Splunk Search

What's wrong in this sub search ?

jangid
Builder

What is the wrong in this sub search ?
Individually both are working fine.

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish | eval percentage=(numJobs/numFinish)*100 | search [search eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending | rename numPending as numJobs]

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish

Result is 867

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending

Result is 252

Tags (2)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

I think you are looking to do this:

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

I don't think the subsearch command is the correct approach in this case.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

I think you are looking to do this:

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

I don't think the subsearch command is the correct approach in this case.

jangid
Builder

brilliant 🙂

0 Karma

jangid
Builder

Sorry for wrong result - I edited my question

I am calculating the percentage of completion
numFinish is total job
numPending is pending job

0 Karma

Ayn
Legend

Tell us more about what the desired results are. It seems your subsearch would emit something like "numJobs=867" as a filtering expression? What's the idea there?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...