Below query is producing the results
index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| search job_name=*"Group06"* OR job_name=*"Group01"*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
but not this query. $group$ - dropdown selected option is Group06
index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???")
|''' table rerunGroup - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=*rerunGroup*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
No big difference except Eval statement and passing the variable value.
Can someone please help
Hi @Thulasiraman,
"search" command is not using another field value. Please try with "where" command like below,
index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup - This shows Group01 in the table '''
| where job_name="*$group$*" OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
Hi @Thulasiraman,
Can you please try below?
index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
@scelikok No luck. I have attached outcome screenshot for your reference
| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01
| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06
@ITWhisperer Can you please help with my above question? Thanks in advance!