plugin(logs): support time based queries for Splunk by michaelalang · Pull Request #1317 · tektoncd/results

michaelalang · 2026-04-28T07:46:05Z

Changes

PR concept change:
- with the request to split the PR into it's functions, time based queries and custom UIDKeyEnv the documentation changes accordingly startTime and endTime for Splunk queries
- the second PR tackles the variable resolution for UIDkeys on pipelineRunUIDKeyEnv, taskRunUIDKeyEnv
- this PR now focuses on

Release Notes

Splunk queries do now contain startTime and endTime to limit the range result returned by Splunk.
The default values are taken from the stored Results record.

For pull requests with a release note:

* Implements https://github.com/tektoncd/results/issues/1179 
* reduces the load to Splunk servers by limiting the search window with start/endTime

additional note for reviewers

Since I am not the best at writing go code, the code snippets are AI powered. I reviewed them and they seem to be adequate.

linux-foundation-easycla · 2026-04-28T07:46:10Z

The committers listed above are authorized under a signed CLA.

✅ login: michaelalang / name: Michaela Lang (c7bee96)

enarha · 2026-04-29T11:47:59Z

/ok-to-test

enarha · 2026-06-21T15:55:31Z

1. Split into two PRs

This PR bundles two independent changes — it would be easier to review as two separate PRs:

PR 1: Add time-range filtering to Splunk queries
Extract getLogRequestParams() from the existing getLokiLogs() code (the switch block that resolves uidKey, startTime, endTime from the record), then use it in both getLokiLogs() and getSplunkLogs(). This lets you add earliest_time/latest_time to the Splunk search job request without duplicating the time extraction logic. This is a straightforward performance fix — Splunk queries should not search all-time when we already know the run's time window.

PR 2: Make UID keys configurable via LOGGING_PLUGIN_PIPELINERUN_UID_KEY / LOGGING_PLUGIN_TASKRUN_UID_KEY
With getLogRequestParams() already extracted in PR 1, this becomes a clean addition — read the configured keys and fall back to the defaults.

2. Use config.Config instead of os.Getenv()

The new UID key settings are read via os.Getenv() directly in getLogRequestParams(), but every other logging configuration option goes through pkg/api/server/config/config.go (the Config struct with mapstructure tags). The new keys should follow the same pattern — add fields to the Config struct and read them from s.config. This keeps configuration centralized, allows validation at startup, and avoids values changing mid-process. Also, to stay consistent with the existing naming convention, consider naming them LOGGING_PLUGIN_PIPELINERUN_UID_KEY and LOGGING_PLUGIN_TASKRUN_UID_KEY.

michaelalang · 2026-06-21T15:58:29Z

@enarha thanks for the review I'll start working on your points accordingly

… Splunk queries This commit represents Part 1 of the requested PR split. It focuses on the straightforward performance fix for Splunk queries without mixing in the configuration changes for UID keys. Changes include: - Extracting `getLogRequestParams()` from the existing `getLokiLogs()` code (the logic that resolves uidKey, startTime, endTime from the record). - Using the extracted `getLogRequestParams()` in both `getLokiLogs()` and `getSplunkLogs()`. - Adding `earliest_time` and `latest_time` to the Splunk search job request so Splunk queries do not search all-time when the run's time window is already known.

Extract getLogRequestParams() from getLokiLogs() to share record time and UID key resolution between Loki and Splunk, and add earliest_time/latest_time to Splunk search queries to scope searches to the run's time window.

enarha · 2026-06-22T15:55:51Z

/lgtm

Copilot

Pull request overview

This PR updates the v1alpha2 log plugin’s Splunk backend to use record-derived start/end timestamps when creating Splunk search jobs, limiting query scope and reducing load on Splunk.

Changes:

Refactors time/UID extraction into a shared getLogRequestParams helper for Loki and Splunk.
Adds earliest_time and latest_time parameters to Splunk job creation requests.
Extends the Splunk log plugin unit test to assert the submitted time bounds.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
pkg/api/server/v1alpha2/plugin/plugin_logs.go	Adds shared log request parameter extraction and applies record-based time bounds to Splunk queries.
pkg/api/server/v1alpha2/plugin/plugin_logs_test.go	Adds assertions that Splunk requests include earliest/latest time values derived from the record.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

vdemeester · 2026-07-06T09:25:05Z

 		data := &pipelinev1.PipelineRun{}
 		err := json.Unmarshal(rec.Data, data)
 		if err != nil {
-			err = fmt.Errorf("failed to marshal pipelinerun data for fetching log, err: %s", err.Error())
-			s.logger.Error(err)
-			return err
+			return "", "", "", fmt.Errorf("failed to marshal pipelinerun data for fetching log, err: %w", err)
 		}


This comment make sense ; but at the same time, the error message was already there before this PR, so we can definitely fix this in a follow-up instead.

vdemeester · 2026-07-06T09:25:27Z

 		data := &pipelinev1.TaskRun{}
 		err := json.Unmarshal(rec.Data, data)
 		if err != nil {
-			err = fmt.Errorf("failed to marshal taskrun data for fetching log, err: %s", err.Error())
-			s.logger.Error(err)
-			return err
+			return "", "", "", fmt.Errorf("failed to marshal taskrun data for fetching log, err: %w", err)
 		}


