https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182026#M52483 <P>Awesome looks like that did the trick after a small tweak!</P> Thu, 14 Aug 2014 18:54:30 GMT brywilk_umich 2014-08-14T18:54:30Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182024#M52481 <P>Hello,</P> <P>I have nagios feeding data into splunk. The below searches give me ping (up, down) and a service check (ok, critical). While the separate searches seem to work great, I would like to combine them and have a overall uptime percentage for availability, and in the future will likely add more nagios checks to combine. Both searches have a similar Server field.</P> <P>index=nagios perfdata="HOSTPERFDATA" tag::src_host=collaboration hoststate | eventstats count as "totalCount" | eventstats count as "choiceCount" by hoststate | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by hoststate</P> <P>index=nagios name="check__smtp" AND perfdata="SERVICEPERFDATA" tag::src_host=collaboration | eventstats count as "totalCount" | eventstats count as "choiceCount" by severity | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by severity</P> <P>thanks.</P> Mon, 28 Sep 2020 17:20:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182024#M52481 brywilk_umich 2020-09-28T17:20:25Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182025#M52482 <P>Assuming host=down and severity=critical means host was not available, then try this.</P> <PRE><CODE>index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check__smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="down" OR severity="critical","Unavailable","Available" | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count as totalCount | eval percentAvailable=(unavailCount/totalCount)*100 | table percentAvailable </CODE></PRE> Thu, 14 Aug 2014 18:37:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182025#M52482 somesoni2 2014-08-14T18:37:37Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182026#M52483 <P>Awesome looks like that did the trick after a small tweak!</P> Thu, 14 Aug 2014 18:54:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182026#M52483 brywilk_umich 2014-08-14T18:54:30Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182027#M52484 <P>Found 1 little flaw, the percent available comes out to 0 if their arent any unavailable events. Any thoughts on fixing that?</P> Thu, 14 Aug 2014 19:08:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182027#M52484 brywilk_umich 2014-08-14T19:08:36Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182028#M52485 <P>Never mind I did a stats on Available and based the percentAvailable off of that.....</P> <P>thanks again!</P> Thu, 14 Aug 2014 19:15:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-to-evaluate-uptime-percentage/m-p/182028#M52485 brywilk_umich 2014-08-14T19:15:22Z