Hi ,
My wish to get the difference between yesterday and todays Pass % and fail % for different sourcetypes .
I have tried as below ,
index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h|chart count over sourcetype by Status|addtotals|eval "dbyest Pass %"=round((Pass/Total)*100,3) |eval "dbyest Fail %"=round((Fail/Total)*100,3) |stats count by sourcetype "dbyest Pass %" "dbyest Fail %" |rename Total as "Total Scope"|eval repo="dbyest"
|append
[search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h|chart count over sourcetype by Status|addtotals|eval "yest Pass %"=round((Pass/Total)*100,3) |eval "yest Fail %"=round((Fail/Total)*100,3) |stats count by sourcetype "yest Pass %" "yest Fail %" |rename Total as "Total Scope"|eval repo="yest"]
|eval "Pass % diff"=round("dbyest Pass %"-"yest Pass %")|table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"
When i ran this , i am getting the error "Error in 'eval' command: Type checking failed. '-' only takes numbers."
Please help me in this to get the difference ?
Can you please try this?
index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h
| chart count over sourcetype by Status
| addtotals
| eval dbyest_Pass=round((Pass/Total)*100,3)
| eval dbyest_Fail=round((Fail/Total)*100,3)
| stats count by sourcetype dbyest_Pass dbyest_Fail
| rename Total as "Total Scope"
| eval repo="dbyest"
| append
[ search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h
| chart count over sourcetype by Status
| addtotals
| eval yest_Pass=round((Pass/Total)*100,3)
| eval yest_Fail=round((Fail/Total)*100,3)
| stats count by sourcetype yest_Pass yest_Fail
| rename Total as "Total Scope"
| eval repo="yest"]
| eval Pass_diff=round(dbyest_Pass-yest_Pass)
| rename yest_Pass as "yest Pass %",yest_Fail as "yest Fail %", dbyest_Fail as "dbyest Fail %", dbyest_Pass as "dbyest Pass %", Pass_diff as "Pass % diff"
| table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Can you please change your eval with this?
| eval "Pass % diff"=round('dbyest Pass %'-'yest Pass %')
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
kamlesh_vaghela Thanks for your reply !!
But i am not seeing any value in the table command for "Pass % diff" after that .Can you please provide any other solution for this .
Can you please try this?
index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h
| chart count over sourcetype by Status
| addtotals
| eval dbyest_Pass=round((Pass/Total)*100,3)
| eval dbyest_Fail=round((Fail/Total)*100,3)
| stats count by sourcetype dbyest_Pass dbyest_Fail
| rename Total as "Total Scope"
| eval repo="dbyest"
| append
[ search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h
| chart count over sourcetype by Status
| addtotals
| eval yest_Pass=round((Pass/Total)*100,3)
| eval yest_Fail=round((Fail/Total)*100,3)
| stats count by sourcetype yest_Pass yest_Fail
| rename Total as "Total Scope"
| eval repo="yest"]
| eval Pass_diff=round(dbyest_Pass-yest_Pass)
| rename yest_Pass as "yest Pass %",yest_Fail as "yest Fail %", dbyest_Fail as "dbyest Fail %", dbyest_Pass as "dbyest Pass %", Pass_diff as "Pass % diff"
| table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Thanks for your reply KV .
I got it by changing ,
| eval "dbyest Pass %"=round((Pass/Total)*100,3)
as
| eval "dbyest Pass%"=round(('Pass'/Total)*100,3)
and that worked .