Thank you! Works well. I'm struggling to get the last date value to calculate the percentage deviation. Could you please help ... View more

That's not the prettiest data. In order to make some sense of this data you have to first parse the outer array | spath {} Then you have to split the resulting multivalued field | mvexpand {} Now you can parse each of those structures separately | spath input={}   ... View more

Hi @Thulasiraman, "search" command  is not using another field value. Please try with "where" command like below, index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed | eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???") |''' table rerunGroup - This shows Group01 in the table ''' | where job_name="*$group$*" OR job_name=rerunGroup | head 2 | dedup build_number | stats sum(test_summary.passes) as Pass | fillnull value="Test Inprogress..." Pass ... View more

I'm new and learning, can you please help with below query I have json file with below data, I would like to get name and status and display it in table. Help here is much appreciated. I'm new to splunk Name                                                                                                Status assetPortfolio_ValidateAddAssetForOthers                    passed assetPortfolio_ValidatePLaceHolderText                         failure assetPortfolio_ValidateIfFieldUpdated                              passed { "name": "behaviors",  "children": [      {      "name": "assetPortfolio_ValidateAddAssetForOthers",      "status": "passed"      },      {      "name": "assetPortfolio_ValidatePlaceHolderText",      "status": "failure"      },      {      "name": "assetPortfolio_ValidateIfFieldUpdated",      "status": "passed"     }   ] } ... View more