<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Jenkins JSON test results into table by build in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526330#M148558</link>
    <description>&lt;LI-CODE lang="markup"&gt;{"event_tag":"build_report","metadata":{"scm":"git"},"job_name":"job1","testsuite":{"failures":0,"passes":2,"skips":0,"total":2,"duration":1968.0,"tests":2,"time":1968.0,"errors":0,"testcase":[{"duration":122.0,"classname":"Testsuites.MyCallCenter","testname":"Login","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Login","status":"PASSED"},
{"duration":148.0,"classname":"Testsuites.MyCallCenter","testname":"Edit Calendar","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Edit Calendar","status":"PASSED"}]
},"build_number":615,"page_num":1,"job_result":"PASSED","user":"(timer)","build_url":"job/build/615/"}&lt;/LI-CODE&gt;</description>
    <pubDate>Sat, 24 Oct 2020 12:39:31 GMT</pubDate>
    <dc:creator>JykkeDaMan</dc:creator>
    <dc:date>2020-10-24T12:39:31Z</dc:date>
    <item>
      <title>Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526316#M148553</link>
      <description>&lt;P&gt;I'm wondering if the following table structure is possible (without custom JS).&lt;/P&gt;&lt;P&gt;Raw events are from Jenkins plugin. Below one event example. I get one per job/test/build.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;{ [-]
   build_number: 615
   build_url: job1
   event_tag: build_report
   job_name: jobname
   job_result: FAILURE
   metadata: { [+]
   }
   page_num: 1
   testsuite: { [-]
     duration: 1968
     errors: 0
     failures: 6
     passes: 7
     skips: 0
     testcase: [ [-]
       { [-]
         classname: Testsuites.MyCallCenter
         duration: 122
         failedsince: 0
         groupname: Testsuites
         skipped: false
         status: PASSED
         testname: Login
         uniquename: Testsuites.MyCallCenter.Login
       }
       { [-]
         classname: Testsuites.MyCallCenter
         duration: 148
         failedsince: 0
         groupname: Testsuites
         skipped: false
         status: PASSED
         testname: Edit Calendar
         uniquename: Testsuites.MyCallCenter.Edit Calendar
       }
       { [+]
       }
     ]
     tests: 13
     time: 1968
     total: 13
   }
   user: (timer)
}&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can I create a table, which has a dynamic build number in the header somehow like this?&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;classname | testname | build-613 | build-614 | build-615
Testsuites.MyCallCenter | Login | PASSED | PASSED | PASSED
Testsuites.MyCallCenter | Edit Calendar | PASSED | FAILED | PASSED&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 24 Oct 2020 08:59:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526316#M148553</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-24T08:59:06Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526322#M148555</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=_internal |head 1 | fields _raw |eval _raw="{\"build_number\":\"615\",\"build_url\":\"job1\",\"event_tag\":\"build_report\",\"job_name\":\"jobname\",\"job_result\":\"FAILURE\",\"metadata\":{},\"page_num\":\"1\",\"testsuite\":{\"duration\":\"1968\",\"errors\":\"0\",\"failures\":\"6\",\"passes\":\"7\",\"skips\":\"0\",\"testcase\":[{\"classname\":\"Testsuites.MyCallCenter\",\"duration\":\"122\",\"failedsince\":\"0\",\"groupname\":\"Testsuites\",\"skipped\":\"false\",\"status\":\"PASSED\",\"testname\":\"Login\",\"uniquename\":\"Testsuites.MyCallCenter.Login\"},{\"classname\":\"Testsuites.MyCallCenter\",\"duration\":\"148\",\"failedsince\":\"0\",\"groupname\":\"Testsuites\",\"skipped\":\"false\",\"status\":\"PASSED\",\"testname\":\"Edit Calendar\",\"uniquename\":\"Testsuites.MyCallCenter.Edit Calendar\"},{}],\"tests\":\"13\",\"time\":\"1968\",\"total\":\"13\"},\"user\":\"(timer)\"}"
| rename COMMENT as "the logic"
| spath build_number
| spath testsuite.testcase{} output=testcase
| stats values(eval("build_number_".build_number)) as build_number by testcase
| spath input=testcase
| table build_number classname testname status
| eval tmp=classname."_".testname
| xyseries tmp build_number status
| eval classname=mvindex(split(tmp,"_"),0), testname=mvindex(split(tmp,"_"),1)
| fields - tmp
| table classname testname *&lt;/LI-CODE&gt;&lt;P&gt;I would like you to present _raw. I have to process it.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 24 Oct 2020 11:03:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526322#M148555</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-10-24T11:03:26Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526330#M148558</link>
