change resolvedFromSearch content (#1629)

pkg/collect/host_dns.go

@@ -177,7 +177,7 @@ func queryDNS(name, query, server string) DNSEntry {
 
 		// remember the search domain that resolved the query
 		// e.g. foo.test.com -> test.com
-		entry.Search = strings.Replace(query, name, "", 1)
+		entry.Search = extractSearchFromFQDN(query, name)
 
 		// populate record detail
 		switch rec {
@@ -207,3 +207,13 @@ func queryDNS(name, query, server string) DNSEntry {
 func (c *CollectHostDNS) RemoteCollect(progressChan chan<- interface{}) (map[string][]byte, error) {
 	return nil, ErrRemoteCollectorNotImplemented
 }
+
+func extractSearchFromFQDN(fqdn, name string) string {
+	// no search domain
+	if fqdn == name {
+		return ""
+	}
+	search := strings.TrimPrefix(fqdn, name+".") // remove name
+	search = strings.TrimSuffix(search, ".")     // remove root dot
+	return search
+}

pkg/collect/host_dns_test.go

@@ -0,0 +1,26 @@
+package collect
+
+import (
+	"testing"
+)
+
+func TestExtractSearchFromFQDN(t *testing.T) {
+	tests := []struct {
+		fqdn     string
+		name     string
+		expected string
+	}{
+		{"foo.com.", "foo.com", ""},
+		{"bar.com", "bar.com", ""},
+		{"*.foo.testcluster.net.", "*", "foo.testcluster.net"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fqdn, func(t *testing.T) {
+			result := extractSearchFromFQDN(test.fqdn, test.name)
+			if result != test.expected {
+				t.Errorf("extractSearchFromFQDN(%q, %q) = %q; want %q", test.fqdn, test.name, result, test.expected)
+			}
+		})
+	}
+}