spl2-testing-framework 1.7.0__tar.gz → 1.7.2__tar.gz

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: spl2-testing-framework
-Version: 1.7.0
+Version: 1.7.2
 Summary: SPL2 Testing Framework
 Home-page: https://github.com/splunk/spl2-testing-framework
 Keywords: SPL2 testing framework
@@ -260,8 +260,8 @@ When set (`--check_splunk_results=<option>`), box tests (after running the SPL2
 
 | Value | Behavior |
 |-------|----------|
-| **CIM** | For each output event, push to Splunk, query by host, then validate that the returned event has the expected CIM fields (from `expected_cim_fields.cim_fields` in the box test). Uses `validate_compatibility()`. Skips the test if the box test has no `cim_fields`. |
-| **TA** | For each output event, push to Splunk, query by host, then assert that the returned event equals the expected output event for that index. |
+| **CIM** | For each output event, ingest via HEC, load back from Splunk, then check CIM fields from `expected_cim_fields.cim_fields` with `validate_compatibility(actual, expected)`. Skips if the box test has no `cim_fields`. |
+| **TA** | For each output event, ingest via HEC, load back from Splunk, then assert equality with the expected row for that index. |
 
 For **TA** only, you can name top-level fields to drop on **both** the queried event and each `expected_destination_result` row by adding **`ignore_fields_in_splunk_check`**: an object mapping **field name → short reason**. Use the same key under `test` in each entry in `*.test.json` (same file as `expected_destination_result`):
 

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/README.md

@@ -227,8 +227,8 @@ When set (`--check_splunk_results=<option>`), box tests (after running the SPL2
 
 | Value | Behavior |
 |-------|----------|
-| **CIM** | For each output event, push to Splunk, query by host, then validate that the returned event has the expected CIM fields (from `expected_cim_fields.cim_fields` in the box test). Uses `validate_compatibility()`. Skips the test if the box test has no `cim_fields`. |
-| **TA** | For each output event, push to Splunk, query by host, then assert that the returned event equals the expected output event for that index. |
+| **CIM** | For each output event, ingest via HEC, load back from Splunk, then check CIM fields from `expected_cim_fields.cim_fields` with `validate_compatibility(actual, expected)`. Skips if the box test has no `cim_fields`. |
+| **TA** | For each output event, ingest via HEC, load back from Splunk, then assert equality with the expected row for that index. |
 
 For **TA** only, you can name top-level fields to drop on **both** the queried event and each `expected_destination_result` row by adding **`ignore_fields_in_splunk_check`**: an object mapping **field name → short reason**. Use the same key under `test` in each entry in `*.test.json` (same file as `expected_destination_result`):
 

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/pyproject.toml

@@ -15,7 +15,7 @@
 
 [tool.poetry]
 name = "spl2-testing-framework"
-version = "1.7.0"
+version = "1.7.2"
 description = "SPL2 Testing Framework"
 authors = ["mgazda-splunk <mgazda@splunk.com>"]
 readme = "README.md"

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/spl2_testing_framework/tools/spl2test_runner.py

@@ -23,6 +23,9 @@ from spl2_testing_framework.tools.performance import PerformanceCheck
 from spl2_testing_framework.tools.search_clients.cli_search_client import (
     CLISearchClient,
 )
+from spl2_testing_framework.tools.splunk_integration.splunk_handler import (
+    SplunkEventNotFoundError,
+)
 from spl2_testing_framework.tools.test_types import UnitTest, BoxTest, SingleSPL2
 from spl2_testing_framework.tools.utils import (
     _make_functions_visible_for_testing,
@@ -227,6 +230,15 @@ class SPL2TestRunner:
             return row
         return {k: v for k, v in row.items() if k not in ignore_keys}
 