      <description>&lt;LI-CODE lang="markup"&gt;{"event_tag":"build_report","metadata":{"scm":"git"},"job_name":"job1","testsuite":{"failures":0,"passes":2,"skips":0,"total":2,"duration":1968.0,"tests":2,"time":1968.0,"errors":0,"testcase":[{"duration":122.0,"classname":"Testsuites.MyCallCenter","testname":"Login","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Login","status":"PASSED"},
{"duration":148.0,"classname":"Testsuites.MyCallCenter","testname":"Edit Calendar","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Edit Calendar","status":"PASSED"}]
},"build_number":615,"page_num":1,"job_result":"PASSED","user":"(timer)","build_url":"job/build/615/"}&lt;/LI-CODE&gt;</description>
      <pubDate>Sat, 24 Oct 2020 12:39:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526330#M148558</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-24T12:39:31Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526332#M148559</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="Screenshot 2020-10-24 at 15.43.36.jpg" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11476i77A208A0F3261185/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2020-10-24 at 15.43.36.jpg" alt="Screenshot 2020-10-24 at 15.43.36.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Close already. I put the build number only to short the output.&lt;/P&gt;</description>
      <pubDate>Sat, 24 Oct 2020 12:47:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526332#M148559</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-24T12:47:11Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526343#M148560</link>
      <description>&lt;LI-CODE lang="markup"&gt;| rename COMMENT as "the logic"
| streamstats count as session
| spath build_number
| spath testsuite.testcase{} output=testcase
| stats values(eval("build_number_".build_number)) as build_number by session testcase
| spath input=testcase
| table build_number classname testname status
| eval tmp=classname."_".testname
| xyseries tmp build_number status
| eval classname=mvindex(split(tmp,"_"),0), testname=mvindex(split(tmp,"_"),1)
| fields - tmp 
| table classname testname *&lt;/LI-CODE&gt;&lt;P&gt;Have you tried my logic? the result is wrong.&amp;nbsp; "build_number_" is missing.&lt;BR /&gt;&lt;BR /&gt;If it is changed in a strange way, it cannot be fixed.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 24 Oct 2020 21:45:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526343#M148560</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-10-24T21:45:39Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526355#M148561</link>
      <description>&lt;P&gt;Yes, the first example dit not work, I only removed the prefix "build_number_" to make the output shorter.&lt;/P&gt;&lt;P&gt;But your second example looks better with the split by 'session'. Now we get one row per build there. I'll look into and get back to you.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sun, 25 Oct 2020 05:52:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526355#M148561</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-25T05:52:37Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526357#M148563</link>
      <description>&lt;P&gt;I think&amp;nbsp; I have some testcases larger than 5000 characters and spath only parses the first 5K?&lt;BR /&gt;I have 6K of chars, in case of error happens.&lt;/P&gt;&lt;P&gt;BTW, does it help, if I already have index time extractions defined for sourcetype?&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[json:jenkins]
pulldown_type = true
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRUNCATE = 0
category = Structured
LEARN_MODEL = false
description = JavaScript Object Notation format.&lt;/LI-CODE&gt;&lt;P&gt;So my events have already to following fields:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;job_name
job_result
level
linecount
log_source
log_thrown
message
metadata.scm
page_num
testsuite.duration
testsuite.errors
testsuite.failures
testsuite.passes
testsuite.skips
testsuite.testcase{}.classname
testsuite.testcase{}.duration
testsuite.testcase{}.errordetails
testsuite.testcase{}.errorstacktrace
testsuite.testcase{}.failedsince
testsuite.testcase{}.groupname
testsuite.testcase{}.skipped
testsuite.testcase{}.status
testsuite.testcase{}.testname
testsuite.testcase{}.uniquename
testsuite.tests
testsuite.time
testsuite.total&lt;/LI-CODE&gt;</description>
      <pubDate>Sun, 25 Oct 2020 06:55:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526357#M148563</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-25T06:55:51Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526358#M148564</link>
      <description>&lt;LI-CODE lang="markup"&gt;...
