Can I compare current data with raw data then add a new column?

[peiyee422]

Hi Splunkers,

Please help...

I have a bunch of raw data containing my test results. My problem now is:

I want to compare test results of new coming in result / current result with all the raw data. I have test with the same name in the raw data, but I need to extract them with the 10 latest test results and compare them with the test results and plot a new column named Test Status.

The condition I wanted to make is:

*If current Test Result is Fail, check raw data Test Result, if raw data is Pass, then mark "New Issue" at Test Status,
If current Test Result is Fail, check raw data Test Result, if raw data is Error, then mark "Know Issue" at Test Status,
If current Test Result is Pass , then mark "No Issue" at Test Status. *

I have a query here but I can no longer continue..

source="Linux_HPPResult.csv" host="HPPLINUXTEST30" sourcetype="csv" |table Test_Name Test_Result Platform1 ImageName1 TestType strtime source | eval Test_Status=if(like(Test_Result,"%Error%"),"Known Issue","null") | streamstats count as col2 | eventstats values(Test_Result) as Test_Node by Test_Name | sort Test_Name asc | dedup Test_Name limit=10

Please refer to the image, my set of raw data is something like that. Test Status highlighted is the new column I wanted to add by comparing the test results.

Hope hearing from you guys soon! Thank you so much!! 🙂

[horsefez]

Hi @peiyee422,

please provide us with additional data (like actual raw events). I'm not willing to create test data like this on my own.

[Richfez]

peiyee422 - yeah, that was too much data. I trimmed it down and did some manual moving it around to make it into a comment here. We only need a representative sample, not the whole data set. Even just a few lines is often enough, if it covers the possible lines well enough.

Test_Name Test_Result Platform1 DUTName ImageName1 TestType strtime
[HalLogClassTest] : [Error\DISABLED_logLevel] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:13
[PalNetworkApiSample] : [bDynamicDNS [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:16
[RTC SNVS] : [/usr/tstp/bin/rtc/rtctest /dev/rtc1] Error P600 P600_13 TLO_Instrument BSP_TEST 7/4/2017 21:02
[RTC SNVS] : [/usr/tstp/bin/rtc/rtctest /dev/rtc1] Error P600 P600_13 TLO-BASE_Platform-base BSP_TEST 7/5/2017 0:14
[PalNetworkApiSample] : [bAutoDNS [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:15
[PalNetworkApiSample] : [bIsAutoIPEnabled [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:15
[PalNetworkApiSample] : [bDhcpEnabled [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:14
[PalNetworkApiSample] : [pwszHostName [p600]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:14
[PalNetworkApiSample] : [pwszDomainName [(none)]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:13
[PalNetworkApiSample] : [pwszWinsServer2 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:13
[PalNetworkApiSample] : [pwszWinsServer1 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:12
[PalNetworkApiSample] : [pwszDnsServer2 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:12
[PalNetworkApiSample] : [pwszDnsServer1 []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:11
[PalNetworkApiSample] : [pwszGateway [141.183.188.1]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:10
[PalNetworkApiSample] : [pwszSubnetMask [255.255.252.0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:10
[PalNetworkApiSample] : [iIPv6GlobalPrefixSize [0]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:09
[PalNetworkApiSample] : [pwszIPv6Gateway []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:09
[PalNetworkApiSample] : [pwszIPv6GlobalAddress []] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:08
[PalNetworkApiSample] : [pwszIPv6LocalAddress [fe80::8209:2ff:fe01:ad3]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:08
[PalNetworkApiSample] : [pwszIpAddress [141.183.191.101]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:07
[PalNetworkApiSample] : [DomainName: [(none)]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:06
[PalNetworkApiSample] : [HostName: [p600]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:06
[PalNetworkApiSample] : [Network Connected YES] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:05
[PalNetworkApiSample] : [Lan is ON] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:04
[PalCapsTest] : [PalCaps\GetDirectoryPlatformDiskInfo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:04
[PalCapsTest] : [PalCaps\GetPlatformDiskInfo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:03
[PalCapsTest] : [PalCaps\PalCapsFoo] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:03
[PalCapsTest] : [PalCapsTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:02
[PalSStorageTest] : [PalSStorage\WriteAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:02
[PalSStorageTest] : [PalSStorage\ClearAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:01
[PalSStorageTest] : [PalSStorage\ReadAreas] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:01
[PalSStorageTest] : [PalSStorage\InvalidAreaId] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 23:00
[PalSStorageTest] : [PalSStorage\GetStreamMaxSizes] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:59
[PalSStorageTest] : [PalSStorage\GetValidStreams] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:59
[PalSStorageTest] : [PalSStorage\metaStreamTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:58
[PalSStorageTest] : [PalSStorage\GetMetaData] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:58
[PalSStorageTest] : [PalSStorage\GetSerialNumber_c_linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:57
[PalSStorageTest] : [PalSStorage\GetModelNumber_c_linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:57
[PalSStorageTest] : [PalSStorage\GetSerialNumber] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:56
[PalSStorageTest] : [PalSStorage\GetModelNumber] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:56
[PalSStorageTest] : [PalSStorageTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:55
[PalSStorageTest] : [ssconfig.basedir = /tmp/] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:55
[PalSecureStorageSample] : [Model[LINUXGEN]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:54
[PalSecureStorageSample] : [Serial[TST0000001]] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:53
[PalSecureStorageSample] : [ssconfig.basedir = /tmp/] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:53
[PalDiskInfoSample] : [PalCapsFoo()] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:52
[PalDiskInfoSample] : [PalCapsFoo called] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:52
[PalSysManagementTest] : [NetworkAPI\GetHostName] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:51
[PalSysManagementTest] : [NetworkAPI\cbSizeNotSet] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:51
[PalSysManagementTest] : [NetworkAPI\null_pointer] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:50
[PalSysManagementTest] : [PalSysManagement\Foos_C_Linkage] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:50
[PalSysManagementTest] : [PalSysManagement\RebootSystem] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:49
[PalSysManagementTest] : [PalSysManagement\ShutdownSystem] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:48
[PalSysManagementTest] : [PalSysManagementTest] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:48
[usb488Server-test] : [usb488Test\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:47
[usb488Server-test] : [usb488 server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:47
[telnetServer-test] : [telnetTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:46
[telnetServer-test] : [telnet server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:46
[socketServer-test] : [socketTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:45
[socketServer-test] : [socket server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:45
[hislipServer-test] : [hislipTest\server_open_close] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:44
[hislipServer-test] : [hislip server tests] Error P600 P600_13 TLO_Instrument PALS_TEST 7/4/2017 22:44
[HalLogClassTest] : [Error\DISABLED_construct] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:12
[HalLogClassTest] : [Basic\providerTime] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:12
[HalLogClassTest] : [Basic\provider] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:11
[HalLogClassTest] : [Basic\setAttributes] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:11
[HalLogClassTest] : [Basic\attributesName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:10
[HalLogClassTest] : [Basic\attributesTime] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:10
[HalLogClassTest] : [Basic\allLevel] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:09
[HalLogClassTest] : [Basic\getSet] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:08
[HalLogClassTest] : [Basic\level3] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:08
[HalLogClassTest] : [Basic\entry] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:07
[HalLogClassTest] : [Basic\defaults] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:07
[HalLogClassTest] : [Basic\version] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:06
[HalBaseClassTest] : [Error\nullData] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:06
[HalBaseClassTest] : [Error\nullName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:05
[HalBaseClassTest] : [Error\convertUpper] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:05
[HalBaseClassTest] : [Error\getVersion] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:04
[HalBaseClassTest] : [Basic\userData] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:03
[HalBaseClassTest] : [Basic\format] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:03
[HalBaseClassTest] : [Basic\getNames] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:02
[HalBaseClassTest] : [Basic\convertUpper] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:02
[HalBaseClassTest] : [Basic\convertError] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:01
[HalBaseClassTest] : [Basic\getVersion] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:01
[HalEepromClassTest] : [Error\badName] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:00
[HalEepromClassTest] : [Error\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 22:00
[HalEepromClassTest] : [Error\read] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:59
[HalEepromClassTest] : [Basic\DISABLED_undoWrite] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:59
[HalEepromClassTest] : [Basic\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:58
[HalEepromClassTest] : [Basic\read] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:57
[HalFileClassTest] : [Error\write] Error P600 P600_13 TLO_Instrument HALS_TEST 7/4/2017 21:57

[peiyee422]

Hi,

I am sorry, I can't provide the data here because it is too large and I don't have enough karma points to attach file. Any advice?

Thanks 🙂