topic Re: How to specify a time range inside a search in Dashboards & Visualizations

Status indicators and uptime calculation

mariamathewtel — Tue, 16 Mar 2021 05:04:39 GMT

Hi, I am trying to build a dashboard with some status indicators and uptime gauges. Below are the few sample logs.

2021-02-21 13:48:42,744 (DEBUG) Thread_^[OP].* BATCH ID(31673) response (Internal Server Error, 500)

2021-02-21 13:48:42,741 (DEBUG) Thread_^[KL].* BATCH ID(62422) response (Internal Server Error, 500)

2021-02-21 13:48:31,620 (DEBUG) Thread_^[UV].* BATCH ID(40284) response (OK, 200)

2021-02-21 13:47:41,991 (DEBUG) Thread_^[OP].* BATCH ID(31672) response (OK, 200)

Created a status indicator for last 10 minutes as in the below query.

index="abc" | eval Indicator=if(Response=="(OK, 200)", "UP", "DOWN")
| stats
count(eval(if(Indicator="UP", 1, null()))) as UP_count
count(eval(if(Indicator="DOWN", 1, null()))) as DOWN_count
count(Indicator) as "TotalCount"
| eval SI = case(UP_count>0,"UP", UP_count==0,"DOWN")
| table SI

Result will be either UP or DOWN.

Now I am trying to create a uptime gauge which will display the time from which the value of SI is UP.

For example, if the value of SI was DOWN for sometime and the connection restored and SI = UP from last 2 days, the uptime will be like
2 days, 30 minutes, 40 seconds
Can anyone please help me with this.

Re: How to specify a time range inside a search

gcusello — Mon, 15 Mar 2021 07:40:23 GMT

Hi @mariamathewtel,

you can solve your problem in two ways:

using transpose (it's easier but less performant),
using stats (more complex but more performant).

using transpose.

index="abc" | eval Indicator=if(Response=="(OK, 200)", "UP", "DOWN") | transpose startswith="Internal Server Error" endswith="OK,200" | table duration | eval duration=tostring("duration")

Ciao.

Giuseppe

Re: How to specify a time range inside a search

mariamathewtel — Mon, 15 Mar 2021 09:13:32 GMT

Hi @gcusello , Thanks for your reply.

But it is not working. not sure how to get the duration

Re: How to specify a time range inside a search

gcusello — Mon, 15 Mar 2021 10:09:40 GMT

Hi @mariamathewtel,

check if the transpose correlates the events; if yes, the duration is automatically calculated.

Ciao.

Giuseppe

Re: How to specify a time range inside a search

mariamathewtel — Mon, 15 Mar 2021 10:27:55 GMT

Hi @gcusello ,
For transpose command , i am getting an error like below

Error in 'transpose' command: Numerical limit expected.