Splunk Search

How to configure a search for metadata

jtpryan
New Member

I have a number of Jenkins jobs for which I would like to create a dashboard with search (pull downs, form fills). The searching would be on the metadata held within each job.

For example, one of the pieces of metadata is a filed the Jenkins user filled out called "squad name".

If I just search for one of the squad names I know are in there, SquadNameJimDoodle,
I get the following results:

build_number: 544
   build_url:job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test
   event_tag: build_report
   job_name: job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/
   job_result: SUCCESS
   metadata: { [-]
     FUNCTIONAL_AREA: Digital
     JMX_FILE: Sample-Test-Plan/sendMessageTest.jmx
     REMOTE_BRANCH: EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field
     REQUIRED_LGS: 1
     SQUAD_NAME: SquadNameJimDoodle
     STACK_NAME: Jimmystack
     TEST_REPO_BRANCH: Branch
     TEST_REPO_URL: https://test_repo
   }
   page_num: 1
   testsuite: { [+]
   }
   user: me

As you can see the metadata field SQUAD_NAME: is where the value SquadNameJimDoodle is held.

The other fields I need to search on are also in this "metadata" area. I can't figure out how to build the query to search on them.

Any help appreciated.

Jim

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"build_number\": 544,
    \"build_url\":\"job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test\",
    \"event_tag\": \"build_report\",
    \"job_name\": \"job/job/Release_Candidate/job/docker-dist-load-test-deploy/job/test/job/jmeter-docker-test/\",
    \"job_result\": \"SUCCESS\",
    \"metadata\": { 
      \"FUNCTIONAL_AREA\": \"Digital\",
      \"JMX_FILE\": \"Sample-Test-Plan/sendMessageTest.jmx\",
      \"REMOTE_BRANCH\": \"EEOTS-5691-Update-PEPT-Template-with-Functional-Domain-Field\",
      \"REQUIRED_LGS\": 1,
      \"SQUAD_NAME\": \"SquadNameJimDoodle\",
      \"STACK_NAME\": \"Jimmystack\",
      \"TEST_REPO_BRANCH\": \"Branch\",
      \"TEST_REPO_URL\": \"https://test_repo\"},
    \"page_num\": 1,
    \"testsuite\": { 
    },
    \"user\": \"me\"}}"
    | spath path=metadata output=metadata
    | table metadata
    | spath input=metadata

Hi, @jtpryan
How about this?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...