I have the following search:
index=sandbox document_type=test-collat-record-json_v2
| where ((isnotnull(test_result)) AND project_short="LNL" AND collateral_type="fw" AND ingredient_type="ifwi_bin" AND ingredient="csme")
| dedup test_collat_record_json_guid
| join type=inner left=L right=R where L.project_short=R.project_short L.collateral_type=R.collateral_type L.ingredient_type=R.ingredient_type L.ingredient=R.ingredient
[search document_type=test-collat-record-summary-json]
| table L.collat_record_json_guid, L.project_short, L.collateral_type, L.ingredient_type, L.ingredient, L.version, L.test, L.test_result, R.number_of_tests, R.passing_threshold
I'm joining data from a set of test results and then I lookup info about what a passing set of results should look like from another data source. Hence the join. It's good. It works for me and the result yields the table:
So great. Just want to aggregate the results and get counts of passing/failing tests and compare that with the passing_threshold field.
So I added:
| stats
count(eval(L.test_result=="SUCCESS")) as passingTests
count(eval(L.test_result=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid
But the two evaluations of success and failure tests are zero. But from the table above they are clearly not zero. Should be 2 and 1 respectively.
What have I done wrong? Is eval not going to work on joined data? I am using the correct aliases for the data.
Try like this (put fields in single quotes in eval)
| stats
count(eval('L.test_result'=="SUCCESS")) as passingTests
count(eval('L.test_result'=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid
This fixed my issue.
Thank you! @somesoni2
Try like this (put fields in single quotes in eval)
| stats
count(eval('L.test_result'=="SUCCESS")) as passingTests
count(eval('L.test_result'=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid