@@ -20,7 +20,8 @@ def test_search_event_on_splunk_is_not_empty(self, test_env, splunk_logger):
20
20
@pytest .mark .Critical
21
21
@pytest .mark .parametrize ("query_input" , [
22
22
"index={} cf_app_name=data_gen nozzle-event-counter>0" , # nozzle-event-counter should be searchable
23
- "index={} cf_app_name=data_gen subscription-id::splunk-ci" # subscription-id should be searchable
23
+ "index={} cf_app_name=data_gen subscription-id::splunk-ci" , # subscription-id should be searchable
24
+ "index={} cf_app_name=data_gen uuid::*" # uuid should be searchable
24
25
])
25
26
def test_enable_event_tracing_is_true (self , test_env , splunk_logger , query_input ):
26
27
self .splunk_api = SplunkApi (test_env , splunk_logger )
@@ -31,4 +32,123 @@ def test_enable_event_tracing_is_true(self, test_env, splunk_logger, query_input
31
32
assert len (search_results ) > 0 , \
32
33
'\n Number of events from Splunk should not be {}, however the result is {}' .format (0 , len (search_results ))
33
34
35
+ @pytest .mark .Critical
36
+ @pytest .mark .parametrize ("query_input" , [
37
+ "index=*.*" , # wrong splunk index format should return 0 result
38
+ "index=wrong_index" # wrong splunk index value should return 0 result
39
+ ])
40
+ def test_search_by_incorrect_splunk_index (self , test_env , splunk_logger , query_input ):
41
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
42
+
43
+ search_results = self .splunk_api .check_events_from_splunk (
44
+ query = query_input ,
45
+ start_time = "-15m@m" )
46
+ assert len (search_results ) == 0 , \
47
+ '\n Number of events from Splunk should be {}, however the result is {}' .format (0 , len (search_results ))
48
+
49
+ @pytest .mark .Critical
50
+ @pytest .mark .parametrize ("query_input" , [
51
+ "index={} cf_app_name=data_gen" , # when add_app_info is true, cf_app_name is searchable
52
+ "index={} cf_org_name=splunk-ci-org" , # when add_app_info is true, cf_org_name is searchable
53
+ "index={} cf_space_name=splunk-ci-space" # when add_app_info is true, cf_space_name is searchable
54
+ ])
55
+ def test_add_app_info_is_true (self , test_env , splunk_logger , query_input ):
56
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
57
+
58
+ search_results = self .splunk_api .check_events_from_splunk (
59
+ query = query_input .format (test_env ['splunk_index' ]),
60
+ start_time = "-15m@m" )
61
+ assert len (search_results ) > 0 , \
62
+ '\n Number of events from Splunk should not be {}, however the result is {}' .format (0 , len (search_results ))
63
+
64
+ @pytest .mark .Critical
65
+ @pytest .mark .parametrize ("query_input" , [
66
+ "index={} cf_app_name=data_gen" , # when add_app_info is true, cf_app_name is searchable
67
+ "index={} cf_org_name=splunk-ci-org" , # when add_app_info is true, cf_org_name is searchable
68
+ "index={} cf_space_name=splunk-ci-space" # when add_app_info is true, cf_space_name is searchable
69
+ ])
70
+ def test_add_app_info_is_true (self , test_env , splunk_logger , query_input ):
71
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
72
+
73
+ search_results = self .splunk_api .check_events_from_splunk (
74
+ query = query_input .format (test_env ['splunk_index' ]),
75
+ start_time = "-15m@m" )
76
+ assert len (search_results ) > 0 , \
77
+ '\n Number of events from Splunk should not be {}, however the result is {}' .format (0 , len (search_results ))
78
+
79
+ @pytest .mark .Critical
80
+ @pytest .mark .parametrize ("query_input" , [
81
+ "index={}| spath event_type | search event_type=LogMessage" ,
82
+ "index={}| spath event_type | search event_type=ValueMetric" ,
83
+ "index={}| spath event_type | search event_type=CounterEvent" ,
84
+ "index={}| spath event_type | search event_type=HttpStartStop" ,
85
+ "index={}| spath event_type | search event_type=ContainerMetric"
86
+ ])
87
+ def test_search_by_event_type (self , test_env , splunk_logger , query_input ):
88
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
89
+
90
+ search_results = self .splunk_api .check_events_from_splunk (
91
+ query = query_input .format (test_env ['splunk_index' ]),
92
+ start_time = "-15m@m" )
93
+ assert len (search_results ) > 0 , \
94
+ '\n Number of events from Splunk should not be {}, however the result is {}' .format (0 , len (search_results ))
95
+
96
+ @pytest .mark .Critical
97
+ @pytest .mark .parametrize ("query_input" , [
98
+ "index={} name::update-ci-test"
99
+ ])
100
+ def test_search_by_extra_fields (self , test_env , splunk_logger , query_input ):
101
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
102
+
103
+ search_results = self .splunk_api .check_events_from_splunk (
104
+ query = query_input .format (test_env ['splunk_index' ]),
105
+ start_time = "-15m@m" )
106
+ assert len (search_results ) > 0 , \
107
+ '\n Number of events from Splunk should not be {}, however the result is {}' .format (0 , len (search_results ))
108
+
109
+ @pytest .mark .Critical
110
+ @pytest .mark .parametrize ("query_input" , [
111
+ "index={} arch::old" ,
112
+ "index={} arch::*"
113
+ ])
114
+ def test_search_by_wrong_extra_fields (self , test_env , splunk_logger , query_input ):
115
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
116
+
117
+ search_results = self .splunk_api .check_events_from_splunk (
118
+ query = query_input .format (test_env ['splunk_index' ]),
119
+ start_time = "-15m@m" )
120
+ assert len (search_results ) == 0 , \
121
+ '\n Number of events from Splunk should be {}, however the result is {}' .format (0 , len (search_results ))
122
+
123
+ @pytest .mark .Critical
124
+ @pytest .mark .parametrize ("query_input" , [
125
+ "index={} cf_app_name=data_gen subscription-id::* event_type=LogMessage"
126
+ ])
127
+ def test_fields_and_values_in_splunk_event (self , test_env , splunk_logger , query_input ):
128
+ self .splunk_api = SplunkApi (test_env , splunk_logger )
129
+
130
+ search_results = self .splunk_api .check_events_from_splunk (
131
+ query = query_input .format (test_env ['splunk_index' ]),
132
+ start_time = "-15m@m" )
133
+ last_event = search_results [0 ]
134
+
135
+ expect_content = {
136
+ '_sourcetype' : 'cf:logmessage' ,
137
+ 'cf_app_name' : 'data_gen' ,
138
+ 'index' : test_env ['splunk_index' ],
139
+ 'source' : 'compute' ,
140
+ 'sourcetype' : 'cf:logmessage' ,
141
+ 'subscription-id' : 'splunk-ci'
142
+ }
143
+
144
+ assert_json_contains (expect_content , last_event , "Event raw data results mismatch" )
145
+ last_event_raw = json .loads (last_event ['_raw' ])
34
146
147
+ expect_raw_data = {
148
+ "cf_app_name" : "data_gen" ,
149
+ "cf_org_name" : "splunk-ci-org" ,
150
+ "cf_origin" : "firehose" ,
151
+ "cf_space_name" : "splunk-ci-space" ,
152
+ "event_type" : "LogMessage"
153
+ }
154
+ assert_json_contains (expect_raw_data , last_event_raw , "Event raw data results mismatch" )
0 commit comments