https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44709#M179213 <P>One alternative approach could work something like this:</P> <PRE><CODE>sourcetype=result | eval up_int=if(status="Up",1,0) | stats count as num_events, sum(up_int) as num_up | eval num_down=num_events - num_up </CODE></PRE> Mon, 27 Aug 2012 15:18:24 GMT dwaddle 2012-08-27T15:18:24Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44708#M179212 <P>8/27/12 10:24:04.000 AM server=Test and status=Up host=test1 <BR /> 8/27/12 10:24:04.000 AM server=test1 and status=Up host=test1 <BR /> 8/27/12 10:24:04.000 AM server=test2 and status=Down host=test1 <BR /> 8/27/12 10:24:00.000 AM server=test3 and status=Up host=test1 <BR /> 8/27/12 10:23:04.000 AM server=test4 and status=Down host=test1 </P> <P>i tried running the query:<BR /> sourcetype="result"| stats count as num_events , count(eval(status=Up)) as upevent by server<BR /> but not working as expected, unable to get the numbers of up event and total events together</P> Mon, 27 Aug 2012 14:47:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44708#M179212 ajaysingh3 2012-08-27T14:47:23Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44709#M179213 <P>One alternative approach could work something like this:</P> <PRE><CODE>sourcetype=result | eval up_int=if(status="Up",1,0) | stats count as num_events, sum(up_int) as num_up | eval num_down=num_events - num_up </CODE></PRE> Mon, 27 Aug 2012 15:18:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44709#M179213 dwaddle 2012-08-27T15:18:24Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44710#M179214 <P>thanks dwaddle,</P> <P>i have modified above search to <BR /> sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events , sum(up_int) as num_up| eval uptime=num_up*100/num_events</P> <P>result:<BR /> num_events num_up uptime<BR /><BR /> 1 366 305 83.333333 </P> <P>how can we get the result by server</P> Mon, 28 Sep 2020 12:20:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44710#M179214 ajaysingh3 2020-09-28T12:20:25Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44711#M179215 <P>sourcetype=result<BR /> | eval up_int=if(status="Up",1,0)<BR /> | stats count as num_events, sum(up_int) as num_up by server<BR /> | eval num_down=num_events - num_up</P> Mon, 28 Sep 2020 12:20:27 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44711#M179215 lguinn2 2020-09-28T12:20:27Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44712#M179216 <P>thanks, working fine...</P> Mon, 27 Aug 2012 18:07:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44712#M179216 ajaysingh3 2012-08-27T18:07:43Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44713#M179217 <P>I wonder if your formula really represents uptime. I would calculate it like this:</P> <PRE><CODE>sourcetype=result | fields server | dedup server | map [ search sourcetype=result server=$server$ | sort _time | delta _time as timeDelta | streamstats last(status) as lastStatus | status sum(eval(lastStatus="Down")) as downtime sum(eval(lastStatus="Up")) as uptime | eval percentUptime = round((uptime*100)/(uptime+downtime),1) | fields server, uptime, downtime, percentUptime ] </CODE></PRE> Mon, 27 Aug 2012 18:11:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44713#M179217 lguinn2 2012-08-27T18:11:55Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44714#M179218 <P>this is working for me and giving correct uptime...</P> Tue, 28 Aug 2012 11:54:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44714#M179218 ajaysingh3 2012-08-28T11:54:10Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44715#M179219 <P>sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events, sum(up_int) as num_up by server| eval uptime=num_up*100/num_events|fields server uptime</P> Mon, 28 Sep 2020 12:20:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44715#M179219 ajaysingh3 2020-09-28T12:20:50Z https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44716#M179220 <P>Just add the "by" clause to the stats command:</P> <PRE><CODE>sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events , sum(up_int) as num_up by host| eval uptime=num_up*100/num_events </CODE></PRE> Thu, 27 Sep 2012 08:19:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-uptime-based-on-below-result-total-no-of-up/m-p/44716#M179220 Simon 2012-09-27T08:19:22Z