how to calculate uptime based on below result, (total no of up events)*100/(total no of events)

[ajaysingh3]

8/27/12 10:24:04.000 AM server=Test and status=Up host=test1
8/27/12 10:24:04.000 AM server=test1 and status=Up host=test1
8/27/12 10:24:04.000 AM server=test2 and status=Down host=test1
8/27/12 10:24:00.000 AM server=test3 and status=Up host=test1
8/27/12 10:23:04.000 AM server=test4 and status=Down host=test1

i tried running the query:
sourcetype="result"| stats count as num_events , count(eval(status=Up)) as upevent by server
but not working as expected, unable to get the numbers of up event and total events together

[Simon]

Just add the "by" clause to the stats command:

sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events , sum(up_int) as num_up by host| eval uptime=num_up*100/num_events

[ajaysingh3]

sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events, sum(up_int) as num_up by server| eval uptime=num_up*100/num_events|fields server uptime

[lguinn2]

I wonder if your formula really represents uptime. I would calculate it like this:

sourcetype=result | fields server | dedup server 
| map [ search sourcetype=result server=$server$  | sort _time | delta _time as timeDelta 
      | streamstats last(status) as lastStatus 
      | status  sum(eval(lastStatus="Down")) as downtime sum(eval(lastStatus="Up")) as uptime 
      | eval percentUptime = round((uptime*100)/(uptime+downtime),1)
      | fields server, uptime, downtime, percentUptime ]

[ajaysingh3]

this is working for me and giving correct uptime...

[ajaysingh3]

thanks dwaddle,

i have modified above search to
sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events , sum(up_int) as num_up| eval uptime=num_up*100/num_events

result:
num_events num_up uptime

1 366 305 83.333333

how can we get the result by server

[dwaddle]

One alternative approach could work something like this:

sourcetype=result
| eval up_int=if(status="Up",1,0)
| stats count as num_events, sum(up_int) as num_up
| eval num_down=num_events - num_up

[ajaysingh3]

thanks, working fine...

[lguinn2]

sourcetype=result
| eval up_int=if(status="Up",1,0)
| stats count as num_events, sum(up_int) as num_up by server
| eval num_down=num_events - num_up