Dashboards & Visualizations

Availability Panel in Status History Dashboard

klaxdal
Contributor

I am trying to adjust the Availability panel within the Status History to show month over month availability percentages - it currently only shows the aggregate e.g. displays one value as opposed to breaking out availability month -to -month

Here is the current search :

sourcetype="web_ping" title="" NOT (date_hour>=1 date_hour<120) NOT (date_hour>=4 date_hour<420) NOT (date_hour>=21 date_hour<2120) | fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0) | fillnull value=1 success | chart count as total, sum(success) as successes | eval availability=round(100(successes/total),2) | fields availability

Any help would be greatly appreciated !

Tags (1)
0 Karma
1 Solution

niketn
Legend

@cmerriman, I think you missed multiplication for percent i.e. | eval availability= round(100*(success/total),2). However, I think the complete query in the question is not ideal way of writing SPL. Also for correct SPL we would still need for information around data and intent of SPL in question.

@klaxdal, please post code on Splunk answer using the code button (101010) so that special characters do not escape. Following things are not clear in your query
1) date_hour ideally should be between 0 to 24. However, you have used 120, 420, 2120, which would never exist. Please explain the intent of using date_hour filter. Also inclusion is better than exclusion. See if you can add positive match rather than negative match using NOT. Further you should also know that != and NOT behavior are different.

2) If we were to use your query, the success eval case() should ideally be re-written as following and fillnull value=1000 response_code and | fillnull value=1 success would NOT be required.

| eval success=case(response_code>=400 OR isnull(response_code) OR timed_out == "True", 0,true(),1)

3) However, there is even better way of writing the query with count with eval within timechart command since evals should ideally be performed after transforming commands (statistical commands that generate tabular data).

Try the following search after correcting date_hour in your base search:

 <Your_Base_Search_With_Valid_date_hour_Filter> 
| timechart span=1mon count as total, count(eval((response_code<400 AND isnotnull(response_code)) OR timed_out!="True")) as successes
| eval availability=round(100*(successes/total),2) 
| fields _time availability

Also, OR timed_out!="True" can be AND timed_out!="True" depending on whether the field is timed_out is available on all events or not i.e. either time_out=="True" or timed_out=="False". Based on your query time_out=="True" condition would be evaluated only if response_code<400. Please confirm if this is the expected use case or not. Also confirm if time_out is not True then what is its value?

PS: Most of these tips are already listed in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@cmerriman, I think you missed multiplication for percent i.e. | eval availability= round(100*(success/total),2). However, I think the complete query in the question is not ideal way of writing SPL. Also for correct SPL we would still need for information around data and intent of SPL in question.

@klaxdal, please post code on Splunk answer using the code button (101010) so that special characters do not escape. Following things are not clear in your query
1) date_hour ideally should be between 0 to 24. However, you have used 120, 420, 2120, which would never exist. Please explain the intent of using date_hour filter. Also inclusion is better than exclusion. See if you can add positive match rather than negative match using NOT. Further you should also know that != and NOT behavior are different.

2) If we were to use your query, the success eval case() should ideally be re-written as following and fillnull value=1000 response_code and | fillnull value=1 success would NOT be required.

| eval success=case(response_code>=400 OR isnull(response_code) OR timed_out == "True", 0,true(),1)

3) However, there is even better way of writing the query with count with eval within timechart command since evals should ideally be performed after transforming commands (statistical commands that generate tabular data).

Try the following search after correcting date_hour in your base search:

 <Your_Base_Search_With_Valid_date_hour_Filter> 
| timechart span=1mon count as total, count(eval((response_code<400 AND isnotnull(response_code)) OR timed_out!="True")) as successes
| eval availability=round(100*(successes/total),2) 
| fields _time availability

Also, OR timed_out!="True" can be AND timed_out!="True" depending on whether the field is timed_out is available on all events or not i.e. either time_out=="True" or timed_out=="False". Based on your query time_out=="True" condition would be evaluated only if response_code<400. Please confirm if this is the expected use case or not. Also confirm if time_out is not True then what is its value?

PS: Most of these tips are already listed in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

klaxdal
Contributor

Thanks so much for your help !

0 Karma

cmerriman
Super Champion

if you want this month by month try:

sourcetype="web_ping" title="" NOT (date_hour>=1 date_hour<120) NOT (date_hour>=4 date_hour<420) NOT (date_hour>=21 date_hour<2120) | fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0) | fillnull value=1 success | timechart span=1mon count as total, sum(success) as successes | eval availability=round(100(successes/total),2) | fields _time availability

you need to add a timefield to your chart and fields commands.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...