From f2fe02d8a2abfd949340c8ad7925ec16ac768b63 Mon Sep 17 00:00:00 2001 From: "Bhargav Nariyani (C)" Date: Wed, 1 Apr 2020 18:57:08 +0530 Subject: [PATCH 1/4] Updated regex for extract-report --- pytest_splunk_addon/plugin.py | 194 ++++++++---------- .../TA_broken_sourcetype/default/props.conf | 4 +- tests/addons/TA_fiction/default/props.conf | 48 ++++- 3 files changed, 124 insertions(+), 122 deletions(-) diff --git a/pytest_splunk_addon/plugin.py b/pytest_splunk_addon/plugin.py index 159943a97..cafd7eb31 100644 --- a/pytest_splunk_addon/plugin.py +++ b/pytest_splunk_addon/plugin.py @@ -19,12 +19,8 @@ def pytest_configure(config): """ Setup configuration after command-line options are parsed """ - config.addinivalue_line( - "markers", "splunk_addon_internal_errors: Check Errors" - ) - config.addinivalue_line( - "markers", "splunk_addon_searchtime: Test search time only" - ) + config.addinivalue_line("markers", "splunk_addon_internal_errors: Check Errors") + config.addinivalue_line("markers", "splunk_addon_searchtime: Test search time only") def dedup_tests(test_list): @@ -48,13 +44,9 @@ def pytest_generate_tests(metafunc): """ for fixture in metafunc.fixturenames: if fixture.startswith("splunk_app"): - LOGGER.info( - "generating testcases for splunk_app. fixture=%s", fixture - ) + LOGGER.info("generating testcases for splunk_app. fixture=%s", fixture) # Load associated test data - tests = load_splunk_tests( - metafunc.config.getoption("splunk_app"), fixture - ) + tests = load_splunk_tests(metafunc.config.getoption("splunk_app"), fixture) metafunc.parametrize(fixture, dedup_tests(tests)) @@ -129,15 +121,8 @@ def return_tags(tags_property, stanza_name): List of pytest parameters """ return pytest.param( - { - "tag_query": stanza_name, - tags_property.value + "_tag": tags_property.name, - }, - id=stanza_name - + " | " - + tags_property.name - + "=" - + tags_property.value, + {"tag_query": stanza_name, tags_property.value + "_tag": tags_property.name,}, + id=stanza_name + " | " + tags_property.name + "=" + tags_property.value, ) @@ -158,14 +143,10 @@ def load_splunk_props(props): elif props_section.startswith("source::"): LOGGER.info("Parsing source stanza=%s", props_section) for props_source in list(get_list_of_sources(props_section)): - yield return_props_stanza_param( - props_section, props_source, "source" - ) + yield return_props_stanza_param(props_section, props_source, "source") else: LOGGER.info("parsing sourcetype stanza=%s", props_section) - yield return_props_stanza_param( - props_section, props_section, "sourcetype" - ) + yield return_props_stanza_param(props_section, props_section, "sourcetype") def return_props_stanza_param(stanza_id, stanza_value, stanza_type): @@ -192,9 +173,7 @@ def return_props_stanza_param(stanza_id, stanza_value, stanza_type): stanza_value, str(test_name), ) - return pytest.param( - {"field": stanza_type, "value": stanza_value}, id=test_name - ) + return pytest.param({"field": stanza_type, "value": stanza_value}, id=test_name) def load_splunk_fields(app, props, transforms): @@ -247,20 +226,15 @@ def load_splunk_fields(app, props, transforms): ) elif current.startswith("REPORT-"): yield from return_transforms_report( - transforms, - stanza_type, - each_stanza_name, - props_property, + transforms, stanza_type, each_stanza_name, props_property, ) - elif re.match('LOOKUP', current, re.IGNORECASE): + elif re.match("LOOKUP", current, re.IGNORECASE): yield from return_props_lookup( stanza_type, each_stanza_name, props_property, app - ) -def get_params_from_regex( - regex, property_value, stanza_type, stanza_name, fields -): + +def get_params_from_regex(regex, property_value, stanza_type, stanza_name, fields): """ Returns the fields captured using regex as pytest parameters @@ -283,9 +257,7 @@ def get_params_from_regex( for matchNum, match in enumerate(matches, start=1): for groupNum in range(0, len(match.groups())): groupNum = groupNum + 1 - field_test_name = "{}_field::{}".format( - stanza_name, match.group(groupNum) - ) + field_test_name = "{}_field::{}".format(stanza_name, match.group(groupNum)) yield pytest.param( { "stanza_type": stanza_type, @@ -297,9 +269,7 @@ def get_params_from_regex( fields.append(match.group(groupNum)) -def return_transforms_report( - transforms, stanza_type, stanza_name, report_property -): +def return_transforms_report(transforms, stanza_type, stanza_name, report_property): """ Returns the fields parsed from transforms.conf as pytest parameters @@ -316,8 +286,7 @@ def return_transforms_report( """ try: for transforms_section in [ - each_stanza.strip() - for each_stanza in report_property.value.split(",") + each_stanza.strip() for each_stanza in report_property.value.split(",") ]: report_test_name = ( f"{stanza_name}::{report_property.name}::{transforms_section}" @@ -339,11 +308,8 @@ def return_transforms_report( ), ) fields.append(section.options["SOURCE_KEY"].value) - if ( - "REGEX" in section.options - and section.options["REGEX"].value != "" - ): - regex = r"\(\?<([^\>]+)\>" + if "REGEX" in section.options and section.options["REGEX"].value != "": + regex = r"\(\?P?(?:[<'])([^\>'\s]+)[\>']" yield from get_params_from_regex( regex, section.options["REGEX"].value, @@ -351,15 +317,10 @@ def return_transforms_report( stanza_name, fields, ) - if ( - "FIELDS" in section.options - and section.options["FIELDS"].value != "" - ): + if "FIELDS" in section.options and section.options["FIELDS"].value != "": fields_list = [ each_field.strip() - for each_field in section.options["FIELDS"].value.split( - "," - ) + for each_field in section.options["FIELDS"].value.split(",") ] for each_field in fields_list: yield pytest.param( @@ -371,10 +332,7 @@ def return_transforms_report( id="{}_field::{}".format(stanza_name, each_field), ) fields.append(each_field) - if ( - "FORMAT" in section.options - and section.options["FORMAT"].value != "" - ): + if "FORMAT" in section.options and section.options["FORMAT"].value != "": regex = r"(\S*)::" yield from get_params_from_regex( regex, @@ -415,27 +373,27 @@ def return_props_extract(stanza_type, stanza_name, props_property): generator of fields as pytest parameters """ test_name = f"{stanza_name}::{props_property.name}" - regex = r"\(\?<([^\>]+)\>(?:.*(?i)in\s+(.*))?" - matches = re.finditer(regex, props_property.value, re.MULTILINE) + regex = r"\(\?P?(?:[<'])([^\>'\s]+)[\>']" fields = [] - for match_num, match in enumerate(matches, start=1): - for group_num in range(0, len(match.groups())): - group_num = group_num + 1 - if match.group(group_num): - field_test_name = "{}_field::{}".format( - stanza_name, match.group(group_num) - ) - yield pytest.param( - { - "stanza_type": stanza_type, - "stanza_name": stanza_name, - "fields": [match.group(group_num)], - }, - id=field_test_name, - ) - fields.append(match.group(group_num)) + yield from get_params_from_regex( + regex, props_property.value, stanza_type, stanza_name, fields, + ) + # If SOURCE_KEY is used in EXTRACT, generate the test for the same. + regex_for_source_key = r"(?:(?i)in\s+(\w+))\s*$" + extract_source_key = re.search( + regex_for_source_key, props_property.value, re.MULTILINE + ) + if extract_source_key: + yield pytest.param( + { + "stanza_type": stanza_type, + "stanza_name": stanza_name, + "fields": extract_source_key.group(1), + }, + id="{}_field::{}".format(stanza_name, extract_source_key.group(1)), + ) + fields.insert(0, extract_source_key.group(1)) if fields: - fields.reverse() LOGGER.info( "(Generated pytest.param for extract." "stanza_type=%s stanza_name=%s, fields=%s)", @@ -444,11 +402,7 @@ def return_props_extract(stanza_type, stanza_name, props_property): str(fields), ) yield pytest.param( - { - "stanza_type": stanza_type, - "stanza_name": stanza_name, - "fields": fields, - }, + {"stanza_type": stanza_type, "stanza_name": stanza_name, "fields": fields,}, id=test_name, ) @@ -477,9 +431,10 @@ def get_lookup_fields(lookup_str): lookup_str += " OUTPUT " # Take input fields or output fields depending on the input_output_index - input_output_str = lookup_str.split(" OUTPUT ")[input_output_index].split(" OUTPUTNEW ")[input_output_index] + input_output_str = lookup_str.split(" OUTPUT ")[input_output_index].split( + " OUTPUTNEW " + )[input_output_index] - field_parser = r"(\"(?:\\\"|[^\"])*\"|\'(?:\\\'|[^\'])*\'|[^\s,]+)\s*(?:[aA][sS]\s*(\"(?:\\\"|[^\"])*\"|\'(?:\\\'|[^\'])*\'|[^\s,]+))?" # field_groups: Group of max 2 fields - (source, destination) for "source as destination" field_groups = re.findall(field_parser, input_output_str) @@ -489,11 +444,17 @@ def get_lookup_fields(lookup_str): # Taking