How to display only the test name if key "failure" is in the same object in JSON event

[sloh_splunk]

I am sending sauce labs test results to splunk and they are in this format:

{
  "testsuite": {
    "@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217",
    "@tests": "6",
    "@failures": "1",
    "@skipped": "0",
    "@timestamp": "2020-08-06T20:48:40.510Z",
    "@time": "223.437",
    "@package": "com.example",
    "testcase": [
      {
        "@name": "C120116_testStatusFilterExitButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.47",
        "failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)"
      },
      {
        "@name": "C119770_testAlertTitleIs25Chars",
        "@classname": "com.example.AlertsMockTest",
        "@time": "6.835"
      },
      {
        "@name": "C120116_testAlertsStatusFilterButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.181"
      },
      {
        "@name": "C120106_testBackButtonExitsAppOnRegistrationLogin",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.879"
      },
      {
        "@name": "C117932_testShareButtonOpensShareSheet",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.583"
      },
      {
        "@name": "C134741_testZeroDashboards",
        "@classname": "com.example.ZeroDataMockTest",
        "@time": "7.248"
      } 
    ]
  }
}

I am trying this SPL:

source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure  | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300)

However I get a table that looks like this:

How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure?

[bowesmana · Accepted solution]

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

[to4kawa]

sample:

index=_internal | head 1 | fields _raw _time
| eval _raw="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}"
| spath testsuite.testcase{} output=testcase
| spath 
| stats values(testsuite.@*) as testsuite_* by testcase
| spath input=testcase
| search failure="*"
| fields - testcase
| rename @* as testcase_*

[sloh_splunk]

@to4kawathank you! your answer is also very helpful!