Getting Data In

Not producing result when Variable is being passed in search after eval

Thulasiraman
Explorer

Below query is producing the results 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| search job_name=*"Group06"* OR job_name=*"Group01"*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



but not this query. $group$ - dropdown selected option is Group06

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "Group01", "$group$"=="Group07", "Group02", "$group$"=="Group08", "Group03", "$group$"=="Group09", "Group04", "$group$"=="Group10", "Group05",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=*rerunGroup*
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass



No big difference except Eval statement and passing the variable value. 

Can someone please help

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

"search" command  is not using another field value. Please try with "where" command like below,

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| where job_name="*$group$*" OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Thulasiraman,

Can you please try below? 

index="jenkins" sourcetype="json:jenkins" job_name="$env$_Group*" event_tag=job_event type=completed
| eval rerunGroup = case("$group$"=="Group06", "*Group01*", "$group$"=="Group07", "*Group02*", "$group$"=="Group08", "*Group03*", "$group$"=="Group09", "*Group04*", "$group$"=="Group10", "*Group05*",1==1, "???")
|''' table rerunGroup  - This shows Group01 in the table '''
| search job_name=*$group$* OR job_name=rerunGroup
| head 2
| dedup build_number
| stats sum(test_summary.passes) as Pass
| fillnull value="Test Inprogress..." Pass
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Thulasiraman
Explorer

@scelikok No luck. I have attached outcome screenshot for your reference

| search job_name=*Group06* OR job_name=*Group01* - This produce 2 events, 1st one belong to Group06 2nd event belong to Group01

| search job_name=*Group06* OR job_name=rerunGroup - This produce only 1 event belong to Group06

Screenshot 2023-11-20 at 1.07.04 PM.png

Screenshot 2023-11-20 at 1.06.37 PM.png

  

0 Karma

Thulasiraman
Explorer

@ITWhisperer Can you please help with my above question? Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...