Skip to content

Commit 1756fc8

Browse files
nandinivijnandinivij
authored
feat: Scripted input support requirement test (#442)
* feat: Scripted input support requirement test * added transport type file monitor
1 parent d98c97d commit 1756fc8

File tree

7 files changed

+163
-12
lines changed

7 files changed

+163
-12
lines changed

‎pytest_splunk_addon/standard_lib/event_ingestors/requirement_event_ingester.py

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,25 @@ def get_events(self):
162162
LOGGER.info(
163163
f"sending data transport_type:forwarder/uf_file_monitor filename:{filename} "
164164
)
165+
elif transport_type in (
166+
"scripted_input",
167+
"scripted input",
168+
"hec_raw",
169+
):
170+
transport_type = "scripted_input"
171+
host, source, sourcetype = self.extract_params(
172+
event_tag
173+
)
174+
LOGGER.info(
175+
f"sending data transport_type:scripted_input or hec_raw filename:{filename} "
176+
)
177+
elif transport_type == "file_monitor":
178+
host, source, sourcetype = self.extract_params(
179+
event_tag
180+
)
181+
LOGGER.info(
182+
f"sending data transport_type:file_monitor filename:{filename} "
183+
)
165184
else:
166185
transport_type = "default"
167186
unescaped_event = self.extract_raw_events(event_tag)

‎pytest_splunk_addon/standard_lib/requirement_tests/test_generator.py

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,11 @@ def generate_cim_req_params(self):
150150
"dbx",
151151
"windows_input",
152152
"hec_event",
153+
"scripted_input",
154+
"scripted input",
155+
"hec_raw",
156+
"file_monitor",
157+
"forwarder",
153158
):
154159
host, source, sourcetype = self.extract_params(event_tag)
155160
host, source, sourcetype = self.escape_host_src_srctype(
@@ -160,18 +165,8 @@ def generate_cim_req_params(self):
160165
"source": source,
161166
"sourcetype": sourcetype,
162167
}
163-
elif transport_type.lower() == "forwarder":
164-
host, source, sourcetype = self.extract_params(event_tag)
165-
host, source, sourcetype = self.escape_host_src_srctype(
166-
host, source, sourcetype
167-
)
168-
transport_type_params = {
169-
"host": host,
170-
"source": source,
171-
"sourcetype": sourcetype,
172-
}
173168
else:
174-
# todo: non syslog/modinput events are skipped currently until we support it
169+
# todo: non syslog/modinput/non forwarder/scripted_input events are skipped currently until we support it
175170
continue
176171

177172
escaped_event = self.escape_char_event(unescaped_event)

‎tests/constants.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -770,3 +770,12 @@
770770
TA_REQUIREMENTS_UF_FAILED = [
771771
"*test_splunk_app_requirements_uf.py::Test_App::test_requirement_params* FAILED*",
772772
]
773+
774+
TA_REQUIREMENTS_SCRIPTED_PASSED = [
775+
"*test_splunk_app_requirements_scripted.py::Test_App::test_events_with_untokenised_values* PASSED*",
776+
"*test_splunk_app_requirements_scripted.py::Test_App::test_requirement_params* PASSED*",
777+
]
778+
779+
TA_REQUIREMENTS_SCRIPTED_FAILED = [
780+
"*test_splunk_app_requirements_scripted.py::Test_App::test_requirement_params* FAILED*",
781+
]

‎tests/requirement_test_scripted/sample_requirement_test_scripted.log

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0"?>
2+
<device>
3+
<vendor>Nix</vendor>
4+
<product>Nix</product>
5+
<version id="6,7" os="CentOS"/>
6+
<version id="6.9,7.4,8.0" os="RHEL"/>
7+
<version id="16.04" os="Ubuntu"/>
8+
<version id="10,11,11.3" os="Solaris"/>
9+
<version id="10.11,10.12" os="MAC OS X"/>
10+
<event code="" name="service" format="">
11+
<transport type="scripted input" host="sample_host" source="Unix:Service" sourcetype ="Unix:Service" />
12+
<source>
13+
<comment>Unix service information. Data is collected from live instance. Data is generated from systemctl command. </comment>
14+
</source>
15+
<raw>
16+
<![CDATA[Tue May 26 01:38:02 PDT 2020 type=systemctl UNIT=whoopsie.service, LOADED=not-found, ACTIVE=inactive, SUB=dead, DESCRIPTION="whoopsie.service"]]>
17+
</raw>
18+
<cim>
19+
<models>
20+
<model>Endpoint:Services</model>
21+
</models>
22+
<cim_fields>
23+
<field name="service" value="whoopsie.service"/>
24+
<field name="service_name" value="whoopsie.service"/>
25+
<field name="status" value="stopped"/>
26+
<field name="start_mode" value="Auto"/>
27+
<field name="vendor_product" value="nix"/>
28+
</cim_fields>
29+
<missing_recommended_fields>
30+
<field>service_id</field>
31+
<field>service_path</field>
32+
<field>user</field>
33+
</missing_recommended_fields>
34+
</cim>
35+
<test></test>
36+
</event>
37+
</device>

