Splunk Search

Why am I receiving negative values for jenkins build times?

cdgill
Explorer

Here is my search query, though this issue is common across a number of different custom searches we are attempting:
index=jenkins* job_name=mosaic-os*/master event_tag=job_event (type=started OR type=completed) (NOT job_result=SUCCESS) | dedup build_number | eval build_duration = job_duration - queue_time - 'test_summary.duration' | stats values(job_name), avg(build_duration), min(build_duration), max(build_duration), stdev(build_duration), stdev(queue_time), stdev(test_summary.duration)

For almost any parameter we get a negative value for the min build_duration. Obviously build times can't go back in time, so does anyone have any possible insights on what may be causing this?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Why are you subtracting the times? If you spend longer in queue, you get a negative number automatically. Shouldn't the math be such:

eval build_duration = job_duration + queue_time + 'test_summary.duration'

This makes more sense to me. As it gives a total time for the start to finish time of the build.

0 Karma

cdgill
Explorer

I was told that job_duration already includes queue_time and 'test_summary.duration', thus I was subtracting those values to get just the build_duration without queue and test_sum. Is that not the case?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

well, you can start with a table job_duration queue_time 'test_summary.duration' and check it your self. maybe they are in different units? Seconds vs minutes ?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...