Splunk Search

How to display only the test name if key "failure" is in the same object in JSON event

sloh_splunk
Splunk Employee
Splunk Employee

I am sending sauce labs test results to splunk and they are in this format:

 

 

{
  "testsuite": {
    "@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217",
    "@tests": "6",
    "@failures": "1",
    "@skipped": "0",
    "@timestamp": "2020-08-06T20:48:40.510Z",
    "@time": "223.437",
    "@package": "com.example",
    "testcase": [
      {
        "@name": "C120116_testStatusFilterExitButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.47",
        "failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)"
      },
      {
        "@name": "C119770_testAlertTitleIs25Chars",
        "@classname": "com.example.AlertsMockTest",
        "@time": "6.835"
      },
      {
        "@name": "C120116_testAlertsStatusFilterButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.181"
      },
      {
        "@name": "C120106_testBackButtonExitsAppOnRegistrationLogin",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.879"
      },
      {
        "@name": "C117932_testShareButtonOpensShareSheet",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.583"
      },
      {
        "@name": "C134741_testZeroDashboards",
        "@classname": "com.example.ZeroDataMockTest",
        "@time": "7.248"
      } 
    ]
  }
}

 

 

 

I am trying this SPL:

 

 

source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure  | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300)

 

 

 

However I get a table that looks like this:

Screen Shot 2020-08-06 at 5.57.43 PM.png

 

How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

to4kawa
Ultra Champion

sample:

 

 

index=_internal | head 1 | fields _raw _time
| eval _raw="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}"
| spath testsuite.testcase{} output=testcase
| spath 
| stats values(testsuite.@*) as testsuite_* by testcase
| spath input=testcase
| search failure="*"
| fields - testcase
| rename @* as testcase_*

 

 

sloh_splunk
Splunk Employee
Splunk Employee

@to4kawathank you! your answer is also very helpful!

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...