Splunk Cloud Platform

Getting different result when do search query and same implement on dashboard for percentage of success to total jobs

Impavan5
Loves-to-Learn Lots
index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Approved by" OR "*Finished:*")
| fields source
| stats count(eval(match(_raw, "Approved by"))) as count_approved,
    count(eval(match(_raw, ".*Finished:*."))) as count_finish by source
| where count_approved > 0 AND count_finish > 0
| stats dc(source) as Total
| appendcols
    [ search(index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Finished: UNSTABLE" OR "Finished: SUCCESS" OR "Approved by" OR "Automatic merge*" OR "pushed branch tip is behind its remote" OR "WARNING: E2E tests did not pass"))
    | fields source host
    | stats count(eval(match(_raw, "Approved by"))) as count_approved,
        count(eval(match(_raw, "Finished: SUCCESS"))) as count_success,
        count(eval(match(_raw, "Finished: UNSTABLE"))) as count_unstable,
        count(eval(match(_raw, "Automatic merge.*failed*."))) as count_merge_fail,
        count(eval(match(_raw, "WARNING: E2E tests did not pass"))) as count_e2e_failure,
        count(eval(match(_raw, "pushed branch tip"))) as count_branch_fail by source, host
    | where count_approved > 0 AND (count_success > 0 OR (count_unstable > 0 AND (count_merge_fail > 0 OR count_branch_fail > 0 OR count_e2e_failure > 0)))
    | stats dc(source) as success
        ]
        | stats avg(success) as S, avg(Total) as T | eval percentage=( S / T * 100)
        | fields percentage,success, Total
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use the body of the message to ask your question.  Tell us how the search results differ when run in a dashboard.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Impavan5
Loves-to-Learn Lots

Can you pls assist with valid solution for above query.

0 Karma

Impavan5
Loves-to-Learn Lots

when i do query for percentage of success to the total jobs it gives result 87.716 but when i see on dashboard it gives result 90 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is your time range for both searches?

0 Karma

Impavan5
Loves-to-Learn Lots

time range :last onemonth 

0 Karma

Impavan5
Loves-to-Learn Lots

Hi ,
issue fixed , time range i was taken static instead of default.  Thanks.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...