fix: updating url rule (#864)

Updated **url** rule so that if only url["path"] or url["query"] is given, just path and query is generated. EG: url["path"] will generate path like: "/random/path" EG: url["query"] will generate query like: "?asd=abs"
splunk · Jul 10, 2024 · a00fc81 · a00fc81
1 parent ea24436
commit a00fc81
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/pytest_splunk_addon/sample_generation/rule.py b/pytest_splunk_addon/sample_generation/rule.py
@@ -934,6 +934,8 @@ def replace(self, sample, token_count):
                         url = self.fake.url()
 
                     if bool(set(["full", "path"]).intersection(value_list)):
+                        if value_list == ["path"]:
+                            url = ""
                         url = (
                             url
                             + "/"
@@ -944,8 +946,9 @@ def replace(self, sample, token_count):
                                 ]
                             )
                         )
-
                     if bool(set(["full", "query"]).intersection(value_list)):
+                        if value_list == ["query"]:
+                            url = ""
                         url = url + self.generate_url_query_params()
                     yield self.token_value(*([str(url)] * 2))
         else:

diff --git a/tests/e2e/addons/TA_fiction_indextime/default/props.conf b/tests/e2e/addons/TA_fiction_indextime/default/props.conf
@@ -12,6 +12,10 @@ FIELDALIAS-write_ops = w_op_s as write_ops
 EVAL-total_ops = read_ops + write_ops
 EVAL-vendor_product = if(isnull(vendor_product), "TEST_INDEX_TIME", vendor_product)
 
+[test:indextime:sourcetype_basic]
+EVAL-extracted_path = if(match(test_url_path,"^\/.*"), test_url_query, null)
+EVAL-extracted_query = if(match(test_url_query,"^\?.*"), test_url_query, null)
+
 [test:indextime:sourcetype:file_all_dependent]
 TRANSFORMS-sourcetype_file_all_dependent_change_host = sourcetype_file_all_dependent_change_host
 

diff --git a/tests/e2e/constants.py b/tests/e2e/constants.py
@@ -497,6 +497,11 @@
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype:modinput_host_event_time_plugin::modinput_host_event_time_plugin.samples_2* PASSED*",
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype:user_email_relation_time_plugin::sample_file_two.samples* PASSED*",
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-13* PASSED*",
+    "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic::field::extracted_query* PASSED*",
+    "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic::field::extracted_path* PASSED*",
+    "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic* PASSED*",
+    "*test_splunk_fiction_indextime.py::Test_App::test_props_fields_no_dash_not_empty[test:indextime:sourcetype_basic::field::extracted_path* PASSED*",
+    "*test_splunk_fiction_indextime.py::Test_App::test_props_fields_no_dash_not_empty[test:indextime:sourcetype_basic::field::extracted_query* PASSED*",
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-14* PASSED*",
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-15* PASSED*",
     "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-16* PASSED*",