Splunk Search

Not able to invoke each rows sprint, the element after the "by".

awesterman
New Member

I have been trying to see if (sprints==last_chunk) but my problem is that, if I eval within the stats section, sprints will still be an MV field. If I evaluate afterwards. Points can no longer be summed.
...
| stats sum(eval(if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0))) as experimental by sprints

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Nothing about that search should make an MV field. Try breaking it out like this to see if it helps you debug it better?

|eval last_chunk = if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0)
| stats sum(points) as total sum(last_chunk) as experimental by sprints
0 Karma

awesterman
New Member

I think I might not have included enough context. On the image below I put a bracket around an attempt to use the added eval. Also pointed out with arrows below how it looks like the if new and old if statement (experimental1 and experimental 2) is using Done/Complete correctly but not sprints. That one is used correctly in the eval after sprintVel. Hopefully that helps.

https://imgur.com/a/AqCGrC6

index=jira project_id="RB" fields.customfield_10005{}!="" | rename fields.customfield_10005{} as sprint
| dedup key
| where like(key, "RB-2985") or like(key, "RB-2797")  or like(key, "RB-2084") or like (key, "RB-3212")
| where NOT fields.resolutiondate="*" or fields.resolutiondate > "2019-01-04T13:00:00.000-0600"    
| rex field=sprint ".*name=(?[^,]*)"
| where like(sprints,"%Replibit Sprint %")
| eval last_sprint=mvindex(sprints, -1)
| eval sprint_number2 = ltrim(split(last_sprint,","), "name=Replibit Sprint")
| where sprint_number2 > 28

| eval sprint_id=sprint_number2."-".key 
| rename fields.customfield_10002 as points
| eval sv = if((sprints==last_sprint) and ((status=="DONE") or (status=="CLOSED")), points, 0)
| stats list(key) as Keys count(sprints) as SprintNum list(sprints) as Sprints list(last_sprint) as Last_sprint sum(points) as Commit sum(eval(if(isnotnull(mvfind(sprints, last_sprint)) and ((status=="DONE") or (status=="CLOSED")), points, 0))) as experimental sum(sv) as experimental2 list(status) as Status by sprints

| eval sprint = sprints
| eval pts = points
| eval sprintVel = if((sprints==Last_sprint) and ((Status=="DONE") or (Status=="CLOSED")), 1, 0)
| eval sprintDC = if(((Status=="DONE") or (Status=="CLOSED")), 1, 0)
| eval sprintLC = if((sprints==Last_sprint), 1, 0)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...