last non-empty field ensures that the aliased value will have # higher priority for each_group in field_groups: - field_list.append([each_field for each_field in reversed(each_group) if each_field][0]) + field_list.append( + [each_field for each_field in reversed(each_group) if each_field][0] + ) input_output_field_list.append(field_list) - return {"input_fields": input_output_field_list[0], "output_fields": input_output_field_list[1], "lookup_stanza": lookup_stanza} + return { + "input_fields": input_output_field_list[0], + "output_fields": input_output_field_list[1], + "lookup_stanza": lookup_stanza, + } def return_props_lookup(stanza_type, stanza_name, props_property, app): @@ -530,10 +491,12 @@ def return_props_lookup(stanza_type, stanza_name, props_property, app): if parsed_fields["lookup_stanza"] in transforms.sects: stanza = transforms.sects[parsed_fields["lookup_stanza"]] - if 'filename' in stanza.options: - lookup_file = stanza.options['filename'].value + if "filename" in stanza.options: + lookup_file = stanza.options["filename"].value try: - location = os.path.join(app.package.working_app_path, "lookups", lookup_file) + location = os.path.join( + app.package.working_app_path, "lookups", lookup_file + ) with open(location, "r") as csv_file: reader = csv.DictReader(csv_file) fieldnames = reader.fieldnames @@ -544,16 +507,33 @@ def return_props_lookup(stanza_type, stanza_name, props_property, app): # If there is an error. the test should fail with the current fields # This makes sure the test doesn't exit prematurely except (OSError, IOError, UnboundLocalError, TypeError) as e: - LOGGER.info("Could not read the lookup file, skipping test. error=%s", str(e)) + LOGGER.info( + "Could not read the lookup file, skipping test. error=%s", + str(e), + ) # Test individual fields for each_field in lookup_field_list: field_test_name = f"{stanza_name}_field::{each_field}" - yield pytest.param({'stanza_type': stanza_type, 'stanza_name': stanza_name, 'fields': [each_field]}, id=field_test_name) + yield pytest.param( + { + "stanza_type": stanza_type, + "stanza_name": stanza_name, + "fields": [each_field], + }, + id=field_test_name, + ) # Test Lookup as a whole - yield pytest.param({'stanza_type': stanza_type, 'stanza_name': stanza_name, 'fields': lookup_field_list}, id=test_name) - + yield pytest.param( + { + "stanza_type": stanza_type, + "stanza_name": stanza_name, + "fields": lookup_field_list, + }, + id=test_name, + ) + def return_props_eval(stanza_type, stanza_name, props_property): """ @@ -586,11 +566,7 @@ def return_props_eval(stanza_type, stanza_name, props_property): ) test_name = f"{stanza_name}_field::{fields[0]}" return pytest.param( - { - "stanza_type": stanza_type, - "stanza_name": stanza_name, - "fields": fields, - }, + {"stanza_type": stanza_type, "stanza_name": stanza_name, "fields": fields,}, id=test_name, ) @@ -619,11 +595,7 @@ def return_props_sourcetype(stanza_type, stanza_name, props_property): str(fields), ) return pytest.param( - { - "stanza_type": stanza_type, - "stanza_name": stanza_name, - "fields": fields, - }, + {"stanza_type": stanza_type, "stanza_name": stanza_name, "fields": fields,}, id=test_name, ) @@ -730,10 +702,8 @@ def return_eventtypes_param(stanza_id): """ LOGGER.info( - "Generated pytest.param of eventtype with id=%s", - f"eventtype::{stanza_id}", + "Generated pytest.param of eventtype with id=%s", f"eventtype::{stanza_id}", ) return pytest.param( - {"field": "eventtype", "value": stanza_id}, - id=f"eventtype::{stanza_id}", + {"field": "eventtype", "value": stanza_id}, id=f"eventtype::{stanza_id}", ) diff --git a/tests/addons/TA_broken_sourcetype/default/props.conf b/tests/addons/TA_broken_sourcetype/default/props.conf index 60bd851f7..8d1d2d8f5 100644 --- a/tests/addons/TA_broken_sourcetype/default/props.conf +++ b/tests/addons/TA_broken_sourcetype/default/props.conf @@ -7,9 +7,11 @@ EXTRACT-one = group=(?[^,]+) EVAL-one = "working" EVAL-two = one EVAL-used_in_extract = "use_this_in_extract" -EXTRACT-incorrect_extract = (?.*) in used_in_extract ## source_field from EVAL hence this extract would fail EXTRACT-incorrect_extract = (?.*) in used_in_extract +## Here in is used as a regex and hotWarmPath is not a SOURCE_KEY hence in should be enclosed as [i]n +## Since in is not enclosed as [i]n, this would fail +EXTRACT-broken_one = (?.*) [i]n hotWarmPath # Without lookup name LOOKUP-test_no_lookup = component OUTPUT context_test diff --git a/tests/addons/TA_fiction/default/props.conf b/tests/addons/TA_fiction/default/props.conf index ce98aa9ae..cc00ac028 100644 --- a/tests/addons/TA_fiction/default/props.conf +++ b/tests/addons/TA_fiction/default/props.conf @@ -10,20 +10,50 @@ EVAL-splunk_server = "server1" [splunkd] -## "in" used as a regex and not as a keyword -EXTRACT-0 = [i]n hotWarmPath=(?.*) - -## single field extraction +# single field extraction (?regex) EXTRACT-one = group=(?[^,]+) -## multiple field extractions +# multiple field extractions (?regex) EXTRACT-two = group=(?[^,]+).*name=(?[^,]+) -## use of "in" keyword to extract from source_field -EXTRACT-three = (?.*) in hotWarmPath +# single field extraction (?Pregex) +EXTRACT-three = group=(?P[^,]+) + +# multiple field extraction (?Pregex) +EXTRACT-four = group=(?P[^,]+).*name=(?P[^,]+) + +# single field extraction (?'field'regex) +EXTRACT-five = group=(?'extractfive'[^,]+) + +# multiple field extraction (?'field'regex) +EXTRACT-six = group=(?'extractsixA'[^,]+).*name=(?'extractsixB'[^,]+) + +# multiple field extraction combination of regex formats +EXTRACT-seven = group=(?[^,]+).*name=(?'extractsevenB'[^,]+).*instantaneous_kbps=(?P[^,]+) + +# "in" used as a regex and not as a keyword no field extract before in +EXTRACT-0 = in hotWarmPath=(?.*) + +# use of "in" keyword to extract from source_field +EXTRACT-eight = (?.*) in hotwarmpath_extract + +#use of "IN" keyword(case insensitivity) to extract from source_field +EXTRACT-nine = (?.*) IN hotwarmpath_extract + +#use of "In" keyword to extract from source_field +EXTRACT-ten = (?.*) In hotwarmpath_extract + +#use of "iN" keyword to extract from source_field +EXTRACT-eleven = (?.*) iN hotwarmpath_extract + +# Multiple field extracted using in from source_field +EXTRACT-twelve = (?opt)\/splunk(?.*) in hotwarmpath_extract + +# Multiple Groups with [i]n regex as a regex and not a keyword +EXTRACT-thirteen = (?\d+-\d+-\d+)\s(?\d+:\d+:\d+).*[i]n hotWarmPath=(?.*) -## use of "IN" keyword(case insensitivity) to extract from source_field -EXTRACT-four = (?.*) IN hotWarmPath +# Two Groups with in regex as a regex and not a keyword +EXTRACT-fourteen = (?\d+-\d+-\d+).*in hotWarmPath=(?.*) REPORT-g1 = ta_fiction_onefish REPORT-g2 = ta_fiction_twofish From ae757d00e8d09e0456841a44bf3e17862342531b Mon Sep 17 00:00:00 2001 From: "Bhargav Nariyani (C)" Date: Wed, 1 Apr 2020 20:56:36 +0530 Subject: [PATCH 2/4] ACD-4055 Updated Broken Case and Count --- tests/addons/TA_broken_sourcetype/default/props.conf | 2 +- tests/test_splunk_addon.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/addons/TA_broken_sourcetype/default/props.conf b/tests/addons/TA_broken_sourcetype/default/props.conf index 8d1d2d8f5..e91d6474f 100644 --- a/tests/addons/TA_broken_sourcetype/default/props.conf +++ b/tests/addons/TA_broken_sourcetype/default/props.conf @@ -11,7 +11,7 @@ EVAL-used_in_extract = "use_this_in_extract" EXTRACT-incorrect_extract = (?.*) in used_in_extract ## Here in is used as a regex and hotWarmPath is not a SOURCE_KEY hence in should be enclosed as [i]n ## Since in is not enclosed as [i]n, this would fail -EXTRACT-broken_one = (?.*) [i]n hotWarmPath +EXTRACT-broken_one = (?.*) in hotWarmPath # Without lookup name LOOKUP-test_no_lookup = component OUTPUT context_test diff --git a/tests/test_splunk_addon.py b/tests/test_splunk_addon.py index 370f6dd6e..1c4124197 100644 --- a/tests/test_splunk_addon.py +++ b/tests/test_splunk_addon.py @@ -136,7 +136,7 @@ def empty_method(): "\n".join(result.stdout.lines), "\n".join(result.stderr.lines), ) - result.assert_outcomes(passed=294, failed=0) + result.assert_outcomes(passed=371, failed=0) # make sure that that we get a '0' exit code for the testsuite assert result.ret == 0 @@ -186,7 +186,7 @@ def empty_method(): "\n".join(result.stdout.lines), "\n".join(result.stderr.lines), ) - result.assert_outcomes(passed=99, failed=31) + result.assert_outcomes(passed=99, failed=33) # The test suite should fail as this is a negative test assert result.ret != 0 From faddb055024b17dfc05763a89d59d3447e1efce1 Mon Sep 17 00:00:00 2001 From: "Bhargav Nariyani (C)" Date: Thu, 2 Apr 2020 13:35:15 +0530 Subject: [PATCH 3/4] ADDON-4055 Updating tests for extract --- .../TA_broken_sourcetype/default/props.conf | 8 +- tests/addons/TA_fiction/default/props.conf | 41 ++++--- tests/constants.py | 100 +++++++++++++----- 3 files changed, 95 insertions(+), 54 deletions(-) diff --git a/tests/addons/TA_broken_sourcetype/default/props.conf b/tests/addons/TA_broken_sourcetype/default/props.conf index aa0eae85b..c97d32335 100644 --- a/tests/addons/TA_broken_sourcetype/default/props.conf +++ b/tests/addons/TA_broken_sourcetype/default/props.conf @@ -12,14 +12,14 @@ EXTRACT-one = group=(?