I am sending sauce labs test results to splunk and they are in this format: {
"testsuite": {
"@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217",
"@tests": "6",
"@failures": "1",
"@skipped": "0",
"@timestamp": "2020-08-06T20:48:40.510Z",
"@time": "223.437",
"@package": "com.example",
"testcase": [
{
"@name": "C120116_testStatusFilterExitButton",
"@classname": "com.example.AlertsMockTest",
"@time": "7.47",
"failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)"
},
{
"@name": "C119770_testAlertTitleIs25Chars",
"@classname": "com.example.AlertsMockTest",
"@time": "6.835"
},
{
"@name": "C120116_testAlertsStatusFilterButton",
"@classname": "com.example.AlertsMockTest",
"@time": "7.181"
},
{
"@name": "C120106_testBackButtonExitsAppOnRegistrationLogin",
"@classname": "com.example.MainActivityTest",
"@time": "4.879"
},
{
"@name": "C117932_testShareButtonOpensShareSheet",
"@classname": "com.example.MainActivityTest",
"@time": "4.583"
},
{
"@name": "C134741_testZeroDashboards",
"@classname": "com.example.ZeroDataMockTest",
"@time": "7.248"
}
]
}
} I am trying this SPL: source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300) However I get a table that looks like this: How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure?
... View more