Splunk Cloud Platform

Getting different result when do search query and same implement on dashboard for percentage of success to total jobs

Impavan5
Loves-to-Learn Lots
index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Approved by" OR "*Finished:*")
| fields source
| stats count(eval(match(_raw, "Approved by"))) as count_approved,
    count(eval(match(_raw, ".*Finished:*."))) as count_finish by source
| where count_approved > 0 AND count_finish > 0
| stats dc(source) as Total
| appendcols
    [ search(index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Finished: UNSTABLE" OR "Finished: SUCCESS" OR "Approved by" OR "Automatic merge*" OR "pushed branch tip is behind its remote" OR "WARNING: E2E tests did not pass"))
    | fields source host
    | stats count(eval(match(_raw, "Approved by"))) as count_approved,
        count(eval(match(_raw, "Finished: SUCCESS"))) as count_success,
        count(eval(match(_raw, "Finished: UNSTABLE"))) as count_unstable,
        count(eval(match(_raw, "Automatic merge.*failed*."))) as count_merge_fail,
        count(eval(match(_raw, "WARNING: E2E tests did not pass"))) as count_e2e_failure,
        count(eval(match(_raw, "pushed branch tip"))) as count_branch_fail by source, host
    | where count_approved > 0 AND (count_success > 0 OR (count_unstable > 0 AND (count_merge_fail > 0 OR count_branch_fail > 0 OR count_e2e_failure > 0)))
    | stats dc(source) as success
        ]
        | stats avg(success) as S, avg(Total) as T | eval percentage=( S / T * 100)
        | fields percentage,success, Total
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use the body of the message to ask your question.  Tell us how the search results differ when run in a dashboard.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Impavan5
Loves-to-Learn Lots

Can you pls assist with valid solution for above query.

0 Karma

Impavan5
Loves-to-Learn Lots

when i do query for percentage of success to the total jobs it gives result 87.716 but when i see on dashboard it gives result 90 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is your time range for both searches?

0 Karma

Impavan5
Loves-to-Learn Lots

time range :last onemonth 

0 Karma

Impavan5
Loves-to-Learn Lots

Hi ,
issue fixed , time range i was taken static instead of default.  Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...