topic Re: SLA calculating in Splunk Search

How to calculate SLA?

Sekhar — Fri, 19 May 2023 12:22:16 GMT

my query below

(Index=x source=xtype valid) or (index=y source= ytype passed) | eval which=if(match(_raw, " valid"),"valid", "passed") | stats values( which) as msg by manid | stats count(eval(msg=" valid")) as total_ count count(eval(msg= "passed"))

getting out like total count 54 respons count 58

But i want check this condition too

Eval msgconur = mvcount(msg) | where >1

Need to check duration time > 30 count duration time <30 count

Re: SLA calculating

ITWhisperer — Fri, 19 May 2023 07:34:47 GMT

| stats values( which) as msg count(eval(duration>30)) as gt30 count(eval(duration<30) as lt30 by manid | where mvcount(msg) > 1

Re: SLA calculating

Sekhar — Fri, 19 May 2023 07:39:00 GMT

My SLA calculating like this 100-(count of duration<30/total count)*100