About laduran

laduran · ‎08-08-2022

This fixed my issue. Thank you! @somesoni2

laduran · ‎08-08-2022

I have the following search: index=sandbox document_type=test-collat-record-json_v2 | where ((isnotnull(test_result)) AND project_short="LNL" AND collateral_type="fw" AND ingredient_type="ifwi_bin" AND ingredient="csme") | dedup test_collat_record_json_guid | join type=inner left=L right=R where L.project_short=R.project_short L.collateral_type=R.collateral_type L.ingredient_type=R.ingredient_type L.ingredient=R.ingredient [search document_type=test-collat-record-summary-json] | table L.collat_record_json_guid, L.project_short, L.collateral_type, L.ingredient_type, L.ingredient, L.version, L.test, L.test_result, R.number_of_tests, R.passing_threshold I'm joining data from a set of test results and then I lookup info about what a passing set of results should look like from another data source. Hence the join. It's good. It works for me and the result yields the table: So great. Just want to aggregate the results and get counts of passing/failing tests and compare that with the passing_threshold field. So I added: | stats count(eval(L.test_result=="SUCCESS")) as passingTests count(eval(L.test_result=="FAILURE")) as failingTests values(R.number_of_tests) as numTests, values(R.passing_threshold) as pass_threshold by L.collat_record_json_guid But the two evaluations of success and failure tests are zero. But from the table above they are clearly not zero. Should be 2 and 1 respectively. What have I done wrong? Is eval not going to work on joined data? I am using the correct aliases for the data.

laduran · ‎08-05-2022

I am fairly new to Splunk but I come from a background of SQL databases and I may still be trying to do things in a "relational" way... Having said that I have two data sources. One represents test results (a list of test results) and one represents test suites (just some metadata for a set of tests like number of tests and a minimum required passing tests) I want to be able to compute the ratio of tests that passed and compare that with a passing threshold ratio. To do this I join test results with the test summary data like this: index=test_results | where (!isnull(test_result)) | join type=inner left=L right=R where L.test_summary_id=R.test_summary_id [search index=test_summaries] |stats values(L.project_short) AS project, count(eval(L.test_result=='PASS')) as tests_passing count, values(R.number_of_tests) as number_of_tests, values(R.passing_threshold) as pass_threshold by L.sw_release_id The line count(eval(L.test_result=='PASS')) as tests_passing always evaluates to 0 but I expect it to be the number of tests with the value "PASS" as a result for that sw_release_id. Other searches where I am not joining two tables, I can compute the tests_passing value correctly. Is there something about a join that prevents me from doing evaluations? Should I not use a join? Thanks...

laduran · ‎07-29-2022

Thanks for the reply. But... I gotta say, the syntax for doing multiple joins is very convoluted and not intuitive compared with SQL.

Posts	4
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎07-20-2022

Online Status	Offline
Date Last Visited	‎08-08-2022 04:36 PM

Why is eval failing on joined data?

Is there something about a join that prevents me f...

Re: Eval failing on joined data

Why is eval failing on joined data?

Is there something about a join that prevents me f...

Re: How do I combine my three searches using multi...