FieldsTests

Test generation mechanism to verify the field extractions of an Add-on

TestTemplates

Includes the test scenarios to check the field extractions of an Add-on.

class standard_lib.fields_tests.test_templates.FieldTestTemplates

Bases: object

Test templates to test the knowledge objects of an App

test_eventtype(splunk_search_util, splunk_ingest_data, splunk_setup, splunk_searchtime_fields_eventtypes, record_property, caplog)

Tests if all eventtypes in eventtypes.conf are generated in Splunk.

Parameters

• splunk_search_util (fixture) – Fixture to create a simple connection to Splunk via SplunkSDK

• splunk_searchtime_fields_eventtypes (fixture) – Fixture containing list of eventtypes

• record_property (fixture) – Used to add user properties to test report

• caplog (fixture) – Access and control log capturing

Returns

Asserts whether test case passes or fails.

test_props_fields(splunk_search_util, splunk_ingest_data, splunk_setup, splunk_searchtime_fields_positive, record_property)

This test case checks that a field value has the expected values.

Parameters

• splunk_search_util (SearchUtil) – Object that helps to search on Splunk.

• splunk_searchtime_fields_positive (fixture) – Test for stanza field.

• record_property (fixture) – Document facts of test cases.

• caplog (fixture) – fixture to capture logs.

test_props_fields_no_dash_not_empty(splunk_search_util, splunk_ingest_data, splunk_setup, splunk_searchtime_fields_negative, record_property)

This test case checks negative scenario for the field value.

Parameters

• splunk_search_util (SearchUtil) – Object that helps to search on Splunk.

• splunk_searchtime_fields_negative (fixture) – Test for stanza field.

• record_property (fixture) – Document facts of test cases.

• caplog (fixture) – fixture to capture logs.

test_savedsearches(splunk_search_util, splunk_ingest_data, splunk_setup, splunk_searchtime_fields_savedsearches, record_property, caplog)

Tests if all savedsearches in savedsearches.conf are being executed properly to generate proper results.

Parameters

• splunk_search_util (fixture) – Fixture to create a simple connection to Splunk via SplunkSDK

• splunk_searchtime_fields_savedsearches (fixture) – Fixture containing list of savedsearches

• record_property (fixture) – Used to add user properties to test report

• caplog (fixture) – Access and control log capturing

Returns

Asserts whether test case passes or fails.

test_tags(splunk_search_util, splunk_ingest_data, splunk_setup, splunk_searchtime_fields_tags, record_property, caplog)

Test case to check tags mentioned in tags.conf

This test case checks if a tag is assigned to the event if enabled, and also checks that a tag is not assigned to the event if disabled.

Parameters

• splunk_search_util (helmut_lib.SearchUtil.SearchUtil) – object that helps to search on Splunk.

• splunk_searchtime_fields_tags (fixture) – pytest parameters to test.

• record_property (fixture) – pytest fixture to document facts of test cases.

• caplog (fixture) – fixture to capture logs.

TestGenerator

Module include class to generate the test cases to test the knowledge objects of an Add-on.

class standard_lib.fields_tests.test_generator.FieldTestGenerator(app_path, field_bank=None)

Bases: object

Generates test cases to test the knowledge objects of an Add-on.

• Provides the pytest parameters to the test templates.

• Supports field_bank: List of fields with patterns and expected values which should be tested for the Add-on.

Parameters

• app_path (str) – Path of the app package

• field_bank (str) – Path of the fields Json file

generate_eventtype_tests()

Generate test case for eventtypes

Yields

pytest.params for the test templates

generate_field_tests(is_positive)

Generate test case for fields

Parameters

is_positive (bool) – Test type to generate

Yields

pytest.params for the test templates

generate_savedsearches_tests()

Generate test case for savedsearches

Yields

pytest.params for the test templates

generate_tag_tests()

Generate test case for tags

Yields

pytest.params for the test templates

generate_tests(fixture)

Generate the test cases based on the fixture provided supported fixtures:

• splunk_app_searchtime_fields

• splunk_app_searchtime_negative

• splunk_app_searchtime_eventtypes

• splunk_app_searchtime_tags

• splunk_app_searchtime_savedsearches

Parameters

fixture (str) – fixture name

FieldBank

To enhance the test cases while verifying the field extractions.

class standard_lib.fields_tests.field_bank.FieldBank

Bases: object

Supports field_bank: List of fields with patterns and expected

values which should be tested for the Add-on.

Steps to use:

1. Create a json file with the list of fields.

   Example:

   {
       "stanza_name": [    # Key should be stanza_name
           {
               "name": "action",
               "condition": "| regex _raw=\"success\""
               "validity": "action=if(action=\"unknown\", null(), action)"
               "expected_values": ["success", "failure"]
               "negative_values": ["", "-", "unknown"]
           }
       ]
   }
   

   Parameter	Description
   condition	A filtering SPL command.
   validity	An EVAL statement. Filter out invalid value of a field
   expected_fields	List of expected_fields
   negative_fields	The list of values the field should not have

   supported stanza_type:

   1. source

   2. sourcetype

2. Provide path of the json file with –field-bank=path parameter

classmethod init_field_bank_tests(field_bank_path)

Parse the field JSON file and return the list of fields

Parameters

field_bank_path (str) – Path of the field JSON file

Yields

dict – details of the fields including stanza and stanza_type