 30

# NOTE: Based on testing, there are 45 detections couldn't generate risk/notables within single dispatch, and
# they needed to be retried; 90s is a reasonable wait time before retrying dispatching the SavedSearch
# Wait time before retrying dispatching the SavedSearch
Expand Down Expand Up @@ -954,7 +951,6 @@ def dispatch_and_validate(self, elapsed_sleep_time: dict[str, int]) -> None:
self.dispatch()

wait_time = TimeoutConfig.BASE_SLEEP
max_wait = TimeoutConfig.MAX_SLEEP_PER_TRY
time_elapsed = 0
validation_error = None

Expand All @@ -968,7 +964,9 @@ def dispatch_and_validate(self, elapsed_sleep_time: dict[str, int]) -> None:
if time_elapsed > TimeoutConfig.ADD_WAIT_TIME:
time.sleep(wait_time)
elapsed_sleep_time["elapsed_sleep_time"] += wait_time
wait_time = min(max_wait, wait_time * 2)
wait_time = min(
TimeoutConfig.RETRY_DISPATCH - int(time_elapsed), wait_time * 2
)

try:
self.validate_ara_events()
Expand All @@ -992,7 +990,6 @@ def dispatch_and_validate(self, elapsed_sleep_time: dict[str, int]) -> None:
# it for completion, but that seems more tricky
def test(
self,
max_sleep: int = TimeoutConfig.MAX_SLEEP_PER_TRY,
raise_on_exc: bool = False,
) -> IntegrationTestResult:
"""Execute the integration test
Expand All @@ -1001,17 +998,9 @@ def test(
and clear the indexes if so. Then, we force a run of the detection, wait for `sleep` seconds, and finally we
validate that the appropriate risk/notable events seem to have been created. NOTE: assumes the data already
exists in the instance
:param max_sleep: max number of seconds to sleep in each iteration for after enabling the detection before we
check for created events; re-checks are made upon failures using an exponential backoff until the max is reached
:param raise_on_exc: bool flag indicating if an exception should be raised when caught by the test routine, or
if the error state should just be recorded for the test
"""
# max_sleep must be greater than the base value
if max_sleep < TimeoutConfig.BASE_SLEEP:
raise ClientError(
f"max_sleep value of {max_sleep} is less than the base sleep required "
f"({TimeoutConfig.BASE_SLEEP})"
)

# initialize result as None
result: IntegrationTestResult | None = None
Expand Down
Loading