Splunk Search

What's wrong in this sub search ?

Builder

What is the wrong in this sub search ?
Individually both are working fine.

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish | eval percentage=(numJobs/numFinish)*100 | search [search eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending | rename numPending as numJobs]

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish

Result is 867

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending

Result is 252

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I think you are looking to do this:

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

I don't think the subsearch command is the correct approach in this case.

View solution in original post

Splunk Employee
Splunk Employee

I think you are looking to do this:

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

I don't think the subsearch command is the correct approach in this case.

View solution in original post

Builder

brilliant 🙂

0 Karma

Builder

Sorry for wrong result - I edited my question

I am calculating the percentage of completion
numFinish is total job
numPending is pending job

0 Karma

Legend

Tell us more about what the desired results are. It seems your subsearch would emit something like "numJobs=867" as a filtering expression? What's the idea there?

0 Karma