Deployment Architecture

pipe and data carry through

Lynyrd
Explorer

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximum = 20 | eval Actual = Round(Actual) | bin Actual span=1 | chart stdev(Actual) as stedVal | eval capture = if(stedVal/Maximum <= 0.17, Maximum, Maximum)

Maximum does not print out in results

Tags (1)

Lynyrd
Explorer

What is the code in SPLUNK to do this? Convert PERL to SPLUNK

foreach $event (@dbase){
push(@records, split(/\,/, $event));
}

for($j=0; $j<$num_records, $j++){

push(@mu_set, ($records[2]+$records[3])/2);

}

0 Karma

mayurr98
Super Champion

Run this only

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximumx = 20

If you are getting maximum then chart command after that is removing that field you need to use alternative of chart or you need to add those fields in chart which you want to use!!

Also one more thing just do not run full query. Debug it after each | as you do at each test point in the test centre and see where it is getting fail.
I hope this solves your query

0 Karma

Lynyrd
Explorer

I don't think splunk can do what I want it to do because it appears it cannot work with data in parallel because of its pipe structure. I need to work with multiple charts and arrays in parallel and I need data structures that splunk does not have like associative arrays and indexing into those arrays... I think I should use PERL or Python to do what I need to do. I'm interested in searching of course but I need to calculate intermediate values based on search results on multiple test points TP's.

I don't think splunk has that capability.

0 Karma

Lynyrd
Explorer

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximumx = 20 | eval Actual = Round(Actual) | bin Actual span=1 | chart stdev(Actual) as stedVal | eval capture = if(stedVal/Maximumx <= 0.17, Maximumx, Maximumx)

Maximumx is not being printed out.

Lynyrd
Explorer

I'm debugging. I want to see if Maximum gets se to 20 and then I want to if it get printed out.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...