Splunk Search

How to get a value - even if 0 results from search?

JYTTEJ
Communicator

I have a measurement on our system availability.

I have following summary index search:

SEARCH | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >150 |RENAME timeDeltaS as Sec_unavailable timeDelta as hh:mm:ss_unavailable |stats sum(Sec_unavailable) as total_unavail| eval seconds_in_month=(relative_time(_time,"@mon-1mon")-relative_time(_time,"@mon-2mon")) |sistats sum(total_unavail), sum(seconds_in_month)

This will return 0 results if we do not have any downtime during the month.

I use following search for the measurement report, in which I calculate the % availability:
index=summary REPORT=xxxxx |eval Month=strftime(_time,"%m") | Stats sum(total_unavail) sum(seconds_in_month) by date_year Month |rename sum(total_unavail) as unavail sum(seconds_in_month) as secmonth |eval avail=secmonth-unavail|eval AvailPct = round((avail/secmonth)*100,2)|chart sum(AvailPct) by Month |RENAME sum(AvailPct) as "Avail.Pct"

This gives following result - if the result of the summary search is <> 0 results.

Month Avail.Pct

1 04 99.99

2 06 99.99

The result of the summary search for Month 05 was zero (= no down time) - I would of course like to display the value for Month 05 as 100.00 - how do I accomplish this?

Tags (1)

JYTTEJ
Communicator

I did actually solve the problem myself:

Added append which select unvailability as 1 second: eval Sec_unavailable=1 and calculates the number of seconds in the month.

In order not to have the seconds in month repeated in the sum I then used the VALUES function - and then a stats sum.

|APPEND [SEARCH xxx | eval seconds_in_month=(relative_time(_time,"@mon-1mon")-relative_time(_time,"@mon-2mon"))|eval Sec_unavailable=1
] |stats values(Sec_unavailable) AS total_unavail values(seconds_in_month) as seconds_in_month|SISTATS SUM(total_unavail) SUM(seconds_in_month)

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...