|
| 1 | +# CLAUDE.md |
| 2 | + |
| 3 | +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. |
| 4 | + |
| 5 | +## Running |
| 6 | + |
| 7 | +```bash |
| 8 | +# Start Splunk (from the splunk-sdk-python root): |
| 9 | +docker compose up -d --build |
| 10 | + |
| 11 | +# Start the F1 2025 data collector (separate Docker container): |
| 12 | +./start-collector.sh |
| 13 | + |
| 14 | +# After Splunk is up, enable all three modinput stanzas: |
| 15 | +docker exec splunk /opt/splunk/bin/splunk http-event-collector enable -uri https://localhost:8089 -auth admin:changed! -server-cert-cn SplunkServerDefaultCert |
| 16 | +curl -sk -u admin:changed! https://localhost:8089/services/data/inputs/turn_coach/turn_coach/enable -d '' -X POST |
| 17 | +curl -sk -u admin:changed! https://localhost:8089/services/data/inputs/pit_strategy/pit_strategy/enable -d '' -X POST |
| 18 | +curl -sk -u admin:changed! https://localhost:8089/services/data/inputs/race_summary/race_summary/enable -d '' -X POST |
| 19 | +``` |
| 20 | + |
| 21 | +The `docker-compose.yml` in the repo root mounts `examples/mclaren_demo_app` directly into |
| 22 | +the Splunk container as `/opt/splunk/etc/apps/mclaren_demo_app` — no deploy step needed. |
| 23 | + |
| 24 | +## Commands |
| 25 | + |
| 26 | +```bash |
| 27 | +# Lint: ruff fix + format + basedpyright (run from splunk-sdk-python root) |
| 28 | +make lint |
| 29 | + |
| 30 | +# Tail the advisor log |
| 31 | +docker exec splunk tail -f /opt/splunk/var/log/splunk/mclaren_demo_app.log |
| 32 | + |
| 33 | +# Run a modular input manually (LD_LIBRARY_PATH required for libssl inside container) |
| 34 | +docker exec splunk bash -c "LD_LIBRARY_PATH=/opt/splunk/lib /opt/splunk/bin/python3.13 /opt/splunk/etc/apps/mclaren_demo_app/bin/turn_coach.py" |
| 35 | + |
| 36 | +# Restart Splunk (picks up config changes without full container rebuild) |
| 37 | +make docker-splunk-restart |
| 38 | + |
| 39 | +# Full container rebuild (needed after Dockerfile or compose.yml changes) |
| 40 | +make docker-refresh |
| 41 | +``` |
| 42 | + |
| 43 | +No test suite. `make lint` (from the repo root) is the only automated gate. |
| 44 | +Run it after every code change before considering work done. |
| 45 | + |
| 46 | +## Architecture |
| 47 | + |
| 48 | +Three **modular inputs** poll `index=main source=f1_2025` via oneshot searches and |
| 49 | +emit structured JSON advice to `index=main`. |
| 50 | + |
| 51 | +``` |
| 52 | +F1 2025 game → UDP → f1-2025 collector (Docker :8501) |
| 53 | + → HEC → Splunk Enterprise (:8088) → index=main source=f1_2025 |
| 54 | +
|
| 55 | +Modular inputs (bin/*.py, each a splunklib.modularinput.Script subclass): |
| 56 | + turn_coach.py — triggers on sector change (LapData.sector field) |
| 57 | + pit_strategy.py — triggers on lap change (LapData.current_lap_num field) |
| 58 | + race_summary.py — triggers on race end (FinalClassificationData result_status=3) |
| 59 | +
|
| 60 | +Each input → splunklib.ai.Agent (LangChain backend) → LLM → JSON event → index=main |
| 61 | +``` |
| 62 | + |
| 63 | +**LLM connector:** `bedrock_connector.py` creates an `AnthropicBedrockModel` that |
| 64 | +authenticates via the `ssc-ci-cd_bedrock-inference-role` AWS profile using SigV4 |
| 65 | +(no stored credentials — `credential_process` in `~/.aws/config` calls `dev-login`). |
| 66 | +The fallback is `circuit_connector.py` which uses the Cisco Circuit AI gateway (OpenAI-compatible). |
| 67 | +All three modinputs import one of these connectors to get their `_LLM_MODEL`. |
| 68 | + |
| 69 | +**Dashboard:** Single `advisor` dashboard (`local/data/ui/views/advisor.xml`) with three |
| 70 | +side-by-side panels (Turn Coach, Pit Strategy, Race Debrief). Each panel has its own |
| 71 | +JS/CSS file under `appserver/static/`. Dashboard loads via Splunk Simple XML extension |
| 72 | +(`script=` / `stylesheet=` attributes). |
| 73 | + |
| 74 | +**Events:** All three sourcetypes use `KV_MODE = json` (see `default/props.conf`). |
| 75 | +JS polls via `service.oneshotSearch()` (Splunk Web SDK, authenticated) every 3 seconds. |
| 76 | + |
| 77 | +**Dependencies:** Runtime deps are bundled into `bin/lib/` (volume-mounted live into |
| 78 | +Splunk). `bin/lib/splunklib` is a symlink to the repo's `splunklib/` (set up in |
| 79 | +`docker-compose.yml`). All other 3rd-party packages (`langchain*`, `httpx`, `pydantic`, |
| 80 | +`boto3`/`botocore`, etc.) must be installed into `bin/lib/` before the modinputs can run. |
| 81 | + |
| 82 | +## Key Constraints |
| 83 | + |
| 84 | +- `bin/lib/` is the only dependency path available inside the Splunk container. |
| 85 | +- AWS session tokens from `dev-login` expire ~1h; refresh by running any `aws` command |
| 86 | + via `dev-login` or logging in again. |
| 87 | +- After any JS/CSS/conf change, hit `http://localhost:8000/en-GB/debug/refresh` then hard-reload |
| 88 | + the dashboard. This reloads all app confs and bumps static asset cache in one shot. |
| 89 | +- `basedpyright` config in the root `pyproject.toml` silences `splunklib` type stubs — |
| 90 | + use `# pyright: ignore[reportMissingImports]` for splunklib imports in bin/ files. |
| 91 | +- Line length limit is 100 chars (ruff `E501` is ignored, but keep lines readable). |
0 commit comments