Skip to content

Commit 5af628c

Browse files
dvarasani-crestdvarasani-crest
authored
fix: token replacement for other mappings (#892)
This PR fixes the issue with the token replacement for the fields defined under `other_mappings` for the sample event. - Updated the e2e tests to cover the token replacement scenario for `other_mappings`
1 parent fb0a6d8 commit 5af628c

File tree

6 files changed

+65
-48
lines changed

6 files changed

+65
-48
lines changed

‎pytest_splunk_addon/sample_generation/sample_event.py‎

Lines changed: 48 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -290,11 +290,15 @@ def get_token_extractions_count(self, token):
290290
token (str): Token name
291291
"""
292292
tokens_in_extractions = 0
293-
if (
294-
self.requirement_test_data is not None
295-
and "cim_fields" in self.requirement_test_data.keys()
293+
if self.requirement_test_data is not None and (
294+
"cim_fields" in self.requirement_test_data.keys()
295+
or "other_fields" in self.requirement_test_data.keys()
296296
):
297-
for extracted_field in self.requirement_test_data["cim_fields"].values():
297+
field_values = [
298+
*self.requirement_test_data.get("cim_fields", {}).values(),
299+
*self.requirement_test_data.get("other_fields", {}).values(),
300+
]
301+
for extracted_field in field_values:
298302
if isinstance(extracted_field, str):
299303
tokens_in_extractions += len(re.findall(token, extracted_field))
300304
elif isinstance(extracted_field, list):
@@ -315,21 +319,24 @@ def replace_token(self, token, token_values):
315319
sample_tokens = re.finditer(token, self.event, flags=re.MULTILINE)
316320

317321
for _, token_value in enumerate(token_values):
318-
token_value = token_value.value
319-
match_object = next(sample_tokens)
320-
match_str = (
321-
match_object.group(0)
322-
if len(match_object.groups()) == 0
323-
else match_object.group(1)
324-
)
325-
match_str = re.escape(match_str)
326-
self.event = re.sub(
327-
match_str,
328-
lambda x: str(token_value),
329-
self.event,
330-
1,
331-
flags=re.MULTILINE,
332-
)
322+
try:
323+
token_value = token_value.value
324+
match_object = next(sample_tokens)
325+
match_str = (
326+
match_object.group(0)
327+
if len(match_object.groups()) == 0
328+
else match_object.group(1)
329+
)
330+
match_str = re.escape(match_str)
331+
self.event = re.sub(
332+
match_str,
333+
lambda x: str(token_value),
334+
self.event,
335+
1,
336+
flags=re.MULTILINE,
337+
)
338+
except StopIteration:
339+
break
333340
else:
334341
self.event = re.sub(
335342
token, lambda x: str(token_values), self.event, flags=re.MULTILINE
@@ -365,28 +372,30 @@ def update_requirement_test_field(self, field, token, token_values):
365372
token_values (list/str): Token value(s) which are replaced in the key fields
366373
"""
367374
if field != "_time":
368-
if (
369-
self.requirement_test_data is not None
370-
and "cim_fields" in self.requirement_test_data.keys()
375+
if self.requirement_test_data is not None and (
376+
"cim_fields" in self.requirement_test_data.keys()
377+
or "other_fields" in self.requirement_test_data.keys()
371378
):
372-
for cim_field, value in self.requirement_test_data[
373-
"cim_fields"
374-
].items():
375-
if token in value:
376-
if isinstance(token_values, list):
377-
if len(token_values) == 1:
378-
self.requirement_test_data["cim_fields"][
379-
cim_field
380-
] = value.replace(token, str(token_values[0].key))
379+
fields_key = ["cim_fields", "other_fields"]
380+
for key in fields_key:
381+
for field_name, value in self.requirement_test_data.get(
382+
key, {}
383+
).items():
384+
if token in value:
385+
if isinstance(token_values, list):
386+
if len(token_values) == 1:
387+
self.requirement_test_data[key][
388+
field_name
389+
] = value.replace(token, str(token_values[0].key))
390+
else:
391+
self.requirement_test_data[key][field_name] = [
392+
value.replace(token, str(token_value.key))
393+
for token_value in token_values
394+
]
381395
else:
382-
self.requirement_test_data["cim_fields"][cim_field] = [
383-
value.replace(token, str(token_value.key))
384-
for token_value in token_values
385-
]
386-
else:
387-
self.requirement_test_data["cim_fields"][
388-
cim_field
389-
] = value.replace(token, str(token_values.key))
396+
self.requirement_test_data[key][
397+
field_name
398+
] = value.replace(token, str(token_values.key))
390399

391400
def get_key_fields(self):
392401
"""

‎tests/e2e/addons/TA_transition_from_req/default/props.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,5 @@ EVAL-app = "psa"
1111
FIELDALIAS-user = tester AS user
1212
FIELDALIAS-src = ip AS src
1313
EVAL-status = case(action=="success", "PASS", action=="failure", "FAIL", 0==0, "OTHER")
14+
EVAL-access = if(action=="success", "allowed", "denied")
1415
EVAL-vendor_product = "Pytest Splunk Addon"

‎tests/e2e/addons/TA_transition_from_req/default/pytest-splunk-addon-data.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ token.3.token = ##result_mapping##
2929
token.3.replacementType = all
3030
token.3.replacement = file[$SPLUNK_HOME/etc/apps/TA_transition_from_req/samples/result_mapping:2]
3131

32+
token.4.token = ##access_mapping##
33+
token.4.replacementType = all
34+
token.4.replacement = file[$SPLUNK_HOME/etc/apps/TA_transition_from_req/samples/result_mapping:3]
35+
3236
#[sample_requirement.xml]
3337
#requirement_test_sample = 1
3438
#sourcetype = juniper

‎tests/e2e/addons/TA_transition_from_req/samples/result_mapping‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
success,PASS
2-
failure,FAIL
3-
error,OTHER
1+
success,PASS,allowed
2+
failure,FAIL,denied
3+
error,OTHER,denied

‎tests/e2e/addons/TA_transition_from_req/samples/sample_modinput.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
</cim>
2929
<other_mappings>
3030
<field name="vendor_product" value="Pytest Splunk Addon"/>
31+
<field name="access" value="##access_mapping##" />
3132
</other_mappings>
3233
</event>
3334
<event code="" name="UnmappedEvent" format="">

‎tests/e2e/constants.py‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -790,6 +790,7 @@
790790
"*test_splunk_app_req.py::Test_App::test_cim_fields_recommended[Authentication-*::sample_name::sample_modinput.xml::* PASSED*",
791791
"*test_splunk_app_req.py::Test_App::test_splunk_internal_errors PASSED*",
792792
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1* PASSED *",
793+
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::access* PASSED*",
793794
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::action* PASSED*",
794795
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::app* PASSED*",
795796
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::dest* PASSED*",
@@ -801,10 +802,11 @@
801802
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::tester* PASSED*",
802803
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::user* PASSED*",
803804
"*test_splunk_app_req.py::Test_App::test_props_fields[test:data:1::field::vendor_product* PASSED*",
804-
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-4* PASSED*",
805-
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-5* PASSED*",
806-
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-6* PASSED*",
805+
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-7* PASSED*",
806+
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-8* PASSED*",
807+
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-9* PASSED*",
807808
"*test_splunk_app_req.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1* PASSED*",
809+
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::access* PASSED*",
808810
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::action* PASSED*",
809811
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::app* PASSED*",
810812
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::dest* PASSED*",
@@ -816,9 +818,9 @@
816818
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::tester* PASSED*",
817819
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::user* PASSED*",
818820
"*test_splunk_app_req.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::vendor_product* PASSED*",
819-
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-4* PASSED*",
820-
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-5* PASSED*",
821-
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-6* PASSED*",
821+
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-7* PASSED*",
822+
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-8* PASSED*",
823+
"*test_splunk_app_req.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-9* PASSED*",
822824
'*test_splunk_app_req.py::Test_App::test_tags[eventtype="test_auth"::tag::authentication* PASSED*',
823825
"*test_splunk_app_req.py::Test_App::test_eventtype[eventtype::test_auth* PASSED*",
824826
]

0 commit comments

Comments
 (0)