File tree Expand file tree Collapse file tree 3 files changed +25
-10
lines changed Expand file tree Collapse file tree 3 files changed +25
-10
lines changed Original file line number Diff line number Diff line change 1414# limitations under the License.
1515#
1616import json
17-
1817from .base_event_ingestor import EventIngestor
1918import requests
2019from time import time , mktime
Original file line number Diff line number Diff line change @@ -190,11 +190,14 @@ def generate_requirements_datamodels_tests(self):
190190 datamodel .replace (" " , "_" ).replace (":" , "_" )
191191 for datamodel in datamodels
192192 ]
193- yield pytest .param (
194- {
193+ sample_event = {
195194 "datamodels" : datamodels ,
196195 "stanza" : escaped_event ,
197- },
196+ }
197+ if event .metadata ["ingest_with_uuid" ] == "true" :
198+ sample_event ["unique_identifier" ] = event .unique_identifier
199+ yield pytest .param (
200+ sample_event ,
198201 id = f"{ '-' .join (datamodels )} ::sample_name::{ event .sample_name } ::host::{ event .metadata .get ('host' )} " ,
199202 )
200203
Original file line number Diff line number Diff line change @@ -401,21 +401,34 @@ def test_datamodels(
401401 record_property (fixture): Document facts of test cases to provide more info in the test failure reports.
402402 caplog (fixture): fixture to capture logs.
403403 """
404- esacaped_event = splunk_searchtime_fields_datamodels ["stanza" ]
404+ escaped_event = splunk_searchtime_fields_datamodels ["stanza" ]
405405 datamodels = splunk_searchtime_fields_datamodels ["datamodels" ]
406- self .logger .info (
407- f"Testing for tag { datamodels } with tag_query { esacaped_event } "
408- )
409406
410- record_property ("Event_with" , esacaped_event )
407+ record_property ("Event_with" , escaped_event )
411408 record_property ("datamodels" , datamodels )
412409
413410 index_list = (
414411 "(index="
415412 + " OR index=" .join (splunk_search_util .search_index .split ("," ))
416413 + ")"
417414 )
418- search = f"search { index_list } { esacaped_event } | fields *"
415+
416+ if splunk_searchtime_fields_datamodels .get ("unique_identifier" ):
417+ record_property (
418+ "stanza_name" , splunk_searchtime_fields_datamodels ["unique_identifier" ]
419+ )
420+ unique_identifier = splunk_searchtime_fields_datamodels ["unique_identifier" ]
421+
422+ self .logger .info (
423+ f"Testing for tag { datamodels } with unique_identifier=\" { unique_identifier } \" "
424+ )
425+
426+ search = f"search { index_list } unique_identifier=\" { unique_identifier } \" | fields *"
427+ else :
428+ self .logger .info (
429+ f"Testing for tag { datamodels } with tag_query { escaped_event } "
430+ )
431+ search = f"search { index_list } { escaped_event } | fields *"
419432
420433 self .logger .info (f"Search: { search } " )
421434
You can’t perform that action at this time.
0 commit comments