Same as above.

vdemeester · 2026-07-06T09:26:02Z

 		if data.Status.CompletionTime == nil {
-			err = errors.New("there's no completion in pipelinerun")
-			s.logger.Error(err)
-			return err
+			return "", "", "", errors.New("there's no completion in pipelinerun")
 		}
 		endTime = strconv.FormatInt(data.Status.CompletionTime.Add(s.forwarderDelayDuration).UTC().Unix(), 10)


I think it's by design though.

vdemeester · 2026-07-06T09:25:57Z

 		if data.Status.CompletionTime == nil {
-			err = errors.New("there's no completion in taskrun")
-			s.logger.Error(err)
-			return err
+			return "", "", "", errors.New("there's no completion in taskrun")
 		}
 		endTime = strconv.FormatInt(data.Status.CompletionTime.Add(s.forwarderDelayDuration).UTC().Unix(), 10)


I think it's by design though.

@@ -263,6 +265,9 @@ func TestSplunkLogs(t *testing.T) {
 		// Verify the request path and query parameters
 		switch r.URL.Path {
 		case "/services/search/v2/jobs":
+			r.ParseForm()
+			gotEarliestTime = r.FormValue("earliest_time")
+			gotLatestTime = r.FormValue("latest_time")


vdemeester · 2026-07-06T09:25:05Z

 		data := &pipelinev1.PipelineRun{}
 		err := json.Unmarshal(rec.Data, data)
 		if err != nil {
-			err = fmt.Errorf("failed to marshal pipelinerun data for fetching log, err: %s", err.Error())
-			s.logger.Error(err)
-			return err
+			return "", "", "", fmt.Errorf("failed to marshal pipelinerun data for fetching log, err: %w", err)
 		}


This comment make sense ; but at the same time, the error message was already there before this PR, so we can definitely fix this in a follow-up instead.

vdemeester · 2026-07-06T09:25:27Z

 		data := &pipelinev1.TaskRun{}
 		err := json.Unmarshal(rec.Data, data)
 		if err != nil {
-			err = fmt.Errorf("failed to marshal taskrun data for fetching log, err: %s", err.Error())
-			s.logger.Error(err)
-			return err
+			return "", "", "", fmt.Errorf("failed to marshal taskrun data for fetching log, err: %w", err)
 		}


Same as above.

vdemeester · 2026-07-06T09:25:57Z

 		if data.Status.CompletionTime == nil {
-			err = errors.New("there's no completion in taskrun")
-			s.logger.Error(err)
-			return err
+			return "", "", "", errors.New("there's no completion in taskrun")
 		}
 		endTime = strconv.FormatInt(data.Status.CompletionTime.Add(s.forwarderDelayDuration).UTC().Unix(), 10)


I think it's by design though.

vdemeester · 2026-07-06T09:26:02Z

 		if data.Status.CompletionTime == nil {
-			err = errors.New("there's no completion in pipelinerun")
-			s.logger.Error(err)
-			return err
+			return "", "", "", errors.New("there's no completion in pipelinerun")
 		}
 		endTime = strconv.FormatInt(data.Status.CompletionTime.Add(s.forwarderDelayDuration).UTC().Unix(), 10)


I think it's by design though.

tekton-robot · 2026-07-06T09:26:33Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Apr 28, 2026

tekton-robot requested review from divyansh42 and khrm April 28, 2026 07:46

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 28, 2026

michaelalang force-pushed the fix_splunk_compat branch from 42a7364 to c7bee96 Compare April 29, 2026 12:07

michaelalang force-pushed the fix_splunk_compat branch from c7bee96 to 15d052d Compare June 21, 2026 16:54

tekton-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 21, 2026

michaelalang mentioned this pull request Jun 21, 2026

plugin(logs): support customizeable variable resolution for Loki and Splunk #1362

Open

Add tess for earlier/latest time Splunk (#1)

2a51b21

Extract getLogRequestParams() from getLokiLogs() to share record time and UID key resolution between Loki and Splunk, and add earliest_time/latest_time to Splunk search queries to scope searches to the run's time window.

michaelalang changed the title ~~plugin(logs): support environment variable resolution for Loki and Splunk~~ plugin(logs): support time based queries for Splunk Jun 22, 2026

tekton-robot assigned enarha Jun 22, 2026

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jun 22, 2026

enarha added the kind/feature Categorizes issue or PR as related to a new feature. label Jun 22, 2026

khrm requested a review from Copilot June 29, 2026 11:12

Copilot started reviewing on behalf of khrm June 29, 2026 11:12 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

vdemeester approved these changes Jul 6, 2026

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 6, 2026

tekton-robot merged commit 2bfecf7 into tektoncd:main Jul 6, 2026
12 checks passed

Uh oh!

Conversation

michaelalang commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Release Notes

additional note for reviewers

Uh oh!

linux-foundation-easycla Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

enarha commented Apr 29, 2026

Uh oh!

enarha commented Jun 21, 2026

Uh oh!

michaelalang commented Jun 21, 2026

Uh oh!

enarha commented Jun 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tekton-robot commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

michaelalang commented Apr 28, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Apr 28, 2026 •

edited

Loading