topic Re: Planned outage graph logic in Splunk Search

Planned outage graph logic

joydeep741 — Mon, 25 Jun 2018 16:18:41 GMT

I want to build a logic for SEARCH-2

My SEARCH -1
Gives me start and End time stamp of a Planned Outage.

My SEARCH-2
Gives me the availaiblity graph of my server.
Now in the availibility graph, if the timestamp is in the time range of planned outage (given by search 1) than I should mark that as "planned outage" (so that no one is confused whether its planned or an actual outage).

index=avail sourcetype=availaibility | if availaibility == 0 | check if the time of event is in the time range given by SUB SEARCH ""My Search 1

Re: Planned outage graph logic

renjith_nair — Tue, 26 Jun 2018 04:13:12 GMT

Hi @joydeep741,
Try something similar,

index=_* earliest=-4h@h|bucket span=1h _time|stats count by component,_time|eval time=_time|eval status=if(count>100,1,0) 
|appendcols [search index=_* earliest=-3h@h latest=-1h@h|stats earliest(_time) as earliest,latest(_time) as latest|fields earliest,latest]| filldown
|eval maintenance=if(_time>=earliest AND _time <= latest,1,0)

Here I take last 4 hours of data and compare it against a planned maintenance of 1 hr (between 3rd and 2nd hour). Do you have data in two different indexes? If the above doesnt work for you, please provide some sample data from both searches

Re: Planned outage graph logic

joydeep741 — Wed, 27 Jun 2018 10:56:33 GMT

My two searches are from 2 different indexes.

Re: Planned outage graph logic

renjith_nair — Thu, 28 Jun 2018 00:49:05 GMT

@joydeep741,

That does not matter. Above is just an example. you could write your searches in the same way or if you could provide some sample events from both indexes, we could help you

Re: Planned outage graph logic

niketn — Thu, 28 Jun 2018 05:52:13 GMT

@joydeep741, if you are on Splunk 7+, seems a good candidate for Chart Event Annotation

Otherwise approach would be similar to what @renjith.nair mentioned. Refer to following old but useful blog on overlaying information on timechart: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html