topic No 100% results in Getting Data In

No 100% results

bullbasin — Wed, 20 Mar 2024 12:07:19 GMT

I have a report with a table where I am showing uptime availability of various products. Currently the table is returning only results that fall below 100%. Makes sense overall but I need all the data. So I need results with no data to show as 100%. For the life of me I can not figure it out. Please all knowing Splunk gods help me.

index=my_data data.environment.application="MY APP" data.environment.environment="test" | eval estack="my_stack" | fillnull value="prod" estack data.environment.stack | where 'data.environment.stack'=estack | streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId | eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False") | transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m | stats sum(duration) as downtime by data.componentId | addinfo | eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0) | rename data.componentId AS Component, avail AS Availability | table Component, Availability

Re: No 100% results

PickleRick — Wed, 20 Mar 2024 10:45:39 GMT

As I understand, you're searching for events meaning that you have an outage/failure. Your 100% uptime would mean that you have no events at all, right?

Well, you can't find something that isn't there so you have to "cheat" a little.

See https://www.duanewaddle.com/proving-a-negative/

Re: No 100% results

bullbasin — Wed, 20 Mar 2024 16:43:35 GMT

Alright maybe not enough coffee....I am going in circles trying to get this to display the values in the csv.  Cant figure out what needs to go with the fillnull value.

index=my_data data.environment.application="MY APP" data.environment.environment="test" | eval estack="my_stack" | fillnull value="prod" estack data.environment.stack | where 'data.environment.stack'=estack | streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId | eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False") | transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m | stats sum(duration) as downtime by data.componentId | inputlookup append=true Component_avail.csv | fillnull | addinfo | eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0) | rename data.componentId AS Component, avail AS Availability | table Component, Availability

Re: No 100% results

bullbasin — Wed, 20 Mar 2024 12:42:50 GMT

Figured it out as it was a rename messing me up.

Re: No 100% results

bullbasin — Wed, 20 Mar 2024 13:20:08 GMT

Ok I guess one last thing. When the results for the report are 100% across the board. I don't get any results it is blank. There seems to be the need for a result below 100% to return all fields again.

Re: No 100% results

PickleRick — Wed, 20 Mar 2024 16:52:41 GMT

A quick and ugly hack would be to run your original search (that one calculating availability) and then do

| append [ | inputlookup Component_avail.csv
    | eval Availability=100 ]
| stats min(Availability) as Availability by Component

Alternatively, you can define your lookup to contain both fields - Component and Availability (with Availability set to 100 across the board) and use

| inputlookup append=t Component_avail.csv

and then do the stats.

This way if your original search calculates some non-100% availability you'll get it in your final results. If there is no sub-100 availability calculated, you'll get the static 100 provided by the lookup.