I have a measurement on our system availability.
I have following summary index search:
SEARCH | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >150 |RENAME timeDeltaS as Sec_unavailable timeDelta as hh:mm:ss_unavailable |stats sum(Sec_unavailable) as total_unavail| eval seconds_in_month=(relative_time(_time,"@mon-1mon")-relative_time(_time,"@mon-2mon")) |sistats sum(total_unavail), sum(seconds_in_month)
This will return 0 results if we do not have any downtime during the month.
I use following search for the measurement report, in which I calculate the % availability:
index=summary REPORT=xxxxx |eval Month=strftime(_time,"%m") | Stats sum(total_unavail) sum(seconds_in_month) by date_year Month |rename sum(total_unavail) as unavail sum(seconds_in_month) as secmonth |eval avail=secmonth-unavail|eval AvailPct = round((avail/secmonth)*100,2)|chart sum(AvailPct) by Month |RENAME sum(AvailPct) as "Avail.Pct"
This gives following result - if the result of the summary search is <> 0 results.
Month Avail.Pct
1 04 99.99
2 06 99.99
The result of the summary search for Month 05 was zero (= no down time) - I would of course like to display the value for Month 05 as 100.00 - how do I accomplish this?
I did actually solve the problem myself:
Added append which select unvailability as 1 second: eval Sec_unavailable=1 and calculates the number of seconds in the month.
In order not to have the seconds in month repeated in the sum I then used the VALUES function - and then a stats sum.
|APPEND [SEARCH xxx | eval seconds_in_month=(relative_time(_time,"@mon-1mon")-relative_time(_time,"@mon-2mon"))|eval Sec_unavailable=1
] |stats values(Sec_unavailable) AS total_unavail values(seconds_in_month) as seconds_in_month|SISTATS SUM(total_unavail) SUM(seconds_in_month)