topic Re: Calculate the SLA percentage from start event query and end event query in Splunk Search

How to calculate the SLA percentage from start event query and end event query?

Sekhar — Mon, 17 Apr 2023 20:19:38 GMT

I have two events one is calculate the SLA percentage from below querys

Start event query

Index=x source type= xx "saved msg" extacted fields s like manid,actionid,batch I'd

End event query

Index=y source type=y " recived msg" extacted fields like manid ,actionid

Re: Calculate the SLA percentage from start event query and end event query

ITWhisperer — Sat, 15 Apr 2023 08:43:29 GMT

What exactly do you mean by "SLA percentage"?

SLA usually means Service Level Agreement, so SLA percentage, is that the percentage of people that have signed up to the agreement, out of everyone in your organisation, or at least the key stakeholders in whatever service is being provided?

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Sat, 15 Apr 2023 08:56:11 GMT

Calculate different between start and end events grouped by manid and count number of mandate execceding different above 30 sec

Re: Calculate the SLA percentage from start event query and end event query

ITWhisperer — Sat, 15 Apr 2023 09:30:30 GMT

Try something like this

(index=x source type=xx "saved msg") OR (index=y source type=y " recived msg") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = max(time) - min(time) | stats count count(eval(duration > 30)) as exceeded | eval slapercentagefailure = 100*exceeded/count

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Sat, 15 Apr 2023 09:37:11 GMT

Getting result like below

Count exceeded. slapercentagefailure

66 1. 1.5152

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Sat, 15 Apr 2023 09:41:16 GMT

Getting result like below

Count exceeded. slapercentagefailure

66 1 1.5152

Same way can add the | stats count by date_hour

For SLA trendy by time of the day??

Re: Calculate the SLA percentage from start event query and end event query

ITWhisperer — Sat, 15 Apr 2023 09:54:54 GMT

Which date_hour, when the start event happens or the end event?

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Sat, 15 Apr 2023 10:00:38 GMT

Calculate different between start and end events grouped by manid and count number of mandate execceding different above 30 sec. SLA trendy by time of the day.

Can I add any field for day_hour above query?

Re: Calculate the SLA percentage from start event query and end event query

ITWhisperer — Sat, 15 Apr 2023 11:13:33 GMT

Sure - which time do you want to use, the min(time) or the max(time)?

Re: Calculate the SLA percentage from start event query and end event query

woodcock — Mon, 17 Apr 2023 17:47:23 GMT

(index="X" AND sourcetype="xx" AND "saved msg")
OR (Index="y" AND sourcetype="yy" AND "recived msg")
| streamstats count(eval(match(_raw, "recived msg"))) AS sessionID BY manid actionid
| stats count(eval(match(_raw, "saved msg"))) AS savedCount range(_time) AS duration min(_time) AS _time BY sessionID
| stats count AS total count(eval((savedCount > 0 AND duration > 30) OR (savedCount==0 AND (now() - _time) > 30))) AS SLA_blown
| eval SLA_percentage = 100 * (total - SLA_blown) / total

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Tue, 18 Apr 2023 02:25:31 GMT

Min(time)

Re: Calculate the SLA percentage from start event query and end event query

Sekhar — Tue, 18 Apr 2023 02:25:56 GMT

Min(time)

Re: Calculate the SLA percentage from start event query and end event query

ITWhisperer — Tue, 18 Apr 2023 06:01:51 GMT

(index=x source type=xx "saved msg") OR (index=y source type=y " recived msg") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid min(_time) as _time by manid | eval duration = max(time) - min(time) | bin _time span=1h | stats count count(eval(duration > 30)) as exceeded by _time | eval slapercentagefailure = 100*exceeded/count