pipe and data carry through

[Lynyrd]

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximum = 20 | eval Actual = Round(Actual) | bin Actual span=1 | chart stdev(Actual) as stedVal | eval capture = if(stedVal/Maximum <= 0.17, Maximum, Maximum)

Maximum does not print out in results

[Lynyrd]

What is the code in SPLUNK to do this? Convert PERL to SPLUNK

foreach $event (@dbase){
push(@records, split(/\,/, $event));
}

for($j=0; $j<$num_records, $j++){

push(@mu_set, ($records[2]+$records[3])/2);

}

[mayurr98]

Run this only

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximumx = 20

If you are getting maximum then chart command after that is removing that field you need to use alternative of chart or you need to add those fields in chart which you want to use!!

Also one more thing just do not run full query. Debug it after each | as you do at each test point in the test centre and see where it is getting fail.
I hope this solves your query

[Lynyrd]

I don't think splunk can do what I want it to do because it appears it cannot work with data in parallel because of its pipe structure. I need to work with multiple charts and arrays in parallel and I need data structures that splunk does not have like associative arrays and indexing into those arrays... I think I should use PERL or Python to do what I need to do. I'm interested in searching of course but I need to calculate intermediate values based on search results on multiple test points TP's.

I don't think splunk has that capability.

[Lynyrd]

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximumx = 20 | eval Actual = Round(Actual) | bin Actual span=1 | chart stdev(Actual) as stedVal | eval capture = if(stedVal/Maximumx <= 0.17, Maximumx, Maximumx)

Maximumx is not being printed out.

[Lynyrd]

I'm debugging. I want to see if Maximum gets se to 20 and then I want to if it get printed out.