Plotting failure/pass percentage of job results over time

[connoroni2]

Hi,

I am attempting to chart the calculated pass and failure percentages over time along with the total passed and failed jobs.

I can successfully create a table that shows the FailureRate and SuccessRate along with my passed and failed totals by using this syntax:

...BASE SEARCH...
| stats count(eval(match(job_result, "FAILURE"))) AS Failed,
count(eval(match(job_result, "SUCCESS"))) AS Passed,
count(eval(match(job_result, "ABORTED"))) AS Aborted
count as t 
| eval s = t-f, percF = (Failed/t)*100, percS=100-percF 
| rename t as Total, percF as FailureRate, percS as SuccessRate
| table Total Passed Failed Aborted FailureRate SuccessRate

When I attempt to make this a chart over time I am not able to overlay the FailureRate and SuccessRate over the same timechart. (Note I had to change to stats count(...) to streamstats(...) to get any output of the total passed, failed, aborted) . 

...BASE SEARCH...
| streamstats count(eval(match(job_result, "FAILURE"))) AS Failed,
count(eval(match(job_result, "SUCCESS"))) AS Passed,
count(eval(match(job_result, "ABORTED"))) AS Aborted
count as t 
| eval s = t-f, percF = (Failed/t)*100, percS=100-percF 
| rename t as Total, percF as FailureRate, percS as SuccessRate
| timechart count by job_result

I am unsure why I am not able to overlay the FailureRate and SuccessRate calculations over time to see the changes as time goes by.

Any help is appreciated as I have scoured this site for some hints on what I am doing wrong.

Thanks! 

[rnowitzki · Accepted solution]

Hi  @connoroni2 ,

You could just exchange streamstats with timechart, directly after the Base Search.
+ You were using "t-f" to eval "s", but "f" was not defined, so I changed it to "t-Failed".

(this is just a question of taste, but I like "speaking" Variables. Why don't you use "total" instead of "t"and "success" instead of "s" in the first place?)

...BASE SEARCH...
| timechart count(eval(match(job_result, "FAILURE"))) AS Failed,
count(eval(match(job_result, "SUCCESS"))) AS Passed,
count(eval(match(job_result, "ABORTED"))) AS Aborted
count as t 
| eval s = t-Failed, percF = (Failed/t)*100, percS=100-percF 
| rename t as Total, percF as FailureRate, percS as SuccessRate

Also, as a side note: You don't account for the Aborted;  the SuccessRate now is just taking the Total minus the Failed ones, but the Aborted ones are not calculated in....

Now the (visual) problem might be, that the Failure- and SuccessRate are just  flat lines in the chart, depending on how much Total is. Maybe you want to show the real numbers of Failed and Passed (and Aborted) in another chart as the percentages. Or you check how it looks like with changing the  format of the Y-Axis to "Log" instead of "Linear"...

Hope this helps.

[connoroni2]

Hi @rnowitzki .

Many thanks for the help! I think it's the standard 'forest in the trees' view of things that I couldn't see the solution.😀

As per your comment for my variable names. I plead guilty. 😀 When I was scrubbing my query to display it publicly, I got lazy and didn't fully form my temporary variable names. 

I performed some modifications to limit the precision of my calculations as well as the variable names. With that said, here is my final search string:

... BASE SEARCH ...
| timechart count(eval(match(job_result, "FAILURE"))) AS Failed,
count(eval(match(job_result, "SUCCESS"))) AS Passed,
count(eval(match(job_result, "ABORTED"))) AS Aborted
count as Total 
| eval percF = round((Failed/Total)*100,2), percS=100-percF, percA = round((Aborted/Total)*100,2)
| rename percF as FailureRate, percS as SuccessRate, percA as AbortedRate

Thanks again for your help.