topic Re: How do you calculate availability with 2 searches? in Splunk Search

How do you calculate availability with 2 searches?

serviceinfrastr — Tue, 18 Dec 2018 09:19:16 GMT

Hi team,

I want to determine the availabilty of my application with the http status code

(Number of request http >= 400 / Number of request http =<200) * 100

I have my two requests :

index=nginx status>=400 host=dnginx01 server_name=toto.toto.fr NOT http_user_agent="*PRTG*" server_name="toto.toto.fr" status=501 | stats count as total

and

index=nginx status<=200 host=dnginx01 server_name=toto.toto.fr NOT http_user_agent="*PRTG*" server_name="toto.toto.fr" | stats count as total

But i don't know how i can do this operation

Re: How do you calculate availability with 2 searches?

renjith_nair — Tue, 18 Dec 2018 13:23:29 GMT

@serviceinfrastructure,

Try

 index=nginx server_name="toto.toto.fr" NOT http_user_agent="*PRTG*" 
 |stats count(eval(if(status>=400,status,null()))) as c_400,count(eval(if(status<=200,status,null()))) as c_200
 |eval availability=(c_400/c_200)*100

PS: removed status=501 condition from your first search because then you don't need status>=400 condition. Please add this using AND if needed.

Re: How do you calculate availability with 2 searches?

serviceinfrastr — Fri, 21 Dec 2018 08:35:31 GMT

thanks @renjith.nair

Yes Perfect, this determine our unavailability

How i can have the availability, eval (100-availability) ?

Re: How do you calculate availability with 2 searches?

renjith_nair — Fri, 21 Dec 2018 09:02:14 GMT

@serviceinfrastructure, availability is a complex topics and it purely depends on how you consider (https://en.wikipedia.org/wiki/Availability). But here , if the unavailability is in % (for e.g. 30%) , then yes availability is 100-30=70 %