public void TestReadXmlSplunk5MVAndFieldRaw()
{
var input = this.OpenResourceFileFromDataFolder(
Splunk502XmlInputFilePath);
var reader = new ResultsReaderXml(input);
Assert.IsFalse(reader.IsPreview);
var events = reader.ToArray();
var valuesSi = events[0]["_si"].GetArray();
Assert.AreEqual(valuesSi.Length, 2);
Assert.AreEqual(valuesSi[1], "_internal");
Assert.IsTrue(events[2]["_raw"].ToString().Contains(
@"""GET /services/messages HTTP/1.1"""));
Assert.IsFalse(events[2]["_raw"].ToString().Contains(
@"<v"));
// Verify handling of XML charactor escaping.
Assert.AreEqual(
@"..._-__[//:::._-]_""_/-///_/.""___""://:/-//?=.&=""_""/",
events[1]["punct"]);
}
public void TestReadXmlEmpty()
{
var input = this.OpenResourceFileFromDataFolder(
Splunk502XmlEmptyInputFilePath);
var reader = new ResultsReaderXml(input);
Assert.IsFalse(reader.IsPreview);
var fields = reader.Fields.ToArray();
Assert.AreEqual(0, fields.Length);
var events = reader.ToArray();
Assert.AreEqual(0, events.Length);
}
public void TestReadXmlPreviewAndFields()
{
var input = this.OpenResourceFileFromDataFolder(
Splunk435PreviewXmlInputFilePath);
var reader = new ResultsReaderXml(input);
Assert.IsTrue(reader.IsPreview);
var fields = reader.Fields.ToArray();
Assert.AreEqual(fields[0], "_cd");
Assert.AreEqual(fields[fields.Length - 1], "version");
CollectionAssert.Contains(fields, "_raw");
CollectionAssert.Contains(fields, "mean_preview_period");
var events = reader.ToArray();
var event0 = events[0];
Assert.AreEqual(event0["_cd"], "54:8568");
Assert.AreEqual(
(int)event0["timestartpos"],
0);
Assert.AreEqual(events.Length, 10);
var event9 = events[9];
var expectedRawFieldValue =
@"12-19-2012 11:50:14.351 -0800 INFO Metrics - group=search_concurrency, system total, active_hist_searches=0, active_realtime_searches=0";
var expectedSegmentedRaw =
"<v xml:space=\"preserve\" trunc=\"0\">12-19-2012 11:50:14.351 -0800 INFO Metrics - group=<sg h=\"1\">search</sg>_concurrency, system total, active_hist_searches=0, active_realtime_searches=0</v>";
Assert.AreEqual(expectedRawFieldValue, event9["_raw"]);
Assert.AreEqual(expectedSegmentedRaw, event9.SegmentedRaw);
}