Dashboards & Visualizations

Not able to remove entries from table row

uptoNoGood
Explorer

Hi,

We have a jenkins pipeline and I am writing a query to visualize duration of various stages across different builds. When using jenkins splunk plugin, its giving some values which arent actually stage names.

If I try to remove those out in search itself, it returns empty data as all stages seem to be in a single statistics raw event. If i later try to use where on it that too doesnt work. Sort also doesnt work on numerice duration values 

Query I am using is :

 

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*" 
| rename stages{}.duration as stageduration 
| rename stages{}.name as stageName
| table stageName, stageduration, build_number

 

 

Query returns result like :

Annotation 2020-07-09 193047.png

How do i remove stages like /apps, com ones ?

Labels (2)
0 Karma
1 Solution

uptoNoGood
Explorer

Hi @richgalloway 
This was giving syntax error. Did you mean mvfilter(match(stageName, "\/apps")?
I wasn't aware of multi fields, after your reply I tried on multiple multi field options and ended up using a combination of mvexpand, table and spath :

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*"
| spath output=stagesmf path=stages{}
| table stagesmf, build_number
| mvexpand stagesmf
| rename stagesmf as _raw
| spath path=duration | spath path=name | spath path=start_time
| table name, duration, start_time, build_number
| where NOT like(name, "%.groovy")

problem with working with multi fields was that any filter only removed values from one column, so i had to separate these out early to get filtering to work

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using mvfilter to remove the undesired bits.

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*" 
| rename stages{}.duration as stageduration 
| rename stages{}.name as stageName
| eval stageName=mvfilter(stageName, "\/apps")
| table stageName, stageduration, build_number

 

---
If this reply helps you, Karma would be appreciated.

uptoNoGood
Explorer

Hi @richgalloway 
This was giving syntax error. Did you mean mvfilter(match(stageName, "\/apps")?
I wasn't aware of multi fields, after your reply I tried on multiple multi field options and ended up using a combination of mvexpand, table and spath :

index=dx_campaign_utf_jenkins_statistics host="<hostname>" event_tag=job_event type=completed job_name=orchestration-pipeline "stages{}.name"="*"
| spath output=stagesmf path=stages{}
| table stagesmf, build_number
| mvexpand stagesmf
| rename stagesmf as _raw
| spath path=duration | spath path=name | spath path=start_time
| table name, duration, start_time, build_number
| where NOT like(name, "%.groovy")

problem with working with multi fields was that any filter only removed values from one column, so i had to separate these out early to get filtering to work

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Apologies for the syntax error. Glad you figured it out.
If your problem is resolved, please accept one of the replies to help future readers.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...