search

salspaugh / splparser

Simple parser for Splunk Processing Language (SPL) written in Python.
Other
35 stars 14 forks source link

one test fail for metadata #109

Closed keroro824 closed 10 years ago

keroro824 commented 10 years ago

Beidi@airbears2-10-142-32-61: ~/Documents/sara/saraResearch/splparser $ splparse "metadata type=sourcetypes index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")" ('ROOT') ('STAGE') ('COMMAND': 'metadata') ('EQ': 'assign') ('OPTION': 'type') ('VALUE': 'sourcetypes') ('EQ': 'assign') ('DEFAULT_FIELD': 'index') ('VALUE': '_internal') ('STAGE') ('COMMAND': 'rename') ('FUNCTION': 'rename') ('FIELD': 'totalCount') ('FIELD': 'Count') ('FUNCTION': 'rename') ('FIELD': 'firstTime') ('FIELD': 'First')

This test works in command line but failed in test:

File "/Users/Beidi/Documents/sara/saraResearch/splparser/test/splparser/rules/metadatarules/test_metadatarules.txt", line 24, in test_metadatarules.txt Failed example: splparser.parse("metadata type=sourcetypes index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")").print_tree() Exception raised: Traceback (most recent call last): File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/doctest.py", line 1289, in __run compileflags, 1) in test.globs File "<doctest test_metadatarules.txt[3]>", line 1 splparser.parse("metadata type=sourcetypes index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")").print_tree() ^ SyntaxError: invalid syntax

salspaugh commented 10 years ago

That's because you used the same quote char to wrap the string as there are quote chars inside it, so it breaks: "metadata type=sourcetypes index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")" I sense you are getting tired -- you should get a good night's sleep now!

keroro824 commented 10 years ago

I tried ' ' but it did not work either

keroro824 commented 10 years ago

it even failed in command line

salspaugh commented 10 years ago

The string also contains ' characters. So you could make all the internal quotes the same, or you could use triple quotes in Python.

salspaugh commented 10 years ago

:first_quarter_moon_with_face: :sleeping: :grey_exclamation: :smile:

keroro824 commented 10 years ago

Good Night!

keroro824 commented 10 years ago

Can you also look at this one please :)

salspaugh commented 10 years ago

All the tests pass now? If so :+1: merge away.