I have following search which calculates seconds UNavailablity:
host=psdkxp* FMT=IOSTAT* APP=TMA PRJ=IPSMON RCD=0 | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >150 |TABLE STM timeDeltaS timeDelta |RENAME timeDeltaS as Sec_unavailable timeDelta as hh:mm:ss_unavailable
I would like to have a search which gives me the percent availability by month - and preferably also YTD.
The calculation should be as follows: Number of days in month * 24 * 60 *60 = TOTAL seconds by month.
Availability calculated as: TOTAL seconds by month minus unavailability seconds divided by total seconds by month.
Example:
TOTAL seconds in April: 31*24*60*60 = 2678400 seconds
Unavailability April = 5 seconds
((2678400-5)/2678400)*100=99.99%
Question 1: How do I do this in a search?
Question 2: There are different number of days in the months - how do I manage this?
Question 3: How do I make a YTD summary availability?
Thank you in advance for your help!
I think I can answer questions 1 and 2. You can use eval
and its friends to compute this in a search. The following eval expression will give you the # of seconds in a month for the month that an event occurs in:
... | eval seconds_in_month=(relative_time(_time,"@mon+1mon")-relative_time(_time,"@mon"))
You should be able to use an additional eval
to calculate your percent-availability. http://www.splunk.com/base/Documentation/latest/SearchReference/Eval
On further thought, YTD might be possible using a similar approach:
... | eval seconds_ytd = (_time - relative_time(_time,"@y"))
I think I can answer questions 1 and 2. You can use eval
and its friends to compute this in a search. The following eval expression will give you the # of seconds in a month for the month that an event occurs in:
... | eval seconds_in_month=(relative_time(_time,"@mon+1mon")-relative_time(_time,"@mon"))
You should be able to use an additional eval
to calculate your percent-availability. http://www.splunk.com/base/Documentation/latest/SearchReference/Eval
On further thought, YTD might be possible using a similar approach:
... | eval seconds_ytd = (_time - relative_time(_time,"@y"))
thanks! that was very useful!