Getting Data In

Not producing result when Variable is being passed in search after eval

Thulasiraman
Explorer

Below query is producing the results 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| search job_name=*"Group06"* OR job_name=*"Group01"*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



but not this query. $group$ - dropdown selected option is Group06

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=*rerunGroup*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



No big difference except Eval statement and passing the variable value. 

Can someone please help

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

"search" command  is not using another field value. Please try with "where" command like below,

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| where job_name="*$group$*" OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

Can you please try below? 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Thulasiraman
Explorer

@scelikok No luck. I have attached outcome screenshot for your reference

| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01

| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06

Screenshot 2023-11-20 at 1.07.04 PM.png

Screenshot 2023-11-20 at 1.06.37 PM.png

  

0 Karma

Thulasiraman
Explorer

@ITWhisperer Can you please help with my above question? Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...