Splunk Cloud Platform

Getting different result when do search query and same implement on dashboard for percentage of success to total jobs

Impavan5
Loves-to-Learn Lots
index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Approved by" OR "*Finished:*")
| fields source
| stats count(eval(match(_raw, "Approved by"))) as count_approved,
    count(eval(match(_raw, ".*Finished:*."))) as count_finish by source
| where count_approved > 0 AND count_finish > 0
| stats dc(source) as Total
| appendcols
    [ search(index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Finished: UNSTABLE" OR "Finished: SUCCESS" OR "Approved by" OR "Automatic merge*" OR "pushed branch tip is behind its remote" OR "WARNING: E2E tests did not pass"))
    | fields source host
    | stats count(eval(match(_raw, "Approved by"))) as count_approved,
        count(eval(match(_raw, "Finished: SUCCESS"))) as count_success,
        count(eval(match(_raw, "Finished: UNSTABLE"))) as count_unstable,
        count(eval(match(_raw, "Automatic merge.*failed*."))) as count_merge_fail,
        count(eval(match(_raw, "WARNING: E2E tests did not pass"))) as count_e2e_failure,
        count(eval(match(_raw, "pushed branch tip"))) as count_branch_fail by source, host
    | where count_approved > 0 AND (count_success > 0 OR (count_unstable > 0 AND (count_merge_fail > 0 OR count_branch_fail > 0 OR count_e2e_failure > 0)))
    | stats dc(source) as success
        ]
        | stats avg(success) as S, avg(Total) as T | eval percentage=( S / T * 100)
        | fields percentage,success, Total
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use the body of the message to ask your question.  Tell us how the search results differ when run in a dashboard.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Impavan5
Loves-to-Learn Lots

Can you pls assist with valid solution for above query.

0 Karma

Impavan5
Loves-to-Learn Lots

when i do query for percentage of success to the total jobs it gives result 87.716 but when i see on dashboard it gives result 90 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is your time range for both searches?

0 Karma

Impavan5
Loves-to-Learn Lots

time range :last onemonth 

0 Karma

Impavan5
Loves-to-Learn Lots

Hi ,
issue fixed , time range i was taken static instead of default.  Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...

Manage Ingest Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Ingest Processor pipeline, deploy it to the ...