Activity Feed
- Karma Re: eventstats distinct values for 493669. 06-05-2020 12:49 AM
- Karma Re: search report query with stats for elliotproebstel. 06-05-2020 12:49 AM
- Posted Re: eventstats distinct values on Splunk Search. 03-27-2018 09:29 AM
- Posted eventstats distinct values on Splunk Search. 03-26-2018 05:48 PM
- Tagged eventstats distinct values on Splunk Search. 03-26-2018 05:48 PM
- Tagged eventstats distinct values on Splunk Search. 03-26-2018 05:48 PM
- Tagged eventstats distinct values on Splunk Search. 03-26-2018 05:48 PM
- Tagged eventstats distinct values on Splunk Search. 03-26-2018 05:48 PM
- Posted Re: search report query with stats on Splunk Search. 03-23-2018 10:58 AM
- Posted Re: search report query with stats on Splunk Search. 03-22-2018 01:25 PM
- Posted Re: search report query with stats on Splunk Search. 03-22-2018 11:59 AM
- Posted Re: search report query with stats on Splunk Search. 03-22-2018 10:32 AM
- Posted Re: search report query with stats on Splunk Search. 03-21-2018 05:20 PM
- Posted search report query with stats on Splunk Search. 03-21-2018 04:58 PM
- Tagged search report query with stats on Splunk Search. 03-21-2018 04:58 PM
- Tagged search report query with stats on Splunk Search. 03-21-2018 04:58 PM
- Tagged search report query with stats on Splunk Search. 03-21-2018 04:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
03-27-2018
09:29 AM
awesome, it worked. Can you explain more about it? so that we can understand concept better. Also let me know Splunk reference documents for above solution.
... View more
03-26-2018
05:48 PM
I have used below query to get distinct values:
stats values(gitRepo) AS serviceName BY buildNum
This gives correct values. Problem is I am not getting value for other fields. If I used eventstats all values are coming in the table output but it is getting wrong data.
eventstats values(gitRepo) AS serviceName BY buildNum
How do I fix this?
... View more
03-23-2018
10:58 AM
fantastic, it worked. +1 for your detailed explanation of each steps and functions used, this really helped to understand the Splunk report concept than just fixing issues.
... View more
03-22-2018
01:25 PM
i have updated above main comment section. I want to find average time to run each application. I hope this can be done by subtracting testRunEndTime - testRunStartTime. Also will be better if I get average of each test cases in an application. i.e. testCaseEndTime - testCaseStartTime
... View more
03-22-2018
11:59 AM
I have given
| eventstats avg(TotalTime) AS AverageTime BY testFileName
still it gives empty
Is this issue because of TotalTime is in time format?
... View more
03-22-2018
10:32 AM
I am new to Splunk reporting.
I am looking for average time taken for a single app( say myapp) to run its test cases.
I run your query, AverageTime gives empty value.
... View more
03-21-2018
05:20 PM
**but if i add stats with avg, i am not getting any values other than TotalValues in the table which comes wrong values.
... View more
03-21-2018
04:58 PM
My below query works fine:
index="jenkins-cicd-*" source="**/test-metrics-summary.json" | rex max_match=0 field=_raw "(?<lineData>[^\n]+)" | mvexpand lineData | spath input=lineData path=env output=singleEnv | spath input=singleEnv | spath input=lineData | eval status=mvindex(status,1)| eval testRunStartTime=mvindex(testRunStartTime,1)| eval testRunEndTime=mvindex(testRunEndTime,1)| eval testFileName=mvindex(testFileName,1)| eval testCaseName=mvindex(testCaseName,1)| eval testCaseId=mvindex(testCaseId,1)| eval TotalTime = strftime(strptime(testRunEndTime , "%Y-%m-%dT%H:%M:%S.%3N") - strptime(testRunStartTime, "%Y-%m-%dT%H:%M:%S.%3N"), "%Mm %Ss %2Nms")|
table status testRunStartTime testRunEndTime testFileName testCaseName testCaseId TotalTime
but if i add stats with avg, i am not getting any values other than avg values in the table
index="jenkins-cicd-*" source="**/ctest-metrics-summary.json" | rex max_match=0 field=_raw "(?<lineData>[^\n]+)" | mvexpand lineData | spath input=lineData path=env output=singleEnv | spath input=singleEnv | spath input=lineData | eval status=mvindex(status,1)| eval testRunStartTime=mvindex(testRunStartTime,1)| eval testRunEndTime=mvindex(testRunEndTime,1)| eval testFileName=mvindex(testFileName,1)| eval testCaseName=mvindex(testCaseName,1)| eval testCaseId=mvindex(testCaseId,1)| eval TotalTime = strftime(strptime(testRunEndTime , "%Y-%m-%dT%H:%M:%S.%3N") - strptime(testRunStartTime, "%Y-%m-%dT%H:%M:%S.%3N"), "%Mm %Ss %2Nms")| stats avg(TotalTime) by TotalTime |
table status testRunStartTime testRunEndTime testFileName testCaseName testCaseId TotalTime
I am getting all fields empty. I want to display average value as AverageTime after filed TotalTime.
... View more
