About kasimbekur

kasimbekur · ‎03-27-2018

awesome, it worked. Can you explain more about it? so that we can understand concept better. Also let me know Splunk reference documents for above solution.

kasimbekur · ‎03-26-2018

I have used below query to get distinct values: stats values(gitRepo) AS serviceName BY buildNum This gives correct values. Problem is I am not getting value for other fields. If I used eventstats all values are coming in the table output but it is getting wrong data. eventstats values(gitRepo) AS serviceName BY buildNum How do I fix this?

kasimbekur · ‎03-23-2018

fantastic, it worked. +1 for your detailed explanation of each steps and functions used, this really helped to understand the Splunk report concept than just fixing issues.

kasimbekur · ‎03-22-2018

i have updated above main comment section. I want to find average time to run each application. I hope this can be done by subtracting testRunEndTime - testRunStartTime. Also will be better if I get average of each test cases in an application. i.e. testCaseEndTime - testCaseStartTime

kasimbekur · ‎03-22-2018

I have given | eventstats avg(TotalTime) AS AverageTime BY testFileName still it gives empty Is this issue because of TotalTime is in time format?

kasimbekur · ‎03-22-2018

I am new to Splunk reporting. I am looking for average time taken for a single app( say myapp) to run its test cases. I run your query, AverageTime gives empty value.

kasimbekur · ‎03-21-2018

**but if i add stats with avg, i am not getting any values other than TotalValues in the table which comes wrong values.

kasimbekur · ‎03-21-2018

My below query works fine: index="jenkins-cicd-*" source="**/test-metrics-summary.json" | rex max_match=0 field=_raw "(?<lineData>[^\n]+)" | mvexpand lineData | spath input=lineData path=env output=singleEnv | spath input=singleEnv | spath input=lineData | eval status=mvindex(status,1)| eval testRunStartTime=mvindex(testRunStartTime,1)| eval testRunEndTime=mvindex(testRunEndTime,1)| eval testFileName=mvindex(testFileName,1)| eval testCaseName=mvindex(testCaseName,1)| eval testCaseId=mvindex(testCaseId,1)| eval TotalTime = strftime(strptime(testRunEndTime , "%Y-%m-%dT%H:%M:%S.%3N") - strptime(testRunStartTime, "%Y-%m-%dT%H:%M:%S.%3N"), "%Mm %Ss %2Nms")| table status testRunStartTime testRunEndTime testFileName testCaseName testCaseId TotalTime but if i add stats with avg, i am not getting any values other than avg values in the table index="jenkins-cicd-*" source="**/ctest-metrics-summary.json" | rex max_match=0 field=_raw "(?<lineData>[^\n]+)" | mvexpand lineData | spath input=lineData path=env output=singleEnv | spath input=singleEnv | spath input=lineData | eval status=mvindex(status,1)| eval testRunStartTime=mvindex(testRunStartTime,1)| eval testRunEndTime=mvindex(testRunEndTime,1)| eval testFileName=mvindex(testFileName,1)| eval testCaseName=mvindex(testCaseName,1)| eval testCaseId=mvindex(testCaseId,1)| eval TotalTime = strftime(strptime(testRunEndTime , "%Y-%m-%dT%H:%M:%S.%3N") - strptime(testRunStartTime, "%Y-%m-%dT%H:%M:%S.%3N"), "%Mm %Ss %2Nms")| stats avg(TotalTime) by TotalTime | table status testRunStartTime testRunEndTime testFileName testCaseName testCaseId TotalTime I am getting all fields empty. I want to display average value as AverageTime after filed TotalTime.

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-21-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

eventstats distinct values

search report query with stats

Re: eventstats distinct values

eventstats distinct values

Re: search report query with stats

Re: search report query with stats

Re: search report query with stats

Re: search report query with stats

Re: search report query with stats

search report query with stats