Exemple #1
0
 def test_pack_dictionary(self):
     self.assertEqual(
         ' | extend foo = pack_dictionary("bar", numField, "baz", stringField)',
         Query().extend(foo=f.pack_dictionary(bar=t.numField,
                                              baz=t.stringField)).render())
Exemple #2
0
 def test_tolong(self):
     self.assertEqual(
         " | where (tolong(stringField)) > 2222222222",
         Query().where(f.to_long(t.stringField) > 2222222222).render())
Exemple #3
0
 def test_toreal(self):
     self.assertEqual(
         " | where (toreal(stringField)) > 0.2",
         Query().where(f.to_real(t.stringField) > 0.2).render())
Exemple #4
0
 def test_tobool(self):
     self.assertEqual(" | where tobool(stringField)",
                      Query().where(f.to_bool(t.stringField)).render())
Exemple #5
0
 def test_to_dynamic(self):
     self.assertEqual(
         " | extend dyn = todynamic(stringField)",
         Query().extend(dyn=f.to_dynamic(t.stringField)).render())
Exemple #6
0
 def test_strcmp(self):
     self.assertEqual(
         " | where (strcmp(stringField, stringField2)) == 1",
         Query().where(
             f.strcmp(t.stringField, t.stringField2) == 1).render())
Exemple #7
0
 def test_cos(self):
     self.assertEqual(" | where (cos(numField)) > 4",
                      Query().where(f.cos(t.numField) > 4).render())
Exemple #8
0
 def test_parse_json_nesting(self):
     self.assertEqual(
         ' | where (parse_json(stringField)["a"].b[2]) contains "bar"',
         Query().where(
             f.parse_json(
                 t.stringField)['a'].b[2].contains('bar')).render())
Exemple #9
0
 def test_pow(self):
     self.assertEqual(
         " | where (pow(numField, numField2)) > 3",
         Query().where(f.pow(t.numField, t.numField2) > 3).render())
Exemple #10
0
 def test_parse_json_number_expression(self):
     self.assertEqual(
         ' | where (todouble(parse_json(stringField).bar)) > 4',
         Query().where(
             f.to_double(f.parse_json(t.stringField).bar) > 4).render())
Exemple #11
0
 def test_parse_json_array(self):
     self.assertEqual(
         ' | where (parse_json(stringField)[2]) == 3',
         Query().where(f.parse_json(t.stringField)[2] == 3).render())
Exemple #12
0
 def test_case(self):
     self.assertEqual(
         ' | extend bucket = case(numField <= 3, "Small", numField <= 10, "Medium", "Large")',
         Query().extend(
             bucket=f.case(t.numField <= 3, "Small", t.numField <= 10,
                           'Medium', 'Large')).render())
Exemple #13
0
 def test_parse_json_dot(self):
     self.assertEqual(
         ' | where (tostring(parse_json(stringField).bar)) contains "ABC"',
         Query().where(
             f.parse_json(
                 t.stringField).bar.to_string().contains('ABC')).render())
Exemple #14
0
 def test_parse_json_brackets(self):
     self.assertEqual(
         ' | where (tostring(parse_json(stringField)["bar"])) contains "ABC"',
         Query().where(
             f.parse_json(t.stringField)['bar'].to_string().contains(
                 'ABC')).render())
Exemple #15
0
 def test_strcat_one_argument(self):
     self.assertRaises(ValueError("strcat requires at least two arguments"),
                       lambda: f.strcat(t.stringField))
Exemple #16
0
 def test_round(self):
     self.assertEqual(
         " | where (round(numField, numField2)) == 3",
         Query().where(f.round(t.numField, t.numField2) == 3).render())
Exemple #17
0
 def test_ceiling(self):
     self.assertEqual(" | where (ceiling(numField)) > 4",
                      Query().where(f.ceiling(t.numField) > 4).render())
Exemple #18
0
 def test_sign(self):
     self.assertEqual(" | where (sign(numField)) == 1",
                      Query().where(f.sign(t.numField) == 1).render())
Exemple #19
0
 def test_strlen(self):
     self.assertEqual(" | where (strlen(stringField)) == 1",
                      Query().where(f.strlen(t.stringField) == 1).render())
Exemple #20
0
 def test_sqrt(self):
     self.assertEqual(" | where (sqrt(numField)) > 1",
                      Query().where(f.sqrt(t.numField) > 1).render())
Exemple #21
0
 def test_count_of(self):
     self.assertEqual(
         ' | where (countof(stringField, "abc", "normal")) == 2',
         Query().where(f.count_of(t.stringField, "abc") == 2).render())
Exemple #22
0
 def test_startofday(self):
     self.assertEqual(
         " | where (startofday(dateField)) > datetime(2019-07-23 00:00:00.000000)",
         Query().where(
             f.start_of_day(t.dateField) > datetime(2019, 7, 23)).render())
Exemple #23
0
 def test_todatetime(self):
     self.assertEqual(
         " | extend foo = todatetime(stringField)",
         Query().extend(foo=f.to_datetime(t.stringField)).render())
Exemple #24
0
 def test_startofmonth(self):
     self.assertEqual(
         " | where (startofmonth(dateField)) > datetime(2019-07-01 00:00:00.000000)",
         Query().where(
             f.start_of_month(t.dateField) > datetime(2019, 7, 1)).render())
Exemple #25
0
 def test_toint(self):
     self.assertEqual(" | where (toint(stringField)) > 1",
                      Query().where(f.to_int(t.stringField) > 1).render())
Exemple #26
0
 def test_startofweek(self):
     self.assertEqual(
         " | where (startofweek(dateField)) > datetime(2019-07-08 00:00:00.000000)",
         Query().where(
             f.start_of_week(t.dateField) > datetime(2019, 7, 8)).render())
Exemple #27
0
 def test_tolower(self):
     self.assertEqual(
         ' | where (tolower(stringField)) == "foo"',
         Query().where(f.to_lower(t.stringField) == "foo").render())
Exemple #28
0
 def test_startofyear(self):
     self.assertEqual(
         " | where (startofyear(dateField)) > datetime(2019-01-01 00:00:00.000000)",
         Query().where(
             f.start_of_year(t.dateField) > datetime(2019, 1, 1)).render())
Exemple #29
0
 def test_to_timespan(self):
     self.assertEqual(
         " | extend t = totimespan(stringField)",
         Query().extend(t=f.to_timespan(t.stringField)).render())
Exemple #30
0
 def test_pack_all(self):
     self.assertEqual(" | extend packed = pack_all()",
                      Query().extend(packed=f.pack_all()).render())