Splunk Search

How to display only the test name if key "failure" is in the same object in JSON event

sloh_splunk
Splunk Employee
Splunk Employee

I am sending sauce labs test results to splunk and they are in this format:

 

 

{
  "testsuite": {
    "@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217",
    "@tests": "6",
    "@failures": "1",
    "@skipped": "0",
    "@timestamp": "2020-08-06T20:48:40.510Z",
    "@time": "223.437",
    "@package": "com.example",
    "testcase": [
      {
        "@name": "C120116_testStatusFilterExitButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.47",
        "failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)"
      },
      {
        "@name": "C119770_testAlertTitleIs25Chars",
        "@classname": "com.example.AlertsMockTest",
        "@time": "6.835"
      },
      {
        "@name": "C120116_testAlertsStatusFilterButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.181"
      },
      {
        "@name": "C120106_testBackButtonExitsAppOnRegistrationLogin",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.879"
      },
      {
        "@name": "C117932_testShareButtonOpensShareSheet",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.583"
      },
      {
        "@name": "C134741_testZeroDashboards",
        "@classname": "com.example.ZeroDataMockTest",
        "@time": "7.248"
      } 
    ]
  }
}

 

 

 

I am trying this SPL:

 

 

source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure  | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300)

 

 

 

However I get a table that looks like this:

Screen Shot 2020-08-06 at 5.57.43 PM.png

 

How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

to4kawa
Ultra Champion

sample:

 

 

index=_internal | head 1 | fields _raw _time
| eval _raw="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}"
| spath testsuite.testcase{} output=testcase
| spath 
| stats values(testsuite.@*) as testsuite_* by testcase
| spath input=testcase
| search failure="*"
| fields - testcase
| rename @* as testcase_*

 

 

sloh_splunk
Splunk Employee
Splunk Employee

@to4kawathank you! your answer is also very helpful!

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...