All Apps and Add-ons

Search through only failing logs - Jenkins


I am trying to speed up a search on Splunk. The search looks through millions of logs for matches to around 100 event types (each event type has multiple strings to match) so it has ended up being very slow.

The original search I have is:


eventtype=fail_type* source="*console" host = $jenkins_server$  | timechart count by eventtype


Which plots a timechart of the different types of fails in the console logs of jenkins which is what I want.

I tried to speed up the job by getting it to only look through logs from failing jobs. I can get a table of failing console logs using the search below but if I try to use those console paths for a new search by adding "| search source=console_path" it doesn't work


event_tag="job_event" host = $jenkins_server$
| eval job_result=if(type="started", "INPROGRESS", job_result) `utc_to_local_time(job_started_at)`
| search (job_result=FAILURE OR job_result=UNSTABLE OR job_result=ABORTED)
| eval console_path= "*" + build_url + "console*"
| table console_path build_url job_result


Apricate any help or suggestions for other ways to speed up the search

Labels (3)
Tags (1)
0 Karma


Setting aside possible accelerations (have you thought about it?), you end your search with a | table command which returns only given set of fields. You don't have source among them so searching by it won't produce any results.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...