Splunk Cloud Platform

Getting different result when do search query and same implement on dashboard for percentage of success to total jobs

Impavan5
Loves-to-Learn Lots
index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Approved by" OR "*Finished:*")
| fields source
| stats count(eval(match(_raw, "Approved by"))) as count_approved,
    count(eval(match(_raw, ".*Finished:*."))) as count_finish by source
| where count_approved > 0 AND count_finish > 0
| stats dc(source) as Total
| appendcols
    [ search(index="jenkins_console" source="*-deploy/*" NOT (source="*/gremlin-fault-injection-deploy/*" OR source="*pipe-test*" OR source="*java-validation-*") ("Finished: UNSTABLE" OR "Finished: SUCCESS" OR "Approved by" OR "Automatic merge*" OR "pushed branch tip is behind its remote" OR "WARNING: E2E tests did not pass"))
    | fields source host
    | stats count(eval(match(_raw, "Approved by"))) as count_approved,
        count(eval(match(_raw, "Finished: SUCCESS"))) as count_success,
        count(eval(match(_raw, "Finished: UNSTABLE"))) as count_unstable,
        count(eval(match(_raw, "Automatic merge.*failed*."))) as count_merge_fail,
        count(eval(match(_raw, "WARNING: E2E tests did not pass"))) as count_e2e_failure,
        count(eval(match(_raw, "pushed branch tip"))) as count_branch_fail by source, host
    | where count_approved > 0 AND (count_success > 0 OR (count_unstable > 0 AND (count_merge_fail > 0 OR count_branch_fail > 0 OR count_e2e_failure > 0)))
    | stats dc(source) as success
        ]
        | stats avg(success) as S, avg(Total) as T | eval percentage=( S / T * 100)
        | fields percentage,success, Total
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use the body of the message to ask your question.  Tell us how the search results differ when run in a dashboard.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Impavan5
Loves-to-Learn Lots

Can you pls assist with valid solution for above query.

0 Karma

Impavan5
Loves-to-Learn Lots

when i do query for percentage of success to the total jobs it gives result 87.716 but when i see on dashboard it gives result 90 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is your time range for both searches?

0 Karma

Impavan5
Loves-to-Learn Lots

time range :last onemonth 

0 Karma

Impavan5
Loves-to-Learn Lots

Hi ,
issue fixed , time range i was taken static instead of default.  Thanks.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...