Splunk Search

How to configure a search for metadata

jtpryan
New Member

I have a number of Jenkins jobs for which I would like to create a dashboard with search (pull downs, form fills). The searching would be on the metadata held within each job.

For example, one of the pieces of metadata is a filed the Jenkins user filled out called "squad name".

If I just search for one of the squad names I know are in there, SquadNameJimDoodle,
I get the following results:

build_number: 544
   build_url:job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test
   event_tag: build_report
   job_name: job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/
   job_result: SUCCESS
   metadata: { [-]
     FUNCTIONAL_AREA: Digital
     JMX_FILE: Sample-Test-Plan/sendMessageTest.jmx
     REMOTE_BRANCH: EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field
     REQUIRED_LGS: 1
     SQUAD_NAME: SquadNameJimDoodle
     STACK_NAME: Jimmystack
     TEST_REPO_BRANCH: Branch
     TEST_REPO_URL: https://test_repo
   }
   page_num: 1
   testsuite: { [+]
   }
   user: me

As you can see the metadata field SQUAD_NAME: is where the value SquadNameJimDoodle is held.

The other fields I need to search on are also in this "metadata" area. I can't figure out how to build the query to search on them.

Any help appreciated.

Jim

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"build_number\": 544,
    \"build_url\":\"job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test\",
    \"event_tag\": \"build_report\",
    \"job_name\": \"job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/\",
    \"job_result\": \"SUCCESS\",
    \"metadata\": { 
      \"FUNCTIONAL_AREA\": \"Digital\",
      \"JMX_FILE\": \"Sample-Test-Plan/sendMessageTest.jmx\",
      \"REMOTE_BRANCH\": \"EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field\",
      \"REQUIRED_LGS\": 1,
      \"SQUAD_NAME\": \"SquadNameJimDoodle\",
      \"STACK_NAME\": \"Jimmystack\",
      \"TEST_REPO_BRANCH\": \"Branch\",
      \"TEST_REPO_URL\": \"https://test_repo\"},
    \"page_num\": 1,
    \"testsuite\": { 
    },
    \"user\": \"me\"}}"
    | spath path=metadata output=metadata
    | table metadata
    | spath input=metadata

Hi, @jtpryan
How about this?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...