[^,]+) EVAL-one = "working" EVAL-two = one -# Component tested: EVAL +# Component tested: EXTRACT # Scenario: source_field is used from EVAL and will not be available in splunk hence this extracting fields from it would fail. # Expected result: FAIL EVAL-used_in_extract = "use_this_in_extract" -## source_field from EVAL hence this extract would fail EXTRACT-incorrect_extract = (?.*) in used_in_extract -## Here in is used as a regex and hotWarmPath is not a SOURCE_KEY hence in should be enclosed as [i]n -## Since in is not enclosed as [i]n, this would fail +# Component tested: EXTRACT +# Scenario: Here in is used as a regex and hotWarmPath is not a SOURCE_KEY hence in should be enclosed as [i]n +# Expected result: FAIL EXTRACT-broken_one = (?.*) in hotWarmPath # Component tested: LOOKUP diff --git a/tests/addons/TA_fiction/default/props.conf b/tests/addons/TA_fiction/default/props.conf index c9d5a42bb..e3d84652f 100644 --- a/tests/addons/TA_fiction/default/props.conf +++ b/tests/addons/TA_fiction/default/props.conf @@ -1,9 +1,5 @@ ######## All the scenarios mentioned here are expected to PASS ######## #Copyright Splunk -[source::/opt/splunk/var/log/splunk/splunkd.log*] -sourcetype = splunkd -EVAL-component = "test" -FIELDALIAS-nine = extractone AS aliasthirteen # Component tested: source, EVAL # Scenario: Data must be present in the respective source=”/opt/splunk/var/log/splunk/splunkd.log*” @@ -35,48 +31,51 @@ EXTRACT-one = group=(?[^,]+) EXTRACT-two = group=(?[^,]+).*name=(?[^,]+) # Component tested: extract (?Pregex) -# Scenario: single field extraction so the plugin tests if the field `extractone` is extracted. +# Scenario: single field extraction so the plugin tests if the field `extractthree` is extracted. EXTRACT-three = group=(?P[^,]+) -# multiple field extraction (?Pregex) +# Component tested: extract (?Pregex) +# Scenario: multiple field extraction so the plugin generates multiple tests one individual for each extracted field +## and one test with combinatory query which tests all the fields must be extracted from a single event. EXTRACT-four = group=(?P[^,]+).*name=(?P[^,]+) -# single field extraction (?'name'regex) +# Component tested: extract (?'name'regex) +# Scenario: single field extraction so the plugin tests if the field `extractfive` is extracted. EXTRACT-five = group=(?'extractfive'[^,]+) -# multiple field extraction (?'name'regex) +# Component tested: extract (?'name'regex) +# Scenario: multiple field extraction so the plugin generates multiple tests one individual for each extracted field +## and one test with combinatory query which tests all the fields must be extracted from a single event. EXTRACT-six = group=(?'extractsixA'[^,]+).*name=(?'extractsixB'[^,]+) -# multiple field extraction combination of regex formats +# Component tested: extract ((?regex)) + (?'name'regex) + (?Pregex) +# Scenario: multiple field extraction so the plugin generates multiple tests one individual for each extracted field +## and one test with combinatory query which tests all the fields must be extracted from a single event. EXTRACT-seven = group=(?[^,]+).*name=(?'extractsevenB'[^,]+).*instantaneous_kbps=(?P[^,]+) # Component tested: extract -# Scenario: "in" used as a regex and not as a keyword so the plugin tests if the field `hotWarmPath` is extracted or not using search queries +# Scenario: "in" used as a regex and not as a keyword so the plugin tests if the field `hotwarmpath_extract` is extracted or not using search queries EXTRACT-0 = in hotWarmPath=(?.*) # Component tested: extract -# Scenario: use of "in" or "IN" keyword to extract from source_field +# Scenario: use of "in","IN","In","iN" keyword to extract from source_field ## tests the fields extracted as mentioned in above scenario extracting multiple fields. ## tests that if source_field is present or not ## and one test with combinatory query containing all the fields and source_field making sure that fields must be extracted from the source_field. EXTRACT-eight = (?.*) in hotwarmpath_extract - -#use of "IN" keyword(case insensitivity) to extract from source_field EXTRACT-nine = (?.*) IN hotwarmpath_extract - -#use of "In" keyword to extract from source_field EXTRACT-ten = (?.*) In hotwarmpath_extract - -#use of "iN" keyword to extract from source_field EXTRACT-eleven = (?.*) iN hotwarmpath_extract -# Multiple field extracted using in from source_field +# Component tested: extract +# Scenario: use of "in","IN","In","iN" keyword to extract multiple fields from source_field +## tests that if source_field is present or not +## and one test with combinatory query containing all the fields and source_field making sure that fields must be extracted from the source_field. EXTRACT-twelve = (?opt)\/splunk(?.*) in hotwarmpath_extract -# Multiple Groups with [i]n regex as a regex and not a keyword +# Component tested: extract +# Scenario: "in" used as a regex and not as a keyword so the plugin tests if multiple fields are extracted or not using search queries EXTRACT-thirteen = (?\d+-\d+-\d+)\s(?\d+:\d+:\d+).*[i]n hotWarmPath=(?.*) - -# Two Groups with in regex as a regex and not a keyword EXTRACT-fourteen = (?\d+-\d+-\d+).*in hotWarmPath=(?.*) # The explanation of the REPORT scenarios is explained in transforms.conf diff --git a/tests/constants.py b/tests/constants.py index 5d02e04fb..1663ca193 100644 --- a/tests/constants.py +++ b/tests/constants.py @@ -10,27 +10,45 @@ "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-0* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractone* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-one* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoA* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoB* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractthree* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-three* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourB* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-four* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reportone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-g1::ta_fiction_onefish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reporttwofishA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reporttwofishB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-g2::ta_fiction_twofish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reportred* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-g3::ta_fiction_redfish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reportblueA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::reportblueB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-g3::ta_fiction_bluefish* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfive* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-five* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixB* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-six* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenB* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenC* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-seven* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-0* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eight* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-nine* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_In* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-ten* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_iN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eleven* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_opt* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_other* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-twelve* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::time_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_multiple* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-thirteen* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_only_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_two* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-fourteen* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::day_id* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::event_id* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::end_time* PASSED*", @@ -102,27 +120,45 @@ "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-0* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractone* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-one* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoA* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoB* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractthree* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-three* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourB* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-four* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reportone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-g1::ta_fiction_onefish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reporttwofishA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reporttwofishB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-g2::ta_fiction_twofish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reportred* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-g3::ta_fiction_redfish* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reportblueA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::reportblueB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-g3::ta_fiction_bluefish* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfive* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-five* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixB* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-six* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenA* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenB* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenC* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-seven* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-0* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eight* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-nine* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_In* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-ten* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_iN* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eleven* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_opt* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_other* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-twelve* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::time_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_multiple* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-thirteen* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_only_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_two* PASSED*", + "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fourteen* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::day_id* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::event_id* PASSED*", "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::end_time* PASSED*", @@ -206,6 +242,7 @@ """ TA_BROKEN_SOURCETYPE_PASSED = [ "*test_splunk_app_broken_sourcetype.py::Test_App::test_splunk_internal_errors PASSED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*source::...none...* PASSED*" "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::splunkd* PASSED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::one* PASSED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::used_in_extract* PASSED*", @@ -259,6 +296,9 @@ "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasthree* PASSED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid*::notvalid* PASSED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*none*::none* PASSED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::broken_extract* PASSED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath* PASSED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-broken_one* PASSED*", '*test_splunk_app_broken_sourcetype.py::Test_App::test_tags*sourcetype="splunkd" | tags_negative_testing=enabled* PASSED*', ] @@ -268,12 +308,14 @@ TA_BROKEN_SOURCETYPE_FAILED = [ "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::notvalid* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*source::...notvalid...* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*source::...none...* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid_field::extractone* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid::EXTRACT-one* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::two* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::incorrect_extract* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-incorrect_extract* FAILED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::broken_extract* FAILED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::hotWarmPath* FAILED*", + "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-broken_one* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::OUTPUT* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_lookup* FAILED*", "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_inputfield* FAILED*", From 32fb356483a0408812b1bd0d3d9c33bfe27bcb0c Mon Sep 17 00:00:00 2001 From: "Rinkal Domadiya (C)" Date: Fri, 3 Apr 2020 13:18:58 +0530 Subject: [PATCH 4/4] Updated the lookup, source stanza and constant file --- .../TA_broken_sourcetype/default/props.conf | 28 +- .../lookups/ta_fiction_splund_component.csv | 6 +- tests/constants.py | 648 +++++++++--------- 3 files changed, 339 insertions(+), 343 deletions(-) diff --git a/tests/addons/TA_broken_sourcetype/default/props.conf b/tests/addons/TA_broken_sourcetype/default/props.conf index c97d32335..82a7784dd 100644 --- a/tests/addons/TA_broken_sourcetype/default/props.conf +++ b/tests/addons/TA_broken_sourcetype/default/props.conf @@ -30,28 +30,28 @@ LOOKUP-test_no_lookup = component OUTPUT context_test # Component tested: LOOKUP # Scenario: With non-existing lookup name # Expected result: FAIL -LOOKUP-test_nonexistent_lookup = Lookup_NAN component OUTPUT context_test +LOOKUP-test_nonexistent_lookup = Lookup_NAN component OUTPUT context_test_1 # Component tested: LOOKUP # Scenario: Lookup without input field so the output_fields will not be there. # Expected result: FAIL -LOOKUP-test_no_inputfield = ta_ficition_lookup OUTPUT context_test +LOOKUP-test_no_inputfield = ta_ficition_lookup OUTPUT context_test_2 # Component tested: LOOKUP # Scenario: non_existing output_field with output/outputnew so the tests for output_field will fail. # Expected result: FAIL -LOOKUP-test_wrong_output = ta_ficition_lookup component output context_test -LOOKUP-test_wrong_outputnew = ta_ficition_lookup component outputnew context_test +LOOKUP-test_wrong_output = ta_ficition_lookup component output non_existing +LOOKUP-test_wrong_outputnew = ta_ficition_lookup component outputnew non_existing_1 # Component tested: LOOKUP # Scenario: Empty lookup file so no tests are generated for the output_fields. # Expected result: PASS -LOOKUP-test_empty_csv = empty_lookup component context_test +LOOKUP-test_empty_csv = empty_lookup component context_test_3 # Component tested: LOOKUP # Scenario: Wrong lookup file and no output fields # Expected result: PASS -LOOKUP-test_lookup_not_found = NaN_lookup component context_test +LOOKUP-test_lookup_not_found = NaN_lookup component context_test_4 REPORT-tsc-delim-fields = tsc-delim-fields @@ -70,18 +70,4 @@ FIELDALIAS-one = name AS aliasone # Scenario: Plugin searches for the original field and one or more alias field names. # Expected result: FAIL FIELDALIAS-two = nofield AS aliasone -FIELDALIAS-three = one AS aliasthree - - -# Component tested: source, sourcetypes -# Expected result: FAIL -[source::...notvalid...] -sourcetype = notvalid - -# Component tested: source, sourcetype -# The settings provided by the pattern [source::...none...] take -# precedence over those provided by [source::...notvalid...], and sourcetype ends up -# with "none" as its value. -# Expected result: PASS -[source::...none...] -sourcetype = none +FIELDALIAS-three = one AS aliasthree \ No newline at end of file diff --git a/tests/addons/TA_broken_sourcetype/lookups/ta_fiction_splund_component.csv b/tests/addons/TA_broken_sourcetype/lookups/ta_fiction_splund_component.csv index 4b90a6d17..cc44471d6 100644 --- a/tests/addons/TA_broken_sourcetype/lookups/ta_fiction_splund_component.csv +++ b/tests/addons/TA_broken_sourcetype/lookups/ta_fiction_splund_component.csv @@ -1,3 +1,3 @@ -component ,context_test -Metrics ,Insights -LMStackMgr,Costs +component ,context_test ,context_test_1 ,context_test_2 ,context_test_3 ,context_test_4 +Metrics ,Insights,Insights,Insights,Insights,Insights +LMStackMgr,Costs,Costs,Costs,Costs,Costs diff --git a/tests/constants.py b/tests/constants.py index 1663ca193..cdbf74c6a 100644 --- a/tests/constants.py +++ b/tests/constants.py @@ -3,237 +3,241 @@ Define the TA_fiction add-on passed test case list. """ TA_FICTION_PASSED = [ - "*test_splunk_app_fiction.py::Test_App::test_splunk_internal_errors PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_stanza*source::/opt/splunk/var/log/splunk/splunkd.log* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_stanza*source::...