Search - Combine different events which are results of a single search command

[JP]

Hi,

My Jenkins sends my testresults data for the same job (Automation regression tests job)  to Splunk in multiple events.

For example, 

Results of single search query - One event has my job details like job duration, job_start_date etc, another event has my test results details like testcasename, test status etc. Now I would like to fetch job_start_date and job_duration from one event and introduce this as new fields along with my second events. So that I can have one table with all details.

These are the data I have, both these results are linked to each other through job_name.

Now I would like to have job_Start_Date and job_duration for each of my test case.

I tried to use Joins (this would not give me job_duration, job_Start_Date for every record in my table), eval also did not work.

Is there any other command that would help in this case ? Can someone guide please. 

Thanks.

[ITWhisperer]

Try appending the second search to the first and then use stats values(*) as * by job_name

[JP]

@ITWhisperer  This is my first search that get the results in a table

index=jenkins* host=opsdev-app-jenkins.route53.com
| search job_name=Dev/TestAutomation/Cert1_Regression source="/test"
| spath path=testsuite.testcase{} output=testcase
| mvexpand testcase
| spath input=testcase path=classname output=tclassname
| spath input=testcase path=testname output=testname
| spath input=testcase path=status output=status
| rename metadata.Auto.Environment AS Environment
| table job_started_at job_duration job_name Environment tclassname testname status

Tried to do append search like below, still job_duration and job_started_at are not populated.

index=jenkins* host=opsdev-app-jenkins.route53.com
| search job_name=DevTestAutomation/gNS_Cert1_Regression source="/test"
| append [search job_name=Dev/TestAutomation/_Cert1_Regression host=opsdev-app-jenkins.route53.com event_tag=job_event | stats values(*) as * by job_name]
| spath path=testsuite.testcase{} output=testcase
| mvexpand testcase
| spath input=testcase path=classname output=tclassname
| spath input=testcase path=testname output=testname
| spath input=testcase path=status output=status
| rename metadata.Auto.Environment AS Environment
| table job_started_at job_duration job_name Environment tclassname testname status

Thanks