Test Splunk Queries

[reesmanp]

I am building a Splunk app for school and one of my requirements is to test that the queries sent to splunk work and are accurate. Is there a way to use unit testing on the queries themselves or should I just make a python script to parse the log files for the data that the query is supposed to gather and compare/contrast?

[michalsvorc]

Sorry for necrobumping, but this thread has over 1K views and still no satisfactory answer. I wonder if someone did find some tool or could share how he resolved this issue.

Would be greatly appreciated by the whole community...

[tbroberg]

Try makeresults?

https://gist.github.com/bshuler/5d0d75ac43ed8f57809fed6b60c4bfca

[markthompson]

I am not aware of one - if you can find one, please share.

You could always set up a test index and run it... But if not, your python script should do the trick

[reesmanp]

Thanks for that. I will see what I can find and let you know if I did find anything or just used a script.