All Apps and Add-ons

Why does availability query not consider "Connection failed" cases as unavailability

etienneabe
New Member

In the website monitoring application some availability score is calculated as below

sourcetype="web_ping" website_monitoring_search_index title="URL being monitored" | fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0) | fillnull value=1 success | chart count as total, sum(success) as successes | eval availability=round(100(successes/total),2) | fields availability*

However, sometimes unavailability can translate into a connection failing rather than in error codes or timeouts
This may oddly show a site with a hell lot of errors while its availability remains high....

Is this a bug or a deliberate design choice ?
If a design choice, why so ?

Tags (1)
0 Karma
1 Solution

LukeMurphey
Champion

This is bug. I opened a bug report on it and will fix it very soon in a maintenance release (2.7.2). See https://lukemurphey.net/issues/2316

Update:
I fixed this in version 2.7.2.

View solution in original post

0 Karma

LukeMurphey
Champion

This is bug. I opened a bug report on it and will fix it very soon in a maintenance release (2.7.2). See https://lukemurphey.net/issues/2316

Update:
I fixed this in version 2.7.2.

0 Karma

etienneabe
New Member

excellent news. Thanks for your swift reaction.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...