(/opt/splunk/var/log/splunk/)(metrics.log*|health.log*)* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_stanza*sourcetype::splunkd* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-one* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractthree* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-three* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-four* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfive* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-five* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-six* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenC* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-seven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-0* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eight* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_IN* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-nine* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_In* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-ten* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_iN* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eleven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_opt* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_other* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-twelve* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_value_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::time_value_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-thirteen* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_only_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-fourteen* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::day_id* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::event_id* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::end_time* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::start_time* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::component* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::comp* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::server_contact_mode* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::dest* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-delim-format::tsc-sk-delim-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex::tsc-regex* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::size1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::size2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::myeval* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliastwo* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasthree* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasfour* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasfive* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliassix* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasseven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliaseight* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasnine* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasten* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliaseleven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliastwelve* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_output1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_output2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_output3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup_test_command_spelling_output4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookuptest_command_spelling_output5* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup-test_command_spelling_output6* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup_test_command_spelling_outputnew4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookuptest_command_spelling_outputnew5* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup-test_command_spelling_outputnew6* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::name* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status.test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_string_outputfield* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status_test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::test_name* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::type* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-one* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractthree* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-three* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-four* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfive* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-five* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-six* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenA* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenB* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenC* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-seven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-0* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eight* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_IN* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-nine* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_In* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-ten* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_iN* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eleven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_opt* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_other* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-twelve* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_value_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::time_value_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-thirteen* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_only_in_hotwarmpath_event* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_two* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fourteen* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::day_id* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::event_id* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::end_time* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::start_time* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::component* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::comp* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::server_contact_mode* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::dest* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-delim-format::tsc-sk-delim-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex::tsc-regex* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::size1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::size2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::myeval* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasone* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliastwo* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasthree* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasfour* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliassix* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasfive* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasseven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliaseight* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasnine* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasten* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliaseleven* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliastwelve* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_output1* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_output2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_output3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup_test_command_spelling_output4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookuptest_command_spelling_output5* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup-test_command_spelling_output6* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup_test_command_spelling_outputnew4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookuptest_command_spelling_outputnew5* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup-test_command_spelling_outputnew6* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::name* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative3* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status2* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative4* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_keyword* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status.test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_string_outputfield* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_output* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status_test* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::test_name* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::type* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_output* PASSED*", + '*test_splunk_app_fiction.py::Test_App::test_splunk_internal_errors PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_stanza*source::/opt/splunk/var/log/splunk/splunkd.log** PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_stanza*source::...(/opt/splunk/var/log/splunk/)(metrics.log*|health.log*)* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_stanza*sourcetype::splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/metrics.log*::splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/health.log*::splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractone* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-one* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extracttwoB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-two* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractthree* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-three* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfourB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-four* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractfive* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-five* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsixB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-six* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::extractsevenC* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-seven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-0* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eight* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_IN* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-nine* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_In* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-ten* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_iN* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-eleven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_opt* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotWarmPath_in_other* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-twelve* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_value_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::time_value_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-thirteen* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::date_only_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::hotwarmpath_extract_two* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::EXTRACT-fourteen* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::day_id* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::event_id* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::end_time* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::start_time* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::component* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::comp* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::server_contact_mode* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::dest* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-delim-format::tsc-sk-delim-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex-format::tsc-regex* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::size1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::size2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::myeval* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasone* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliastwo* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasthree* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasfour* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasfive* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliassix* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasseven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliaseight* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasten* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliasnine* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliaseleven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::aliastwelve* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_output1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_output2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_output3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup_test_command_spelling_output4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookuptest_command_spelling_output5* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup-test_command_spelling_output6* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup_test_command_spelling_outputnew4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookuptest_command_spelling_outputnew5* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::lookup-test_command_spelling_outputnew6* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::name* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test_alternative4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status.test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_string_outputfield* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::context_test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::status_test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::test_name* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd_field::type* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/splunkd.log*_field::component* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/metrics.log*::splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/health.log*::splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/metrics.log*_field::splunk_server* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/health.log*_field::splunk_server* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractone* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-one* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extracttwoB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-two* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractthree* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-three* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfourB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-four* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractfive* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-five* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsixB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-six* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenA* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenB* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::extractsevenC* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-seven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-0* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eight* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_IN* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-nine* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_In* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-ten* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_iN* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-eleven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_opt* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath_in_other* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-twelve* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_value_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::time_value_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-thirteen* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