Getting Data In

Can I compare current data with raw data then add a new column?

peiyee422
New Member

Hi Splunkers,

Please help...

I have a bunch of raw data containing my test results. My problem now is:

I want to compare test results of new coming in result / current result with all the raw data. I have test with the same name in the raw data, but I need to extract them with the 10 latest test results and compare them with the test results and plot a new column named Test Status.

The condition I wanted to make is:

*If current Test Result is Fail, check raw data Test Result, if raw data is Pass, then mark "New Issue" at Test Status,
If current Test Result is Fail, check raw data Test Result, if raw data is Error, then mark "Know Issue" at Test Status,
If current Test Result is Pass , then mark "No Issue" at Test Status. *
alt text

I have a query here but I can no longer continue..

source="Linux_HPPResult.csv" host="HPPLINUXTEST30" sourcetype="csv" |table Test_Name Test_Result Platform1 ImageName1 TestType strtime source | eval Test_Status=if(like(Test_Result,"%Error%"),"Known Issue","null") | streamstats count as col2 | eventstats values(Test_Result) as Test_Node by Test_Name | sort Test_Name asc | dedup Test_Name limit=10

Please refer to the image, my set of raw data is something like that. Test Status highlighted is the new column I wanted to add by comparing the test results.

Hope hearing from you guys soon! Thank you so much!! 🙂

Tags (3)
0 Karma

horsefez
Motivator

Hi @peiyee422,

please provide us with additional data (like actual raw events). I'm not willing to create test data like this on my own.

0 Karma

Richfez
SplunkTrust
SplunkTrust

peiyee422 - yeah, that was too much data. I trimmed it down and did some manual moving it around to make it into a comment here. We only need a representative sample, not the whole data set. Even just a few lines is often enough, if it covers the possible lines well enough.

Test_Name Test_Result Platform1 DUTName ImageName1 TestType strtime
[HalLogClassTest] : [Error\DISABLED_logLevel] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:13
[PalNetworkApiSample] : [bDynamicDNS [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:16
[RTC SNVS] : [/usr/tstp/bin/rtc/rtctest /dev/rtc1] Error P600 P600_13 TLO_Instrument BSP_TEST 7/4/2017 21:02
[RTC SNVS] : [/usr/tstp/bin/rtc/rtctest /dev/rtc1] Error P600 P600_13 TLO-BASE_Platform-base BSP_TEST 7/5/2017 0:14
[PalNetworkApiSample] : [bAutoDNS [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:15
[PalNetworkApiSample] : [bIsAutoIPEnabled [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:15
[PalNetworkApiSample] : [bDhcpEnabled [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:14
[PalNetworkApiSample] : [pwszHostName [p600]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:14
[PalNetworkApiSample] : [pwszDomainName [(none)]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:13
[PalNetworkApiSample] : [pwszWinsServer2 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:13
[PalNetworkApiSample] : [pwszWinsServer1 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:12
[PalNetworkApiSample] : [pwszDnsServer2 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:12
[PalNetworkApiSample] : [pwszDnsServer1 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:11
[PalNetworkApiSample] : [pwszGateway [141.183.188.1]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:10
[PalNetworkApiSample] : [pwszSubnetMask [255.255.252.0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:10
[PalNetworkApiSample] : [iIPv6GlobalPrefixSize [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:09
[PalNetworkApiSample] : [pwszIPv6Gateway []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:09
[PalNetworkApiSample] : [pwszIPv6GlobalAddress []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:08
[PalNetworkApiSample] : [pwszIPv6LocalAddress [fe80::8209:2ff:fe01:ad3]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:08
[PalNetworkApiSample] : [pwszIpAddress [141.183.191.101]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:07
[PalNetworkApiSample] : [DomainName: [(none)]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:06
[PalNetworkApiSample] : [HostName: [p600]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:06
[PalNetworkApiSample] : [Network Connected YES] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:05
[PalNetworkApiSample] : [Lan is ON] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:04
[PalCapsTest] : [PalCaps\GetDirectoryPlatformDiskInfo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:04
[PalCapsTest] : [PalCaps\GetPlatformDiskInfo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:03
[PalCapsTest] : [PalCaps\PalCapsFoo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:03
[PalCapsTest] : [PalCapsTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:02
[PalSStorageTest] : [PalSStorage\WriteAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:02
[PalSStorageTest] : [PalSStorage\ClearAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:01
[PalSStorageTest] : [PalSStorage\ReadAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:01
[PalSStorageTest] : [PalSStorage\InvalidAreaId] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:00
[PalSStorageTest] : [PalSStorage\GetStreamMaxSizes] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:59
[PalSStorageTest] : [PalSStorage\GetValidStreams] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:59
[PalSStorageTest] : [PalSStorage\metaStreamTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:58
[PalSStorageTest] : [PalSStorage\GetMetaData] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:58
[PalSStorageTest] : [PalSStorage\GetSerialNumber_c_linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:57
[PalSStorageTest] : [PalSStorage\GetModelNumber_c_linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:57
[PalSStorageTest] : [PalSStorage\GetSerialNumber] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:56
[PalSStorageTest] : [PalSStorage\GetModelNumber] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:56
[PalSStorageTest] : [PalSStorageTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:55
[PalSStorageTest] : [ssconfig.basedir = /tmp/] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:55
[PalSecureStorageSample] : [Model[LINUXGEN]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:54
[PalSecureStorageSample] : [Serial[TST0000001]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:53
[PalSecureStorageSample] : [ssconfig.basedir = /tmp/] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:53
[PalDiskInfoSample] : [PalCapsFoo()] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:52
[PalDiskInfoSample] : [PalCapsFoo called] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:52
[PalSysManagementTest] : [NetworkAPI\GetHostName] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:51
[PalSysManagementTest] : [NetworkAPI\cbSizeNotSet] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:51
[PalSysManagementTest] : [NetworkAPI\null_pointer] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:50
[PalSysManagementTest] : [PalSysManagement\Foos_C_Linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:50
[PalSysManagementTest] : [PalSysManagement\RebootSystem] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:49
[PalSysManagementTest] : [PalSysManagement\ShutdownSystem] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:48
[PalSysManagementTest] : [PalSysManagementTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:48
[usb488Server-test] : [usb488Test\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:47
[usb488Server-test] : [usb488 server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:47
[telnetServer-test] : [telnetTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:46
[telnetServer-test] : [telnet server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:46
[socketServer-test] : [socketTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:45
[socketServer-test] : [socket server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:45
[hislipServer-test] : [hislipTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:44
[hislipServer-test] : [hislip server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:44
[HalLogClassTest] : [Error\DISABLED_construct] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:12
[HalLogClassTest] : [Basic\providerTime] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:12
[HalLogClassTest] : [Basic\provider] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:11
[HalLogClassTest] : [Basic\setAttributes] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:11
[HalLogClassTest] : [Basic\attributesName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:10
[HalLogClassTest] : [Basic\attributesTime] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:10
[HalLogClassTest] : [Basic\allLevel] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:09
[HalLogClassTest] : [Basic\getSet] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:08
[HalLogClassTest] : [Basic\level3] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:08
[HalLogClassTest] : [Basic\entry] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:07
[HalLogClassTest] : [Basic\defaults] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:07
[HalLogClassTest] : [Basic\version] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:06
[HalBaseClassTest] : [Error\nullData] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:06
[HalBaseClassTest] : [Error\nullName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:05
[HalBaseClassTest] : [Error\convertUpper] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:05
[HalBaseClassTest] : [Error\getVersion] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:04
[HalBaseClassTest] : [Basic\userData] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:03
[HalBaseClassTest] : [Basic\format] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:03
[HalBaseClassTest] : [Basic\getNames] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:02
[HalBaseClassTest] : [Basic\convertUpper] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:02
[HalBaseClassTest] : [Basic\convertError] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:01
[HalBaseClassTest] : [Basic\getVersion] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:01
[HalEepromClassTest] : [Error\badName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:00
[HalEepromClassTest] : [Error\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:00
[HalEepromClassTest] : [Error\read] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:59
[HalEepromClassTest] : [Basic\DISABLED_undoWrite] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:59
[HalEepromClassTest] : [Basic\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:58
[HalEepromClassTest] : [Basic\read] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:57
[HalFileClassTest] : [Error\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:57

peiyee422
New Member

Hi,

I am sorry, I can't provide the data here because it is too large and I don't have enough karma points to attach file. Any advice?

Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...