Failing test: Serverless Security Functional Tests - Common Group 6.x-pack/test_serverless/functional/test_suites/common/discover_ml_uptime/discover/search_source_alert·ts - Discover alerting Search source Alert should create an alert when there is no data view

[kibanamachine]

A test failed on a tracked branch

Error: expected 'DATA VIEW\n.kibana-event-log-*' to sort of equal 'DATA VIEW\nSelect a data view'
    at Assertion.assert (expect.js:100:11)
    at Assertion.eql (expect.js:244:8)
    at Context.<anonymous> (search_source_alert.ts:384:60)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at Object.apply (wrap_function.js:73:16) {
  actual: 'DATA VIEW\n.kibana-event-log-*',
  expected: 'DATA VIEW\nSelect a data view',
  showDiff: true
}

First failure: CI Build - main

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[kertal]

Flaky test runner https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4239

[kertal]

Closing since flaky test runner (50x) detected no flakiness

[kibanamachine]

New failure: CI Build - main

[dmlemeshko]

This test is skipped for Security project due to flakiness: after migrating to SAML roles, the scenario is failing even with SAML Admin role. Works consistently good for Oblt/Search

[kertal]

this is strange, so it seems the security project already has data views available, when there should be non, maybe we should cleanup saved objects before running this test? However it would be interesting, what is causing the difference for the security project FYI @elastic/security-solutions ? Maybe there are other tests executed upfront adding data views?

[kertal]

it looks like the DataViews in the screenshot match the default data views of Security:

kibana/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/sourcerer/sourcerer_timeline.cy.ts

Line 41 in 9746bab

const dataViews = ['logs-*', 'metrics-*', '.kibana-event-log-*'];