Splunk Search

Why am I receiving negative values for jenkins build times?

cdgill
Explorer

Here is my search query, though this issue is common across a number of different custom searches we are attempting:
index=jenkins* job_name=mosaic-os*/master event_tag=job_event (type=started OR type=completed) (NOT job_result=SUCCESS) | dedup build_number | eval build_duration = job_duration - queue_time - 'test_summary.duration' | stats values(job_name), avg(build_duration), min(build_duration), max(build_duration), stdev(build_duration), stdev(queue_time), stdev(test_summary.duration)

For almost any parameter we get a negative value for the min build_duration. Obviously build times can't go back in time, so does anyone have any possible insights on what may be causing this?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Why are you subtracting the times? If you spend longer in queue, you get a negative number automatically. Shouldn't the math be such:

eval build_duration = job_duration + queue_time + 'test_summary.duration'

This makes more sense to me. As it gives a total time for the start to finish time of the build.

0 Karma

cdgill
Explorer

I was told that job_duration already includes queue_time and 'test_summary.duration', thus I was subtracting those values to get just the build_duration without queue and test_sum. Is that not the case?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

well, you can start with a table job_duration queue_time 'test_summary.duration' and check it your self. maybe they are in different units? Seconds vs minutes ?

0 Karma
Get Updates on the Splunk Community!

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...