Hi everyone, I have a CSV file where the line breaks are signified by a semicolon ; . I am wondering how one would parse this CSV with the "line break" being a different character. Example: Number, Score; 1 , 44.5678690273 ;11 , 60.0795233081 ; 14 , 13.6359924845 ; 16 , 44.6169376811 ; 17 , 47.6782506507 ; I tried using: HEADER_FIELD_LINE_NUMBER=1 FIELD_NAMES=Number, Score BREAK_ONLY_BEFORE=; CHARSET=AUTO INDEXED_EXTRACTIONS=csv KV_MODE=none LINE_BREAK=; MUST_BREAK_AFTER=; NO_BINARY_CHECK=true SHOULD_LINEMERGE=true pulldown_type=true However, it does not break the events at the semicolons. ... View more

I am wondering if it is possible to get the value of the chart title and use it/reference it in the search? <panel> <single> <title>GetUsers</title> <search> <query>sourcetype="test_suite_result_xml" testCaseName="$chart.title$"</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </single> </panel> If this is not possible, can one declare a variable within the <panel> tags and reference that variable in the Chart Title and search? What I'm trying to achieve is to have a universal search without any hardcoded values. ... View more

I have the following search which extracts the inner XML pieces. I'm trying to re-parse the resulting strings into XML using xmlkv for additional extraction and it is not working properly... sourcetype="test_suite_result_xml" | xpath outfield=testCase "//testSuite/testRunnerResults/testCase" | mvexpand testCase returns a list of these: <testCase> <startTime>15:45:45</startTime> <status>FINISHED</status> <testCaseId>027c9aec-3802-480c-8f5e-637ebcd192d9</testCaseId> <testCaseName>UC-CR-0010</testCaseName> <timeTaken>608</timeTaken> <testStepResults> <result> <message>Step 1 [MINT-BE-GetApplicationAndBaseUrl] OK: took 129 ms</message> <name>MINT-BE-GetApplicationAndBaseUrl</name> <order>2</order> <started>15:45:45.256</started> <status>OK</status> <timeTaken>129</timeTaken> </result> <result> <message>Step 2 [MINT-BE-StartSession] OK: took 237 ms</message> <name>MINT-BE-StartSession</name> <order>3</order> <started>15:45:45.445</started> <status>OK</status> <timeTaken>237</timeTaken> </result> <result> <message>Step 3 [Transfer_JSessionID] OK: took 4 ms -> Script-result: org.mozilla.javascript.Undefined@689cc181</message> <name>Transfer_JSessionID</name> <order>4</order> <started>15:45:45.726</started> <status>OK</status> <timeTaken>4</timeTaken> </result> <result> <message>Step 4 [MINT-BE-GetUser] OK: took 115 ms</message> <name>MINT-BE-GetUser</name> <order>5</order> <started>15:45:45.751</started> <status>OK</status> <timeTaken>115</timeTaken> </result> <result> <message>Step 5 [MINT-BE-EndSession] OK: took 123 ms</message> <name>MINT-BE-EndSession</name> <order>6</order> <started>15:45:45.905</started> <status>OK</status> <timeTaken>123</timeTaken> </result> </testStepResults> <failedTestSteps/> </testCase> However, adding xmlkv after and trying to extract the testCaseNames returns nothing. sourcetype="test_suite_result_xml" | xpath outfield=testCase "//testSuite/testRunnerResults/testCase" | mvexpand testCase | eval _raw=testCase | xmlkv | table testCase.testCaseName ... View more

I have an XML results input that is indexed on per Test Suite. Each Test Suite has many Test Cases, and each Test Case has many Test Steps. I am trying to create a report where we would like to find out which Test Suite, Case, and Steps failed and what was the error message. However, my search is coming back with all the test case names, and all messages regardless of failure or success. Is there a way to filter out just the failed status for a specific node? Current search: sourcetype=test_suite_result_xml testRunnerResults.testCase.status=FAILED | stats values(testSuiteName) values(testRunnerResults.testCase.testCaseName) values(testRunnerResults.testCase.testStepResults.result.message) by testRunnerResults.testCase.testCaseName Sample XML data: <testSuite> <startTime>15:33:18</startTime> <status>FAILED</status> <testSuiteName>UserLifecycleManager</testSuiteName> <timeTaken>399799</timeTaken> <testRunnerResults> <testCase> <reason>Failing due to failed test step</reason> <startTime>15:33:18</startTime> <status>FAILED</status> <testCaseId>f1d9066c-6744-462e-bf76-6eed9b610a5a</testCaseId> <testCaseName>CreateUser</testCaseName> <timeTaken>1881</timeTaken> <testStepResults> <result> <message>[GetApplicationAndBaseUrl] OK: took 279 ms</message> <name>GetApplicationAndBaseUrl</name> <order>2</order> <started>15:33:18.431</started> <status>OK</status> <timeTaken>279</timeTaken> </result> <result> <message>[CreateNewUser] FAILED: took 281 ms -> [Valid HTTP Status Codes] Response status code:400 is not in acceptable list of status codes</message> <name>CreateNewUser</name> <order>9</order> <started>15:33:20.622</started> <status>FAILED</status> <timeTaken>281</timeTaken> </result> </testStepResults> </testCase> <testCase> <reason></reason> <startTime>15:33:21</startTime> <status>FINISHED</status> <testCaseId>f72a96f9-64f5-4ce4-861a-151e3aadd41f</testCaseId> <testCaseName>VerifyGroup</testCaseName> <timeTaken>598</timeTaken> <testStepResults> <result> <message>[GetApplicationAndBaseUrl] OK: took 256 ms</message> <name>GetApplicationAndBaseUrl</name> <order>2</order> <started>15:33:21.568</started> <status>OK</status> <timeTaken>256</timeTaken> </result> </testStepResults> </testCase> ... View more