def test_pack_dictionary(self):
self.assertEqual(
' | extend foo = pack_dictionary("bar", numField, "baz", stringField)',
Query().extend(foo=f.pack_dictionary(bar=t.numField,
baz=t.stringField)).render())
def test_tolong(self):
self.assertEqual(
" | where (tolong(stringField)) > 2222222222",
Query().where(f.to_long(t.stringField) > 2222222222).render())
def test_toreal(self):
self.assertEqual(
" | where (toreal(stringField)) > 0.2",
Query().where(f.to_real(t.stringField) > 0.2).render())
def test_tobool(self):
self.assertEqual(" | where tobool(stringField)",
Query().where(f.to_bool(t.stringField)).render())
def test_to_dynamic(self):
self.assertEqual(
" | extend dyn = todynamic(stringField)",
Query().extend(dyn=f.to_dynamic(t.stringField)).render())
def test_strcmp(self):
self.assertEqual(
" | where (strcmp(stringField, stringField2)) == 1",
Query().where(
f.strcmp(t.stringField, t.stringField2) == 1).render())
def test_cos(self):
self.assertEqual(" | where (cos(numField)) > 4",
Query().where(f.cos(t.numField) > 4).render())
def test_parse_json_nesting(self):
self.assertEqual(
' | where (parse_json(stringField)["a"].b[2]) contains "bar"',
Query().where(
f.parse_json(
t.stringField)['a'].b[2].contains('bar')).render())
def test_pow(self):
self.assertEqual(
" | where (pow(numField, numField2)) > 3",
Query().where(f.pow(t.numField, t.numField2) > 3).render())
def test_parse_json_number_expression(self):
self.assertEqual(
' | where (todouble(parse_json(stringField).bar)) > 4',
Query().where(
f.to_double(f.parse_json(t.stringField).bar) > 4).render())
def test_parse_json_array(self):
self.assertEqual(
' | where (parse_json(stringField)[2]) == 3',
Query().where(f.parse_json(t.stringField)[2] == 3).render())
def test_case(self):
self.assertEqual(
' | extend bucket = case(numField <= 3, "Small", numField <= 10, "Medium", "Large")',
Query().extend(
bucket=f.case(t.numField <= 3, "Small", t.numField <= 10,
'Medium', 'Large')).render())
def test_parse_json_dot(self):
self.assertEqual(
' | where (tostring(parse_json(stringField).bar)) contains "ABC"',
Query().where(
f.parse_json(
t.stringField).bar.to_string().contains('ABC')).render())
def test_parse_json_brackets(self):
self.assertEqual(
' | where (tostring(parse_json(stringField)["bar"])) contains "ABC"',
Query().where(
f.parse_json(t.stringField)['bar'].to_string().contains(
'ABC')).render())
def test_strcat_one_argument(self):
self.assertRaises(ValueError("strcat requires at least two arguments"),
lambda: f.strcat(t.stringField))
def test_round(self):
self.assertEqual(
" | where (round(numField, numField2)) == 3",
Query().where(f.round(t.numField, t.numField2) == 3).render())
def test_ceiling(self):
self.assertEqual(" | where (ceiling(numField)) > 4",
Query().where(f.ceiling(t.numField) > 4).render())
def test_sign(self):
self.assertEqual(" | where (sign(numField)) == 1",
Query().where(f.sign(t.numField) == 1).render())
def test_strlen(self):
self.assertEqual(" | where (strlen(stringField)) == 1",
Query().where(f.strlen(t.stringField) == 1).render())
def test_sqrt(self):
self.assertEqual(" | where (sqrt(numField)) > 1",
Query().where(f.sqrt(t.numField) > 1).render())
def test_count_of(self):
self.assertEqual(
' | where (countof(stringField, "abc", "normal")) == 2',
Query().where(f.count_of(t.stringField, "abc") == 2).render())
def test_startofday(self):
self.assertEqual(
" | where (startofday(dateField)) > datetime(2019-07-23 00:00:00.000000)",
Query().where(
f.start_of_day(t.dateField) > datetime(2019, 7, 23)).render())
def test_todatetime(self):
self.assertEqual(
" | extend foo = todatetime(stringField)",
Query().extend(foo=f.to_datetime(t.stringField)).render())
def test_startofmonth(self):
self.assertEqual(
" | where (startofmonth(dateField)) > datetime(2019-07-01 00:00:00.000000)",
Query().where(
f.start_of_month(t.dateField) > datetime(2019, 7, 1)).render())
def test_toint(self):
self.assertEqual(" | where (toint(stringField)) > 1",
Query().where(f.to_int(t.stringField) > 1).render())
def test_startofweek(self):
self.assertEqual(
" | where (startofweek(dateField)) > datetime(2019-07-08 00:00:00.000000)",
Query().where(
f.start_of_week(t.dateField) > datetime(2019, 7, 8)).render())
def test_tolower(self):
self.assertEqual(
' | where (tolower(stringField)) == "foo"',
Query().where(f.to_lower(t.stringField) == "foo").render())
def test_startofyear(self):
self.assertEqual(
" | where (startofyear(dateField)) > datetime(2019-01-01 00:00:00.000000)",
Query().where(
f.start_of_year(t.dateField) > datetime(2019, 1, 1)).render())
def test_to_timespan(self):
self.assertEqual(
" | extend t = totimespan(stringField)",
Query().extend(t=f.to_timespan(t.stringField)).render())
def test_pack_all(self):
self.assertEqual(" | extend packed = pack_all()",
Query().extend(packed=f.pack_all()).render())