fix: exception fields structure (#707)

Author: uoboda-splunk

.gitignore

@@ -31,4 +31,7 @@ docs/_build/
 .vscode
 test_report.md
 .idea/
-.python-version
+.python-version
+*.pickle
+*_events.lock
+*_events

pytest_splunk_addon/standard_lib/cim_tests/test_generator.py

@@ -262,25 +262,30 @@ def generate_recommended_fields_tests(self):
         for event in self.tokenized_events:
             if not event.requirement_test_data:
                 continue
-            for _, datamodel in event.requirement_test_data["datamodels"].items():
-                model, *datasets = datamodel.split(":")
-                model = model.replace(" ", "_")
-                if datasets:
-                    datasets = [dataset.replace(" ", "_") for dataset in datasets]
-
-                fields = (
-                    list(event.requirement_test_data["cim_fields"].keys())
-                    + event.requirement_test_data["missing_recommended_fields"]
-                )
-                for exception in event.requirement_test_data["exceptions"]:
-                    fields.append(exception["name"])
+            for _, datamodels in event.requirement_test_data["datamodels"].items():
+                if type(datamodels) is not list:
+                    datamodels = [datamodels]
+                for datamodel in datamodels:
+                    model, *datasets = datamodel.split(":")
+                    model = model.replace(" ", "_")
+                    if datasets:
+                        datasets = [dataset.replace(" ", "_") for dataset in datasets]
+
+                    fields = (
+                        list(event.requirement_test_data["cim_fields"].keys())
+                        + event.requirement_test_data["missing_recommended_fields"]
+                    )
+                    for exception, _ in event.requirement_test_data[
+                        "exceptions"
+                    ].items():
+                        fields.append(exception)
 
-                yield pytest.param(
-                    {
-                        "datamodel": model,
-                        "datasets": datasets,
-                        "fields": fields,
-                        "cim_version": event.requirement_test_data["cim_version"],
-                    },
-                    id=f"{model}-{'-'.join(datasets)}::sample_name::{event.sample_name}::host::{event.metadata.get('host')}",
-                )
+                    yield pytest.param(
+                        {
+                            "datamodel": model,
+                            "datasets": datasets,
+                            "fields": fields,
+                            "cim_version": event.requirement_test_data["cim_version"],
+                        },
+                        id=f"{model}-{'-'.join(datasets)}::sample_name::{event.sample_name}::host::{event.metadata.get('host')}",
+                    )

pytest_splunk_addon/standard_lib/fields_tests/test_generator.py

@@ -177,8 +177,11 @@ def generate_requirements_datamodels_tests(self):
             datamodels = event.requirement_test_data.get("datamodels")
             if datamodels:
                 if type(datamodels) is dict:
-                    datamodels = [datamodels]
-                datamodels = [dm["model"] for dm in datamodels]
+                    if type(datamodels["model"]) == list:
+                        datamodels = datamodels["model"]
+                    else:
+                        datamodels = [datamodels]
+                        datamodels = [dm["model"] for dm in datamodels]
             else:
                 datamodels = []
             datamodels = [

pytest_splunk_addon/standard_lib/fields_tests/test_templates.py

@@ -193,6 +193,8 @@ def test_requirements_fields(
             retries=splunk_search_util.search_retry,
         )
 
+        assert fields_from_splunk, f"Event was not returned with search: {search}"
+
         missing_fields = []
         wrong_value_fields = {}
 
@@ -414,6 +416,8 @@ def test_datamodels(
             retries=splunk_search_util.search_retry,
         )
 
+        assert fields_from_splunk, f"Event was not returned with search: {search}"
+
         extracted_tags = fields_from_splunk.get("tag", "")
         extracted_tags = extracted_tags.strip("][").split(", ")
         extracted_tags = [tag.replace("'", "") for tag in extracted_tags]

pytest_splunk_addon/standard_lib/sample_generation/sample_stanza.py

@@ -421,20 +421,14 @@ def populate_requirement_test_data(event):
                 "missing_recommended_fields"
             ] = missing_recommended_fields
 
-            defined_exceptions = cim.get("exceptions") or []
-            exceptions = []
+            defined_exceptions = cim.get("exceptions") or {}
+            exceptions = {}
             if defined_exceptions:
                 defined_fields = defined_exceptions["field"]
                 defined_fields = (
                     defined_fields if type(defined_fields) == list else [defined_fields]
                 )
                 for field in defined_fields:
-                    exceptions.append(
-                        {
-                            "name": field["@name"],
-                            "value": field["@value"],
-                            "reason": field["@reason"],
-                        }
-                    )
+                    exceptions[field["@name"]] = field["@value"]
             requirement_test_data["exceptions"] = exceptions
         return requirement_test_data

tests/unit/tests_standard_lib/tests_sample_generation/test_sample_stanza.py

@@ -325,7 +325,7 @@ def test_break_events_exception(self, sample_stanza, caplog):
                         "type": "event",
                     },
                     "datamodels": {"model": "Alerts"},
-                    "exceptions": [],
+                    "exceptions": {},
                     "missing_recommended_fields": ["app", "id", "user", "user_name"],
                 },
             ),
@@ -354,10 +354,7 @@ def test_break_events_exception(self, sample_stanza, caplog):
                     "cim_version": "4.20.2",
                     "cim_fields": {},
                     "datamodels": {},
-                    "exceptions": [
-                        {"name": "mane_1", "value": "value_1", "reason": "reason_1"},
-                        {"name": "dest", "value": "192.168.0.1", "reason": "reason"},
-                    ],
+                    "exceptions": {"mane_1": "value_1", "dest": "192.168.0.1"},
                     "missing_recommended_fields": [],
                 },
             ),