‎tests/requirement_test_scripted/sample_requirement_test_scripted_failure.log

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0"?>
2+
<device>
3+
<vendor>Nix</vendor>
4+
<product>Nix</product>
5+
<version id="6,7" os="CentOS"/>
6+
<version id="6.9,7.4,8.0" os="RHEL"/>
7+
<version id="16.04" os="Ubuntu"/>
8+
<version id="10,11,11.3" os="Solaris"/>
9+
<version id="10.11,10.12" os="MAC OS X"/>
10+
<event code="" name="service" format="">
11+
<transport type="scripted input" host="sample_host" source="Unix:Service" sourcetype ="Unix:Service" />
12+
<source>
13+
<comment>Unix service information. Data is collected from live instance. Data is generated from systemctl command. </comment>
14+
</source>
15+
<raw>
16+
<![CDATA[Tue May 26 01:38:02 PDT 2020 type=systemctl UNIT=whoopsie.service, LOADED=not-found, ACTIVE=inactive, SUB=dead, DESCRIPTION="whoopsie.service"]]>
17+
</raw>
18+
<cim>
19+
<models>
20+
<model>Endpoint:Services</model>
21+
</models>
22+
<cim_fields>
23+
<field name="dest" value="qa-ubuntu-105"/>
24+
<field name="service" value="whoopsie.service"/>
25+
<field name="service_name" value="whoopsie.service"/>
26+
<field name="status" value="stopped"/>
27+
<field name="start_mode" value="Auto"/>
28+
<field name="vendor_product" value="nix"/>
29+
</cim_fields>
30+
<missing_recommended_fields>
31+
<field>service_id</field>
32+
<field>service_path</field>
33+
<field>user</field>
34+
</missing_recommended_fields>
35+
</cim>
36+
<test></test>
37+
</event>
38+
</device>

‎tests/requirement_test_uf/sample_requirement_test_uf_failure.log

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<version id="13.21" />
66
<event code="" name="failed_login1,sshd_authentication1" format="syslog">
77
<version id="7.2"/>
8-
<transport type="forwarder" host="sample_host" source="sample_source" sourcetype = "aix_secure" />
8+
<transport type="forwarder" host="sample_host2" source="sample_source2" sourcetype = "aix_secure" />
99
<source>
1010
<comment>Logs for Failed login attempt.(Live Sample)</comment>
1111
</source>

‎tests/test_splunk_addon.py

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ def setup_test_dir(testdir):
5454
),
5555
os.path.join(testdir.tmpdir, "tests/requirement_test_uf"),
5656
)
57+
shutil.copytree(
58+
os.path.join(
59+
testdir.request.config.invocation_dir, "tests/requirement_test_scripted"
60+
),
61+
os.path.join(testdir.tmpdir, "tests/requirement_test_scripted"),
62+
)
5763

5864
shutil.copy(
5965
os.path.join(testdir.request.config.invocation_dir, "Dockerfile.splunk"),
@@ -640,3 +646,50 @@ def empty_method():
640646

641647
# make sure that that we get a non '0' exit code for the testsuite as it contains failure
642648
assert result.ret != 0
649+
650+
651+
@pytest.mark.docker
652+
def test_splunk_app_requirements_scripted(testdir):
653+
"""Make sure that pytest accepts our fixture."""
654+
655+
testdir.makepyfile(
656+
"""
657+
from pytest_splunk_addon.standard_lib.addon_basic import Basic
658+
class Test_App(Basic):
659+
def empty_method():
660+
pass
661+
"""
662+
)
663+
664+
shutil.copytree(
665+
os.path.join(testdir.request.fspath.dirname, "addons/TA_requirement_test_uf"),
666+
os.path.join(testdir.tmpdir, "package"),
667+
)
668+
669+
setup_test_dir(testdir)
670+
SampleGenerator.clean_samples()
671+
Rule.clean_rules()
672+
673+
# run pytest with the following cmd args
674+
result = testdir.runpytest(
675+
"--splunk-type=docker",
676+
"-v",
677+
"-m splunk_searchtime_requirements",
678+
"--search-interval=4",
679+
"--search-retry=4",
680+
"--search-index=*,_internal",
681+
"--requirement-test=tests/requirement_test_scripted",
682+
)
683+
logger.info(result.outlines)
684+
logger.info(len(constants.TA_REQUIREMENTS_SCRIPTED_PASSED))
685+
logger.info(len(constants.TA_REQUIREMENTS_SCRIPTED_FAILED))
686+
result.stdout.fnmatch_lines_random(
687+
constants.TA_REQUIREMENTS_SCRIPTED_PASSED
688+
+ constants.TA_REQUIREMENTS_SCRIPTED_FAILED
689+
)
690+
result.assert_outcomes(
691+
passed=len(constants.TA_REQUIREMENTS_SCRIPTED_PASSED), failed=1
692+
)
693+
694+
# make sure that that we get a non '0' exit code for the testsuite as it contains failure
695+
assert result.ret != 0

0 commit comments

Comments
 (0)