I'm trying to graph out the pass rate of test execution over time from logs that formatted using JSON. I've manually extracted and parsed the values into fields and am now trying to use the values to calculate the pass rates. However, when I try to sum multiple values by timeslice, I get the error "Unexpected token '(' found with the parenthesis in my second sum highlighted. What am I doing wrong? Thanks!
_sourceCategory="xxxx" and _collector="xxxx"
| timeslice 1h
| json "executions[*].status[*].id" as executionStatus
| extract field=executionStatus"(?<status>1|2|3|4)" multi
| if(status matches "1", 1, 0) as pass
| if(status matches "2", 1, 0) as fail
| if(status matches "3", 1, 0) as pwi
| if(status matches "4", 1, 0) as blocked
| sum(pass) as pass by _timeslice, sum(fail) as fail by _timeslice , sum(pwi) as pwi by _timeslice , sum(blocked) as blocked by _timeslice
| pass + fail + pwi + blocked as totalExecutions
| (pass/totalExecutions)*100 as passRate
Please sign in to leave a comment.