Not able to remove entries from table row

[uptoNoGood]

Hi,

We have a jenkins pipeline and I am writing a query to visualize duration of various stages across different builds. When using jenkins splunk plugin, its giving some values which arent actually stage names.

If I try to remove those out in search itself, it returns empty data as all stages seem to be in a single statistics raw event. If i later try to use where on it that too doesnt work. Sort also doesnt work on numerice duration values 

Query I am using is :

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*" 
| rename stages{}.duration as stageduration 
| rename stages{}.name as stageName
| table stageName, stageduration, build_number

Query returns result like :

How do i remove stages like /apps, com ones ?

[richgalloway]

Try using mvfilter to remove the undesired bits.

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*" 
| rename stages{}.duration as stageduration 
| rename stages{}.name as stageName
| eval stageName=mvfilter(stageName, "\/apps")
| table stageName, stageduration, build_number

[uptoNoGood · Accepted solution]

Hi @richgalloway 
This was giving syntax error. Did you mean mvfilter(match(stageName, "\/apps")?
I wasn't aware of multi fields, after your reply I tried on multiple multi field options and ended up using a combination of mvexpand, table and spath :

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*"
| spath output=stagesmf path=stages{}
| table stagesmf, build_number
| mvexpand stagesmf
| rename stagesmf as _raw
| spath path=duration | spath path=name | spath path=start_time
| table name, duration, start_time, build_number
| where NOT like(name, "%.groovy")

problem with working with multi fields was that any filter only removed values from one column, so i had to separate these out early to get filtering to work

[richgalloway]

Apologies for the syntax error. Glad you figured it out.
If your problem is resolved, please accept one of the replies to help future readers.