topic Re: Not producing result when Variable is being passed in search after eval in Getting Data In

Not producing result when Variable is being passed in search after eval

Thulasiraman — Mon, 20 Nov 2023 16:57:19 GMT

Below query is producing the results

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed | search job_name=*"Group06"* OR job_name=*"Group01"* | head 2 | dedup build_number | stats sum(test_summary.passes) as Pass | fillnull value="Test Inprogress..." Pass

but not this query. $group$ - dropdown selected option is Group06

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed | eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???") |''' table rerunGroup - This shows Group01 in the table ''' | search job_name=*$group$* OR job_name=*rerunGroup* | head 2 | dedup build_number | stats sum(test_summary.passes) as Pass | fillnull value="Test Inprogress..." Pass

No big difference except Eval statement and passing the variable value.

Can someone please help

Re: Not producing result when Variable is being passed in search after eval

Thulasiraman — Mon, 20 Nov 2023 15:30:29 GMT

@ITWhisperer Can you please help with my above question? Thanks in advance!

Re: Not producing result when Variable is being passed in search after eval

scelikok — Mon, 20 Nov 2023 17:21:12 GMT

Hi @Thulasiraman,

Can you please try below?

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed | eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???") |''' table rerunGroup - This shows Group01 in the table ''' | search job_name=*$group$* OR job_name=rerunGroup | head 2 | dedup build_number | stats sum(test_summary.passes) as Pass | fillnull value="Test Inprogress..." Pass

Re: Not producing result when Variable is being passed in search after eval

Thulasiraman — Mon, 20 Nov 2023 18:10:24 GMT

@scelikok No luck. I have attached outcome screenshot for your reference

| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01

| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06

Re: Not producing result when Variable is being passed in search after eval

scelikok — Tue, 21 Nov 2023 04:24:14 GMT

Hi @Thulasiraman,

"search" command is not using another field value. Please try with "where" command like below,

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed | eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???") |''' table rerunGroup - This shows Group01 in the table ''' | where job_name="*$group$*" OR job_name=rerunGroup | head 2 | dedup build_number | stats sum(test_summary.passes) as Pass | fillnull value="Test Inprogress..." Pass