Splunk Search

Not able to invoke each rows sprint, the element after the "by".

awesterman
New Member

I have been trying to see if (sprints==last_chunk) but my problem is that, if I eval within the stats section, sprints will still be an MV field. If I evaluate afterwards. Points can no longer be summed.
...
| stats sum(eval(if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0))) as experimental by sprints

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Nothing about that search should make an MV field. Try breaking it out like this to see if it helps you debug it better?

|eval last_chunk = if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0)
| stats sum(points) as total sum(last_chunk) as experimental by sprints
0 Karma

awesterman
New Member

I think I might not have included enough context. On the image below I put a bracket around an attempt to use the added eval. Also pointed out with arrows below how it looks like the if new and old if statement (experimental1 and experimental 2) is using Done/Complete correctly but not sprints. That one is used correctly in the eval after sprintVel. Hopefully that helps.

https://imgur.com/a/AqCGrC6

index=jira project_id="RB" fields.customfield_10005{}!="" | rename fields.customfield_10005{} as sprint
| dedup key
| where like(key, "RB-2985") or like(key, "RB-2797")  or like(key, "RB-2084") or like (key, "RB-3212")
| where NOT fields.resolutiondate="*" or fields.resolutiondate > "2019-01-04T13:00:00.000-0600"    
| rex field=sprint ".*name=(?[^,]*)"
| where like(sprints,"%Replibit Sprint %")
| eval last_sprint=mvindex(sprints, -1)
| eval sprint_number2 = ltrim(split(last_sprint,","), "name=Replibit Sprint")
| where sprint_number2 > 28

| eval sprint_id=sprint_number2."-".key 
| rename fields.customfield_10002 as points
| eval sv = if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0)
| stats list(key) as Keys count(sprints) as SprintNum list(sprints) as Sprints list(last_sprint) as Last_sprint sum(points) as Commit sum(eval(if(isnotnull(mvfind(sprints, last_sprint)) and ((status=="DONE") or (status=="CLOSED")), points, 0))) as experimental sum(sv) as experimental2 list(status) as Status by sprints

| eval sprint = sprints
| eval pts = points
| eval sprintVel = if((sprints==Last_sprint) and ((Status=="DONE") or (Status=="CLOSED")), 1, 0)
| eval sprintDC = if(((Status=="DONE") or (Status=="CLOSED")), 1, 0)
| eval sprintLC = if((sprints==Last_sprint), 1, 0)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...