splunk / splunk/pytest-splunk-addon
Data Generator doesn't set host field via token
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 66
- Forks
- 21
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 2
Description
The following configuration in pytest-splunk-addon-data.conf does replace the tokens as expected, but the ingested data shows a value of Barracuda.logfor field host. Therefore test Test_App.test_indextime_key_fields fails.
[Barracuda.log]
sourcetype = barracuda
#source =
#sourcetype_to_search = barracuda
host_type = plugin
input_type = file_monitor
index = main
sample_count = 20
#expected_event_count =
timestamp_type = event
#breaker =
token.1.token = ##time1##
token.1.replacementType = timestamp
token.1.replacement = %b %d %H:%M:%S
token.1.field = _time
token.2.token = ##host##
token.2.replacementType = random
token.2.replacement = host["ipv4"]
token.2.field = host
token.3.token = ##time2##
token.3.replacementType = timestamp
token.3.replacement = %Y-%m%d %H:%M:%S.%3Q +%z
The following config using host_type = plugin produces the exact same result.
[Barracuda.log]
sourcetype = barracuda
#source =
#sourcetype_to_search = barracuda
host_type = plugin
input_type = file_monitor
index = main
sample_count = 20
#expected_event_count =
timestamp_type = event
#breaker =
token.1.token = ##time1##
token.1.replacementType = timestamp
token.1.replacement = %b %d %H:%M:%S
token.1.field = _time
token.2.token = ##host##
token.2.replacementType = random
token.2.replacement = host["ipv4"]
#token.2.field = host
token.3.token = ##time2##
token.3.replacementType = timestamp
token.3.replacement = %Y-%m%d %H:%M:%S.%3Q +%z
Test output:
---------------------------------------------------------------------------------------------- Captured log call -----------------------------------------------------------------------------------------------
DEBUG pytest-splunk-addon:test_templates.py:80 Base search for indextime key field test: search (index=*) sourcetype=barracuda host IN ("Barracuda.log") | table host
DEBUG pytest-splunk-addon:test_templates.py:88 Results:[{'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}]
INFO pytest-splunk-addon:test_templates.py:143 Some values for the following key fields are missing
Key_field | Expected_values | Actual_values
--------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -----------------
host | {'172.16.51.6', '172.16.51.7', '172.16.51.3', '172.16.51.18', '172.16.51.12', '172.16.51.8', '172.16.51.17', '172.16.51.19', '172.16.51.10', '172.16.51.11', '172.16.51.1', '172.16.51.15', '172.16.51.4', '172.16.51.16', '172.16.51.0', '172.16.51.9', '172.16.51.5', '172.16.51.13', '172.16.51.2', '172.16.51.14'} | {'Barracuda.log'}
System information:
platform darwin -- Python 3.8.6, pytest-6.1.1, py-1.9.0, pluggy-0.13.1 -- /usr/local/opt/python@3.8/bin/python3.8
using: pytest-6.1.1 pylib-1.9.0
setuptools registered plugins:
lovely-pytest-docker-0.2.0 at /usr/local/lib/python3.8/site-packages/lovely/pytest/docker/compose.py
pytest-splunk-addon-1.3.9 at /usr/local/lib/python3.8/site-packages/pytest_splunk_addon/plugin.py
pytest-splunk-addon-1.3.9 at /usr/local/lib/python3.8/site-packages/pytest_splunk_addon/splunk.py
pytest-xdist-2.1.0 at /usr/local/lib/python3.8/site-packages/xdist/plugin.py
pytest-xdist-2.1.0 at /usr/local/lib/python3.8/site-packages/xdist/looponfail.py
pytest-forked-1.3.0 at /usr/local/lib/python3.8/site-packages/pytest_forked/__init__.py
Faker-4.14.0 at /usr/local/lib/python3.8/site-packages/faker/contrib/pytest/plugin.py
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with pytest-splunk-addon-data.conf and the Test_App.test_indextime_key_fields test, comparing the two token configurations and the captured Splunk results. Trace how the host token and host_type are handled, then run the failing test. Done means the configured host token produces the expected IPv4 host values instead of Barracuda.log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100