Splunk Search

How to calculate the downtime duration that a Jboss instance does not process any requests?

Norling80
Path Finder

Hi Guys.

We have a Jboss instance from which we index AccessLogs from, and we expect a fair amount of processes requests on this instance 24/7, I need to be able to calculate "downtime duration" based on the time when this instance does not process any requests, any ideas how to proceed?

Tags (4)

dwaddle
SplunkTrust
SplunkTrust

Here's one way of approaching this. For a "fair amount of requests" we'll make an assumption that you should have at least one request per minute. So any minute that has 0 requests is a "down" minute. To compute the "downtime duration" we count the number of minutes with no requests.

sourcetype = access_combined 
| bucket span=1m _time 
| stats count as requests_per_minute by _time 
| where requests_per_minute  = 0 
| stats count as downtime_duration

Norling80
Path Finder

Thanks a lot 🙂

0 Karma

Norling80
Path Finder

Hey, I just bumped into some problem when with the search you helped out with before. the where requests_per_minute = 0 does not work as expected, I think it´s because if the count is 0 it does not return any result, however if i do where requests_per_minute = 1 it find every single minute where the count is 1.

I changed it to where requests_per_minute < 10 and it founds every minute that has less then 10 events... except for the minutes that have a count = 0.

any ideas how to solve this? The most optimal would be if I could specify a

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...