Splunk Search

How to edit my search to calculate time availability based on gaps between logs?

kanet
New Member

I would like to calculate availability time based on gaps between logs
so far I have this:

index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | where gap > 320  | convert ctime(last_time) as last_time | stats sum(gap) AS Unavailability_sec by HostName | addinfo  | eval range = info_max_time - info_min_time  | eval Availability= 100 - (Unavailability_sec* 100 / range) | stats count | eval msg = if(count!=0, Availability, "100" ) | table msg

But when it reach gaps means count != 0 then its always showing no results found.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | eval Unavailability=if(gap > 320,gap,0)  | addinfo  | eval range = info_max_time - info_min_time | stats sum(Unavailability) AS Unavailability_sec max(range) as range by HostName  | eval Availability= 100 - (Unavailability_sec* 100 / range) 

Gives availability per host.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | eval Unavailability=if(gap > 320,gap,0)  | addinfo  | eval range = info_max_time - info_min_time | stats sum(Unavailability) AS Unavailability_sec max(range) as range by HostName  | eval Availability= 100 - (Unavailability_sec* 100 / range) 

Gives availability per host.

0 Karma

kanet
New Member

Thanks! it is working as should 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...