::date_only_in_hotwarmpath_event* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotwarmpath_extract_two* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fourteen* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::day_id* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::event_id* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::end_time* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::start_time* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::component* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::comp* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::server_contact_mode* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::dest* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-delim-format::tsc-sk-delim-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex-format::tsc-regex* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::size1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::size2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::myeval* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasone* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliastwo* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasthree* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasfour* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasfive* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliassix* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasseven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliaseight* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasten* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasnine* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliaseleven* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliastwelve* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_output1* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_output2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_output3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup_test_command_spelling_output4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookuptest_command_spelling_output5* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup-test_command_spelling_output6* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup_test_command_spelling_outputnew4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookuptest_command_spelling_outputnew5* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::lookup-test_command_spelling_outputnew6* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::name* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative3* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status2* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_alternative4* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_keyword* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status.test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_string_outputfield* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_output* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::status_test* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::test_name* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::type* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_output* PASSED*', '*test_splunk_app_fiction.py::Test_App::test_tags*eventtype="for_tags_positive" | tags_positive_event=enabled* PASSED*', '*test_splunk_app_fiction.py::Test_App::test_tags*eventtype="for_tags_positive" | tags_disabled_event=disabled* PASSED*', '*test_splunk_app_fiction.py::Test_App::test_tags*source="/opt/splunk/var/log/splunk/splunkd.log" | tags_positive_event=enabled* PASSED*', '*test_splunk_app_fiction.py::Test_App::test_tags*source="/opt/splunk/var/log/splunk/splunkd.log" | tags_disabled_event=disabled* PASSED*', - "*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::is_splunkd* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::for_tags_positive* PASSED*", - "*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::is_splunkd-%host%* PASSED*" + '*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::is_splunkd* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::for_tags_positive* PASSED*', + '*test_splunk_app_fiction.py::Test_App::test_eventtype*eventtype::is_splunkd-%host%* PASSED*' ] @@ -241,104 +245,110 @@ Define the TA_broken_sourcetype add-on passed test case list. """ TA_BROKEN_SOURCETYPE_PASSED = [ - "*test_splunk_app_broken_sourcetype.py::Test_App::test_splunk_internal_errors PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*source::...none...* PASSED*" - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::splunkd* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::one* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::used_in_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::component* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_nonexistent_lookup* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_empty_csv* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_lookup_not_found* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::thread* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::comp* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field1* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field2* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::name* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid_field::extractone* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid::EXTRACT-one* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::one* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::two* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::used_in_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::incorrect_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-incorrect_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::OUTPUT* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_lookup* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::component* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_nonexistent_lookup* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_inputfield* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::output* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_wrong_output* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::outputnew* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_wrong_outputnew* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_empty_csv* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_lookup_not_found* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::thread* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::delim_field1* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::delim_field2* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::comp* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::non_existing_field_as_source_key* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::server_contact_mode* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::dest* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-delim-format::contact_mode_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field1* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field2* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field3* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasone* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::name* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::nofield* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasthree* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid*::notvalid* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*none*::none* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::broken_extract* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath* PASSED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-broken_one* PASSED*", - '*test_splunk_app_broken_sourcetype.py::Test_App::test_tags*sourcetype="splunkd" | tags_negative_testing=enabled* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_splunk_internal_errors PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::splunkd* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::one* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::used_in_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::component* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::thread* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::comp* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field1* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field2* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::name* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid_field::extractone* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*notvalid::EXTRACT-one* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::one* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::two* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::used_in_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::incorrect_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-incorrect_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::broken_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::hotWarmPath* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-broken_one* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::OUTPUT* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_lookup* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::component* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_1* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_nonexistent_lookup* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_2* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_3* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::context_test_4* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_inputfield* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::output* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::non_existing* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_wrong_output* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::outputnew* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::non_existing_1* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_wrong_outputnew* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_empty_csv* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_lookup_not_found* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::thread* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::delim_field1* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::delim_field2* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::comp* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-regex-format::tsc-sk-regex-format* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::non_existing_field_as_source_key* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::server_contact_mode* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::dest* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-sk-delim-format::contact_mode_extract* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field1* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field2* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::field3* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-tsc-regex-format::tsc-regex-format* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasone* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::name* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::nofield* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields_no_dash_not_empty*splunkd_field::aliasthree* PASSED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_tags*sourcetype="splunkd" | tags_negative_testing=enabled* PASSED*' ] """ Define the TA_broken_sourcetype add-on failed test case list. """ TA_BROKEN_SOURCETYPE_FAILED = [ - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::notvalid* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*source::...notvalid...* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid_field::extractone* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid::EXTRACT-one* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::two* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::incorrect_extract* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-incorrect_extract* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::broken_extract* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::hotWarmPath* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-broken_one* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::OUTPUT* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_lookup* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_inputfield* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::output* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_wrong_output* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::outputnew* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_wrong_outputnew* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::delim_field1* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::delim_field2* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::non_existing_field_as_source_key* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::server_contact_mode* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::dest* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-delim-format::contact_mode_extract* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field3* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex-format::tsc-regex-format* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::aliasone* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::nofield* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::aliasthree* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid*::notvalid* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*none*::none* FAILED*", + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_stanza*sourcetype::notvalid* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid_field::extractone* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*notvalid::EXTRACT-one* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::two* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::incorrect_extract* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-incorrect_extract* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::broken_extract* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::hotWarmPath* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::EXTRACT-broken_one* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::OUTPUT* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_lookup* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test_1* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_nonexistent_lookup* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test_2* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test_3* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::context_test_4* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_inputfield* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::output* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::non_existing* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_wrong_output* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::outputnew* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::non_existing_1* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_wrong_outputnew* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_empty_csv* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::LOOKUP-test_lookup_not_found* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::delim_field1* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::delim_field2* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-delim-fields::tsc-delim-fields* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::non_existing_field_as_source_key* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::server_contact_mode* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::dest* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-sk-delim-format::contact_mode_extract* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::field3* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd::REPORT-tsc-regex-format::tsc-regex-format* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::aliasone* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::nofield* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_props_fields*splunkd_field::aliasthree* FAILED*', '*test_splunk_app_broken_sourcetype.py::Test_App::test_tags*RandomField="RandomValue" | RandomTag=enabled* FAILED*', '*test_splunk_app_broken_sourcetype.py::Test_App::test_tags*source="/opt/splunk/var/log/splunk/splunkd.log" | tags_negative_testing=disabled* FAILED*', - "*test_splunk_app_broken_sourcetype.py::Test_App::test_eventtype*eventtype::is_splunkd* FAILED*", - "*test_splunk_app_broken_sourcetype.py::Test_App::test_eventtype*eventtype::is_splunkd-%host%* FAILED*", + '*test_splunk_app_broken_sourcetype.py::Test_App::test_eventtype*eventtype::is_splunkd* FAILED*', + '*test_splunk_app_broken_sourcetype.py::Test_App::test_eventtype*eventtype::is_splunkd-%host%* FAILED*' ]