Getting Data In

Not producing result when Variable is being passed in search after eval

Thulasiraman
Explorer

Below query is producing the results 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| search job_name=*"Group06"* OR job_name=*"Group01"*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



but not this query. $group$ - dropdown selected option is Group06

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=*rerunGroup*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



No big difference except Eval statement and passing the variable value. 

Can someone please help

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

"search" command  is not using another field value. Please try with "where" command like below,

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| where job_name="*$group$*" OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

Can you please try below? 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote is appreciated.
0 Karma

Thulasiraman
Explorer

@scelikok No luck. I have attached outcome screenshot for your reference

| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01

| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06

Screenshot 2023-11-20 at 1.07.04 PM.png

Screenshot 2023-11-20 at 1.06.37 PM.png

  

0 Karma

Thulasiraman
Explorer

@ITWhisperer Can you please help with my above question? Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...