Splunk Search

How to display only the test name if key "failure" is in the same object in JSON event

sloh_splunk
Splunk Employee
Splunk Employee

I am sending sauce labs test results to splunk and they are in this format:

 

 

{
  "testsuite": {
    "@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217",
    "@tests": "6",
    "@failures": "1",
    "@skipped": "0",
    "@timestamp": "2020-08-06T20:48:40.510Z",
    "@time": "223.437",
    "@package": "com.example",
    "testcase": [
      {
        "@name": "C120116_testStatusFilterExitButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.47",
        "failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)"
      },
      {
        "@name": "C119770_testAlertTitleIs25Chars",
        "@classname": "com.example.AlertsMockTest",
        "@time": "6.835"
      },
      {
        "@name": "C120116_testAlertsStatusFilterButton",
        "@classname": "com.example.AlertsMockTest",
        "@time": "7.181"
      },
      {
        "@name": "C120106_testBackButtonExitsAppOnRegistrationLogin",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.879"
      },
      {
        "@name": "C117932_testShareButtonOpensShareSheet",
        "@classname": "com.example.MainActivityTest",
        "@time": "4.583"
      },
      {
        "@name": "C134741_testZeroDashboards",
        "@classname": "com.example.ZeroDataMockTest",
        "@time": "7.248"
      } 
    ]
  }
}

 

 

 

I am trying this SPL:

 

 

source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure  | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300)

 

 

 

However I get a table that looks like this:

Screen Shot 2020-08-06 at 5.57.43 PM.png

 

How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

See this example based on your data. It shows how to expand the case array and then do the test for failed cases on the expanded data set. Not totally sure what you want in the output, but the array expansion to separate events, where you can then test the failure for existence should get you there. Without expanding the array to multiple events you cannot align the array indices of the failed events to the case name. Key part is the output=caseArray

| makeresults 
| eval data="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}" 
| spath input=data 
| search "testsuite.@failures">0 
| spath input=data path=testsuite.testcase{} output=caseArray 
| fields - data 
| mvexpand caseArray 
| spath input=caseArray 
| where !isnull(failure) 

 Hope this helps.

to4kawa
Ultra Champion

sample:

 

 

index=_internal | head 1 | fields _raw _time
| eval _raw="{
  \"testsuite\": {
    \"@name\": \"'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217\",
    \"@tests\": \"6\",
    \"@failures\": \"1\",
    \"@skipped\": \"0\",
    \"@timestamp\": \"2020-08-06T20:48:40.510Z\",
    \"@time\": \"223.437\",
    \"@package\": \"com.example\",
    \"testcase\": [
      {
        \"@name\": \"C120116_testStatusFilterExitButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.47\",
        \"failure\": \"NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)\"
                  },
      {
        \"@name\": \"C119770_testAlertTitleIs25Chars\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"6.835\"
                  },
      {
        \"@name\": \"C120116_testAlertsStatusFilterButton\",
        \"@classname\": \"com.example.AlertsMockTest\",
        \"@time\": \"7.181\"
                  },
      {
        \"@name\": \"C120106_testBackButtonExitsAppOnRegistrationLogin\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.879\"
                  },
      {
        \"@name\": \"C117932_testShareButtonOpensShareSheet\",
        \"@classname\": \"com.example.MainActivityTest\",
        \"@time\": \"4.583\"
                  },
      {
        \"@name\": \"C134741_testZeroDashboards\",
        \"@classname\": \"com.example.ZeroDataMockTest\",
        \"@time\": \"7.248\"
                  } 
    ]
  }
}"
| spath testsuite.testcase{} output=testcase
| spath 
| stats values(testsuite.@*) as testsuite_* by testcase
| spath input=testcase
| search failure="*"
| fields - testcase
| rename @* as testcase_*

 

 

sloh_splunk
Splunk Employee
Splunk Employee

@to4kawathank you! your answer is also very helpful!

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...