diff --git a/pytest_splunk_addon/sample_generation/rule.py b/pytest_splunk_addon/sample_generation/rule.py index fc7687142..8aeb5ac1a 100644 --- a/pytest_splunk_addon/sample_generation/rule.py +++ b/pytest_splunk_addon/sample_generation/rule.py @@ -934,6 +934,8 @@ def replace(self, sample, token_count): url = self.fake.url() if bool(set(["full", "path"]).intersection(value_list)): + if value_list == ["path"]: + url = "" url = ( url + "/" @@ -944,8 +946,9 @@ def replace(self, sample, token_count): ] ) ) - if bool(set(["full", "query"]).intersection(value_list)): + if value_list == ["query"]: + url = "" url = url + self.generate_url_query_params() yield self.token_value(*([str(url)] * 2)) else: diff --git a/tests/e2e/addons/TA_fiction_indextime/default/props.conf b/tests/e2e/addons/TA_fiction_indextime/default/props.conf index d0225d577..9cd373979 100644 --- a/tests/e2e/addons/TA_fiction_indextime/default/props.conf +++ b/tests/e2e/addons/TA_fiction_indextime/default/props.conf @@ -12,6 +12,10 @@ FIELDALIAS-write_ops = w_op_s as write_ops EVAL-total_ops = read_ops + write_ops EVAL-vendor_product = if(isnull(vendor_product), "TEST_INDEX_TIME", vendor_product) +[test:indextime:sourcetype_basic] +EVAL-extracted_path = if(match(test_url_path,"^\/.*"), test_url_query, null) +EVAL-extracted_query = if(match(test_url_query,"^\?.*"), test_url_query, null) + [test:indextime:sourcetype:file_all_dependent] TRANSFORMS-sourcetype_file_all_dependent_change_host = sourcetype_file_all_dependent_change_host diff --git a/tests/e2e/constants.py b/tests/e2e/constants.py index 5aaa9badd..0fd69aebd 100644 --- a/tests/e2e/constants.py +++ b/tests/e2e/constants.py @@ -497,6 +497,11 @@ "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype:modinput_host_event_time_plugin::modinput_host_event_time_plugin.samples_2* PASSED*", "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype:user_email_relation_time_plugin::sample_file_two.samples* PASSED*", "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-13* PASSED*", + "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic::field::extracted_query* PASSED*", + "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic::field::extracted_path* PASSED*", + "*test_splunk_fiction_indextime.py::Test_App::test_props_fields[test:indextime:sourcetype_basic* PASSED*", + "*test_splunk_fiction_indextime.py::Test_App::test_props_fields_no_dash_not_empty[test:indextime:sourcetype_basic::field::extracted_path* PASSED*", + "*test_splunk_fiction_indextime.py::Test_App::test_props_fields_no_dash_not_empty[test:indextime:sourcetype_basic::field::extracted_query* PASSED*", "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-14* PASSED*", "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-15* PASSED*", "*test_splunk_fiction_indextime.py::Test_App::test_indextime_key_fields*test:indextime:sourcetype_basic::sample-file-samples-16* PASSED*",