+    def _splunk_process_event(self, box_test: BoxTest, event):
+        try:
+            return self.splunk_handler.process_event(event)
+        except SplunkEventNotFoundError as e:
+            raise SplunkEventNotFoundError(
+                e.event_uuid,
+                context=f"box_test={box_test.name!r}",
+            ) from e
+
     def _check_splunk_results(self, box_test, job):
         output_result = job.result.get("destination", [])
         if self.check_splunk_results == "CIM":
@@ -234,13 +246,13 @@ class SPL2TestRunner:
                 pytest.skip("CIM output not available for this test")
 
             for event in output_result:
-                processed_event = self.splunk_handler.process_event(event)
-                validate_compatibility(box_test.cim_fields, processed_event)
+                processed_event = self._splunk_process_event(box_test, event)
+                validate_compatibility(processed_event, box_test.cim_fields)
         elif self.check_splunk_results == "TA":
             ignore_spec = box_test.ignore_fields_in_splunk_check
             ignore_keys = frozenset(ignore_spec.keys())
             for event, expected in zip(output_result, box_test.output):
-                processed_event = self.splunk_handler.process_event(event)
+                processed_event = self._splunk_process_event(box_test, event)
                 actual = self._strip_ignored_fields_for_splunk_compare(
                     processed_event, ignore_keys
                 )

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/spl2_testing_framework/tools/splunk_integration/splunk_handler.py

@@ -14,6 +14,7 @@
 
 import logging
 import uuid
+from typing import Optional
 
 import requests
 import splunklib.client as client
@@ -26,6 +27,21 @@ from requests.auth import HTTPBasicAuth
 _LOGGER = logging.getLogger(__name__)
 
 
+SPL2_TF_EVENT_UUID_FIELD = "spl2_testing_framework_event_uuid"
+SPL2_TF_DEFAULT_HEC_HOST = "spl2-testing-framework"
+
+
+class SplunkEventNotFoundError(Exception):
+    """Raised when HEC ingest succeeded but search returned no matching event."""
+
+    def __init__(self, event_uuid: str, *, context: Optional[str] = None):
+        self.event_uuid = event_uuid
+        msg = f"No event found after HEC submit (event_uuid={event_uuid!r})"
+        if context:
+            msg = f"{context}: {msg}"
+        super().__init__(msg)
+
+
 class SplunkHandler:
     def __init__(self, config, auth):
         self._config = config
@@ -36,18 +52,45 @@ class SplunkHandler:
         self._create_index()
 
     def process_event(self, event):
-        host = f"test_{uuid.uuid4()}"
-
-        self.push_to_hec(event, host)
-        res = self.get_events_by_host_and_index(host)
+        event_uuid = str(uuid.uuid4())
+        metadata_host = event.get("host")
+        if metadata_host is not None and str(metadata_host).strip() != "":
+            hec_host = str(metadata_host).strip()
+        else:
+            hec_host = SPL2_TF_DEFAULT_HEC_HOST
+
+        self.push_to_hec(event, hec_host, event_uuid)
+        res = self.get_events_by_event_uuid(event_uuid)
         if not res:
-            raise Exception("No event found.")
+            raise SplunkEventNotFoundError(event_uuid)
 
         if len(res) > 1:
             _LOGGER.error("Found more than one event, the result may not be correct")
-        return res[0]
-
-    def push_to_hec(self, data, host):
+        out = dict(res[0])
+        out.pop(SPL2_TF_EVENT_UUID_FIELD, None)
+        return out
+
+    @staticmethod
+    def _hec_event_url(raw_url: str) -> str:
+        if "/services/collector/raw" in raw_url:
+            return raw_url.replace(
+                "/services/collector/raw", "/services/collector/event"
+            )
+        return raw_url
+
+    @staticmethod
+    def _raw_as_event_string(raw):
+        """Normalize pipeline `_raw` for HEC JSON `event` (must be a string).
+
+        ``str`` is passed through ``str()``; ``bytes`` are decoded as UTF-8 with
+        replacement on invalid sequences (avoids :class:`UnicodeDecodeError` for
+        odd binary payloads; prefer valid UTF-8 log text in normal use).
+        """
+        if isinstance(raw, bytes):
+            return raw.decode("utf-8", errors="replace")
+        return str(raw)
+
+    def push_to_hec(self, data, host, event_uuid):
         sourcetype = data.get("sourcetype", "UNKNOWN")
 
         if sourcetype == "UNKNOWN":
@@ -55,29 +98,31 @@ class SplunkHandler:
 
         source = data.get("source", None)
 
-        params = {
+        payload = {
+            "event": SplunkHandler._raw_as_event_string(data["_raw"]),
             "sourcetype": sourcetype,
             "index": self.splunk_config["index"],
             "host": host,
+            "fields": {SPL2_TF_EVENT_UUID_FIELD: event_uuid},
         }
-
         if source is not None:
-            params["source"] = source
-
-        event_data = data["_raw"].encode("utf-8")
+            payload["source"] = source
 
         response = requests.post(
-            url=self.splunk_config["url"],
-            data=event_data,
-            params=params,
+            url=self._hec_event_url(self.splunk_config["url"]),
+            json=payload,
             auth=self._auth,
             verify=False,
         )
 
         response.raise_for_status()
 
-    def get_events_by_host_and_index(self, host):
-        SPL_TEMPLATE = "| search index={index} host={host} | fields *"
+    @staticmethod
+    def _splunk_search_term(value: str) -> str:
+        return '"' + str(value).replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+    def get_events_by_event_uuid(self, event_uuid):
+        SPL_TEMPLATE = "| search index={index} {uuid_field}={uuid} | fields *"
         # Connect to Splunk
         service = client.connect(
             host=self.splunk_config["ip"],
@@ -86,7 +131,11 @@ class SplunkHandler:
             password=self.splunk_config["password"],
             app="search",
         )
-        SPL = SPL_TEMPLATE.format(index=self.splunk_config["index"], host=host)
+        SPL = SPL_TEMPLATE.format(
+            index=self.splunk_config["index"],
+            uuid_field=SPL2_TF_EVENT_UUID_FIELD,
+            uuid=self._splunk_search_term(event_uuid),
+        )
 
         results_all = []
         retry = 0

{spl2_testing_framework-1.7.0 → spl2_testing_framework-1.7.2}/spl2_testing_framework/tools/utils.py

@@ -67,13 +67,18 @@ def calculate_reduction_rate(original_event, reduced_event):
     return reduction_rates
 
 
-def validate_compatibility(expected, parsed_output):
-    """Validate if all fields from parsed_output are present in expected and have the same value."""
+def validate_compatibility(actual, expected):
+    """Check that every field in ``expected`` exists in ``actual`` with the same value.
+
+    Order matches the usual test convention ``assert actual == expected`` (observed
+    value first, reference second). For CIM checks, ``actual`` is the Splunk-processed
+    event and ``expected`` is ``box_test.cim_fields``.
+    """
     extracted_but_wrong = {}
     not_extracted = {}
     for field, value in expected.items():
-        if field in parsed_output:
-            if parsed_output[field] == value:
+        if field in actual:
+            if actual[field] == value:
                 _LOGGER.info(f"FIELD {field} in reduced event")
                 continue
             else:
@@ -90,19 +95,32 @@ def validate_compatibility(expected, parsed_output):
     assert not_extracted == {}
 
 
+_QUOTED_STRING_OR_BARE_KEY = re.compile(
+    r'"(?:[^"\\]|\\.)*"' r"|" r"([{,])\s*([A-Za-z_]+)\s*(:)"
+)
+
+
+def _quote_unquoted_keys(input_str):
+    """Wrap bare (unquoted) object keys in double quotes to produce valid JSON,
+    without corrupting content inside JSON string values.
+
+    Uses regex alternation: the first branch consumes quoted strings (so their
+    content is never touched), the second branch captures bare keys to quote.
+    """
+
+    def _replacer(m):
+        if m.group(1) is None:
+            return m.group(0)
+        return f'{m.group(1)}"{m.group(2)}":'
+
+    return _QUOTED_STRING_OR_BARE_KEY.sub(_replacer, input_str)
+
+
 def parse_raw_from_input(input_str):
     """Parse SPL2-style or JSON array of events and return list of _raw field values.
     Handles unquoted keys (e.g. {_raw: "x"}) by converting them to JSON-quoted keys.
     """
-    # Only replace unquoted keys: key must be preceded by { or , (and optional space)
-    key_pattern = re.compile(
-        r"(\{|,)\s*(_raw|source|sourcetype|host)\s*:", re.MULTILINE
-    )
-
-    def quote_key(match):
-        return f'{match.group(1)}"{match.group(2)}":'
-
-    normalized = key_pattern.sub(quote_key, input_str)
+    normalized = _quote_unquoted_keys(input_str)
     try:
         parsed = json.loads(normalized)
     except json.JSONDecodeError: