Splunk Search

How to configure a search for metadata

jtpryan
New Member

I have a number of Jenkins jobs for which I would like to create a dashboard with search (pull downs, form fills). The searching would be on the metadata held within each job.

For example, one of the pieces of metadata is a filed the Jenkins user filled out called "squad name".

If I just search for one of the squad names I know are in there, SquadNameJimDoodle,
I get the following results:

build_number: 544
   build_url:job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test
   event_tag: build_report
   job_name: job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/
   job_result: SUCCESS
   metadata: { [-]
     FUNCTIONAL_AREA: Digital
     JMX_FILE: Sample-Test-Plan/sendMessageTest.jmx
     REMOTE_BRANCH: EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field
     REQUIRED_LGS: 1
     SQUAD_NAME: SquadNameJimDoodle
     STACK_NAME: Jimmystack
     TEST_REPO_BRANCH: Branch
     TEST_REPO_URL: https://test_repo
   }
   page_num: 1
   testsuite: { [+]
   }
   user: me

As you can see the metadata field SQUAD_NAME: is where the value SquadNameJimDoodle is held.

The other fields I need to search on are also in this "metadata" area. I can't figure out how to build the query to search on them.

Any help appreciated.

Jim

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"build_number\": 544,
    \"build_url\":\"job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test\",
    \"event_tag\": \"build_report\",
    \"job_name\": \"job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/\",
    \"job_result\": \"SUCCESS\",
    \"metadata\": { 
      \"FUNCTIONAL_AREA\": \"Digital\",
      \"JMX_FILE\": \"Sample-Test-Plan/sendMessageTest.jmx\",
      \"REMOTE_BRANCH\": \"EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field\",
      \"REQUIRED_LGS\": 1,
      \"SQUAD_NAME\": \"SquadNameJimDoodle\",
      \"STACK_NAME\": \"Jimmystack\",
      \"TEST_REPO_BRANCH\": \"Branch\",
      \"TEST_REPO_URL\": \"https://test_repo\"},
    \"page_num\": 1,
    \"testsuite\": { 
    },
    \"user\": \"me\"}}"
    | spath path=metadata output=metadata
    | table metadata
    | spath input=metadata

Hi, @jtpryan
How about this?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...