I have a search as follows:
index=*|
search sourcetype=*|
spath logs{} output=logs|
spath serial_number output=serial_number|
spath result output=result|
table serial_number result|
```stats dc(serial_number) as throughput|```
stats
count(eval(if(result="Fail",1,null()))) as failures
count(eval(if(result="Pass",1,null()))) as passes
|
This returns a table shown in the capture with failures=215 and passes=350
how can i get these results as two sperate bars in one bar chart? basically want to show the pass/fail rate
sample of the JSON data i am working with:
{"serial_number": "30913JC0024EW1482300425", "type": "Test", "result": "Pass", "logs": [
{"test_name": "UGC Connect", "result": "Pass"}, {"test_name": "Disable UGC USB Comm Watchdog", "result": "Pass"},
{"test_name": "Hardware Rev", "result": "Pass", "received": "4"}, {"test_name": "Firmware Rev", "result": "Pass", "received": "1.8.3.99", "expected": "1.8.3.99"},
{"test_name": "Set Serial Number", "result": "Pass", "received": "1 A S \n", "expected": "1 A S"},
{"test_name": "Verify serial number", "result": "Pass", "received": "JC0024EW1482300425", "expected": "JC0024EW1482300425", "reason": "Truncated full serial number: 30913JC0024EW1482300425 to JC0024EW1482300425"},
{"test_name": "Thermocouple", "pt1_ugc": "24969.0", "pt1": "25000", "pt2_ugc": "19954.333333333332", "pt2": "20000", "pt3_ugc": "14993.666666666666", "pt3": "15000", "result": "Pass", "tolerance": "1000 deci-mV"},
{"test_name": "Cold Junction", "result": "Pass", "ugc_cj": "278", "user_temp": "270", "tolerance": "+ or - 5 C"},
{"test_name": "Glow Plug Open and Short", "result": "Pass", "received": "GP Open, Short, and Load verified OK.", "expected": "GP Open, Short, and Load verified OK."},
{"test_name": "Glow Plug Power On", "result": "Pass", "received": "User validated Glow Plug Power"},
{"test_name": "Glow Plug Measure", "pt1_ugc": "848", "pt1": "2070", "pt1_tolerance": "2070", "pt2_ugc": "5201", "pt2": "5450", "pt2_tolerance": "2800", "result": "Pass"},
{"test_name": "Motor Soft Start", "result": "Pass", "received": "Motor Soft Start verified", "expected": "Motor Soft Start verified by operator"},
{"test_name": "Motor", "R_rpm_ugc": 1525.0, "R_rpm": 1475, "R_v_ugc": 160.0, "R_v": 155, "R_rpm_t": 150, "R_v_t": 160, "R_name": "AUGER 320 R", "F_rpm_ugc": 1533.3333333333333, "F_rpm": 1475, "F_v_ugc": 164.0, "F_v": 182, "F_rpm_t": 150, "F_v_t": 160, "F_name": "AUGER 320 F", "result": "Pass"},
{"test_name": "Fan", "ugc_rpm": 2436.0, "rpm": 2130, "rpm_t": 400, "ugc_v": 653.3333333333334, "v": 630, "v_t": 160, "result": "Pass"},
{"test_name": "RS 485", "result": "Pass", "received": "All devices detected", "expected": "Devices detected: ['P']"},
{"test_name": "Close UGC Port", "result": "Pass"},
{"test_name": "DFU Test", "result": "Pass", "received": "Found DFU device"},
{"test_name": "Power Cycle", "result": "Pass", "received": "User confirmed power cycle"},
{"test_name": "UGC Connect", "result": "Pass"},
{"test_name": "Close UGC Port", "result": "Pass"},
{"test_name": "USB Power", "result": "Pass", "received": "USB Power manually verified"}]}
Adding a by-field of "serial_number" in you final stats will display you chart like this.
Similarly, instead of the stats you could do a
| chart
count as count
over serial_number
by result
and this should give you results ver similar.
For an overall Pass/Fail visual across all serial number you can do a stats like this
| stats
count as count
by result
and the resulting chart shows something like this
| eval test="Test"
| table test passes failures