Splunk Cloud Platform

Getting different result when do search query and same implement on dashboard for percentage of success to total jobs

Impavan5
Loves-to-Learn Lots
index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Approved by" OR "*Finished:*")
| fields source
| stats count(eval(match(_raw, "Approved by"))) as count_approved,
    count(eval(match(_raw, ".*Finished:*."))) as count_finish by source
| where count_approved > 0 AND count_finish > 0
| stats dc(source) as Total
| appendcols
    [ search(index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Finished: UNSTABLE" OR "Finished: SUCCESS" OR "Approved by" OR "Automatic merge*" OR "pushed branch tip is behind its remote" OR "WARNING: E2E tests did not pass"))
    | fields source host
    | stats count(eval(match(_raw, "Approved by"))) as count_approved,
        count(eval(match(_raw, "Finished: SUCCESS"))) as count_success,
        count(eval(match(_raw, "Finished: UNSTABLE"))) as count_unstable,
        count(eval(match(_raw, "Automatic merge.*failed*."))) as count_merge_fail,
        count(eval(match(_raw, "WARNING: E2E tests did not pass"))) as count_e2e_failure,
        count(eval(match(_raw, "pushed branch tip"))) as count_branch_fail by source, host
    | where count_approved > 0 AND (count_success > 0 OR (count_unstable > 0 AND (count_merge_fail > 0 OR count_branch_fail > 0 OR count_e2e_failure > 0)))
    | stats dc(source) as success
        ]
        | stats avg(success) as S, avg(Total) as T | eval percentage=( S / T * 100)
        | fields percentage,success, Total
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use the body of the message to ask your question.  Tell us how the search results differ when run in a dashboard.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Impavan5
Loves-to-Learn Lots

Can you pls assist with valid solution for above query.

0 Karma

Impavan5
Loves-to-Learn Lots

when i do query for percentage of success to the total jobs it gives result 87.716 but when i see on dashboard it gives result 90 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is your time range for both searches?

0 Karma

Impavan5
Loves-to-Learn Lots

time range :last onemonth 

0 Karma

Impavan5
Loves-to-Learn Lots

Hi ,
issue fixed , time range i was taken static instead of default.  Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...