Not producing result when Variable is being passed in search after eval

[Thulasiraman]

Below query is producing the results 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| search job_name=*"Group06"* OR job_name=*"Group01"*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass

but not this query. $group$ - dropdown selected option is Group06

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=*rerunGroup*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass

No big difference except Eval statement and passing the variable value. 

Can someone please help

[scelikok]

Hi @Thulasiraman,

"search" command  is not using another field value. Please try with "where" command like below,

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| where job_name="*$group$*" OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass

[scelikok]

Hi @Thulasiraman,

Can you please try below? 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass

[Thulasiraman]

@scelikok No luck. I have attached outcome screenshot for your reference

| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01

| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06

  

[Thulasiraman]

@ITWhisperer Can you please help with my above question? Thanks in advance!