splunk / splunk/pytest-splunk-addon

Data Generator doesn't set host field via token

Open
#194 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
66
Forks
21
Avg merge
4d 13h
Merged PRs (30d)
2

Description

The following configuration in pytest-splunk-addon-data.conf does replace the tokens as expected, but the ingested data shows a value of Barracuda.logfor field host. Therefore test Test_App.test_indextime_key_fields fails.

[Barracuda.log]
sourcetype = barracuda
#source =
#sourcetype_to_search = barracuda
host_type = plugin
input_type = file_monitor
index = main
sample_count = 20
#expected_event_count =
timestamp_type = event
#breaker =

token.1.token = ##time1##
token.1.replacementType = timestamp
token.1.replacement = %b %d %H:%M:%S
token.1.field = _time

token.2.token = ##host##
token.2.replacementType = random
token.2.replacement = host["ipv4"]
token.2.field = host

token.3.token = ##time2##
token.3.replacementType = timestamp
token.3.replacement = %Y-%m%d %H:%M:%S.%3Q +%z

The following config using host_type = plugin produces the exact same result.

[Barracuda.log]
sourcetype = barracuda
#source =
#sourcetype_to_search = barracuda
host_type = plugin
input_type = file_monitor
index = main
sample_count = 20
#expected_event_count =
timestamp_type = event
#breaker =

token.1.token = ##time1##
token.1.replacementType = timestamp
token.1.replacement = %b %d %H:%M:%S
token.1.field = _time

token.2.token = ##host##
token.2.replacementType = random
token.2.replacement = host["ipv4"]
#token.2.field = host

token.3.token = ##time2##
token.3.replacementType = timestamp
token.3.replacement = %Y-%m%d %H:%M:%S.%3Q +%z

Test output:

---------------------------------------------------------------------------------------------- Captured log call -----------------------------------------------------------------------------------------------
DEBUG    pytest-splunk-addon:test_templates.py:80 Base search for indextime key field test: search (index=*) sourcetype=barracuda host IN ("Barracuda.log") | table host
DEBUG    pytest-splunk-addon:test_templates.py:88 Results:[{'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}, {'host': 'Barracuda.log'}]
INFO     pytest-splunk-addon:test_templates.py:143 Some values for the following key fields are missing

Key_field | Expected_values                                                                                                                                                                                                                                                                                                        | Actual_values
--------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -----------------
host      | {'172.16.51.6', '172.16.51.7', '172.16.51.3', '172.16.51.18', '172.16.51.12', '172.16.51.8', '172.16.51.17', '172.16.51.19', '172.16.51.10', '172.16.51.11', '172.16.51.1', '172.16.51.15', '172.16.51.4', '172.16.51.16', '172.16.51.0', '172.16.51.9', '172.16.51.5', '172.16.51.13', '172.16.51.2', '172.16.51.14'} | {'Barracuda.log'}

System information:

platform darwin -- Python 3.8.6, pytest-6.1.1, py-1.9.0, pluggy-0.13.1 -- /usr/local/opt/python@3.8/bin/python3.8
using: pytest-6.1.1 pylib-1.9.0
setuptools registered plugins:
  lovely-pytest-docker-0.2.0 at /usr/local/lib/python3.8/site-packages/lovely/pytest/docker/compose.py
  pytest-splunk-addon-1.3.9 at /usr/local/lib/python3.8/site-packages/pytest_splunk_addon/plugin.py
  pytest-splunk-addon-1.3.9 at /usr/local/lib/python3.8/site-packages/pytest_splunk_addon/splunk.py
  pytest-xdist-2.1.0 at /usr/local/lib/python3.8/site-packages/xdist/plugin.py
  pytest-xdist-2.1.0 at /usr/local/lib/python3.8/site-packages/xdist/looponfail.py
  pytest-forked-1.3.0 at /usr/local/lib/python3.8/site-packages/pytest_forked/__init__.py
  Faker-4.14.0 at /usr/local/lib/python3.8/site-packages/faker/contrib/pytest/plugin.py

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with pytest-splunk-addon-data.conf and the Test_App.test_indextime_key_fields test, comparing the two token configurations and the captured Splunk results. Trace how the host token and host_type are handled, then run the failing test. Done means the configured host token produces the expected IPv4 host values instead of Barracuda.log.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.