| streamstats count as session
| stats list(testsuite.testcase{}.*) as * by session build_number
| eval tmp=mvzip(classname,mvzip(testname,status))
| stats values(build_number) as build_number by session tmp
| eval status=mvindex(split(tmp,","),-1)
| xyseries tmp build_number status
| rex mode=sed field=tmp "s/,\w+$//g"
| rename COMMENT as "check this result"
| selfjoin tmp
| eval classname=mvindex(split(tmp,","),0), testname=mvindex(split(tmp,","),1)
| fields - tmp
| table *name *&lt;/LI-CODE&gt;&lt;P&gt;It's very hard to create a log when there's only one log on display, isn't it?&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 25 Oct 2020 07:54:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526358#M148564</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-10-25T07:54:04Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526362#M148566</link>
      <description>&lt;P&gt;This is what I have now and it is looking good. I'm still playing and verifying it.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;...
| streamstats count as session
| spath output=test "testsuite.testcase{}" 
| fields session test host job_name build_number 
| mvexpand test 
| eval result=if(isnotnull(errordetails), "Failed", if(skipped=="true", "Skipped", "Passed"))
| eval duration=round(duration, 2)
| eval result=result
| stats values(build_number) as build_number by session test
| spath input=test output=status "status" 
| spath input=test output=name "name" 
| spath input=test output=testname "testname" 
| eval testname=coalesce(name, testname) 
| spath input=test output=classname "classname" 
| spath input=test output=errordetails "errordetails" 
| spath input=test output=skipped "skipped" 
| eval result=if(isnotnull(errordetails), "Failed", if(skipped=="true", "Skipped", "Passed"))
| table build_number classname testname result
| eval tmp=classname."_".testname
| xyseries tmp build_number result
| eval classname=mvindex(split(tmp,"_"),0), testname=mvindex(split(tmp,"_"),1)
| fields - tmp 
| table classname testname *&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2020-10-25 at 10.14.30.jpg" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11481iBA555D9BB183B120/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2020-10-25 at 10.14.30.jpg" alt="Screenshot 2020-10-25 at 10.14.30.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;And your latest example look good as well :-).&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2020-10-25 at 10.12.12.jpg" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11480iE7CE671C36B63835/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2020-10-25 at 10.12.12.jpg" alt="Screenshot 2020-10-25 at 10.12.12.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;I will accept your answer after I have verified a bit.&lt;/P&gt;&lt;P&gt;Thanks A LOT!&lt;/P&gt;</description>
      <pubDate>Sun, 25 Oct 2020 08:17:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526362#M148566</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-25T08:17:47Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526385#M148575</link>
      <description>&lt;P&gt;One thing: If I have build numbers like 4x, 5x, 3xx, the&amp;nbsp;xyseries seems to sort them as string, not as a number.&lt;/P&gt;&lt;P&gt;Now I get: 3xx, 4x, 5x&lt;BR /&gt;I would like to have: 4x, 5x, 3xx, 4xx, 5xx&lt;BR /&gt;&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2020-10-25 at 23.45.04.jpg" style="width: 668px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11482i1DD46F51652BAFE4/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2020-10-25 at 23.45.04.jpg" alt="Screenshot 2020-10-25 at 23.45.04.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 25 Oct 2020 21:49:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526385#M148575</guid>
      <dc:creator>JykkeDaMan</dc:creator>
      <dc:date>2020-10-25T21:49:53Z</dc:date>
    </item>
    <item>
      <title>Re: Jenkins JSON test results into table by build</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526621#M148643</link>
      <description>&lt;P&gt;sample:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults count=20
| eval name=random() % 200
| eval fieldA="TEST", fieldB="TEST2"
| xyseries fieldA name fieldB
| transpose 0 header_field=fieldA
| sort 0  column
| transpose 0 header_field=column&lt;/LI-CODE&gt;&lt;P&gt;try &lt;STRONG&gt;transpose&lt;/STRONG&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 27 Oct 2020 10:29:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Jenkins-JSON-test-results-into-table-by-build/m-p/526621#M148643</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-10-27T10:29:59Z</dc:date>
    </item>
  </channel>
</rss>

