Hi, I am trying to build a dashboard with some status indicators and uptime gauges. Below are the few sample logs.
2021-02-21 13:48:42,744 (DEBUG) Thread_^[OP].* BATCH ID(31673) response (Internal Server Error, 500)
2021-02-21 13:48:42,741 (DEBUG) Thread_^[KL].* BATCH ID(62422) response (Internal Server Error, 500)
2021-02-21 13:48:31,620 (DEBUG) Thread_^[UV].* BATCH ID(40284) response (OK, 200)
2021-02-21 13:47:41,991 (DEBUG) Thread_^[OP].* BATCH ID(31672) response (OK, 200)
Created a status indicator for last 10 minutes as in the below query.
index="abc" | eval Indicator=if(Response=="(OK, 200)", "UP", "DOWN")
| stats
count(eval(if(Indicator="UP", 1, null()))) as UP_count
count(eval(if(Indicator="DOWN", 1, null()))) as DOWN_count
count(Indicator) as "TotalCount"
| eval SI = case(UP_count>0,"UP", UP_count==0,"DOWN")
| table SI
Result will be either UP or DOWN.
Now I am trying to create a uptime gauge which will display the time from which the value of SI is UP.
For example, if the value of SI was DOWN for sometime and the connection restored and SI = UP from last 2 days, the uptime will be like
2 days, 30 minutes, 40 seconds
Can anyone please help me with this.
Hi @mariamathewtel,
you can solve your problem in two ways:
using transpose.
index="abc" | eval Indicator=if(Response=="(OK, 200)", "UP", "DOWN")
| transpose startswith="Internal Server Error" endswith="OK,200"
| table duration
| eval duration=tostring("duration")
Ciao.
Giuseppe
Hi @gcusello , Thanks for your reply.
But it is not working. not sure how to get the duration
Hi @mariamathewtel,
check if the transpose correlates the events; if yes, the duration is automatically calculated.
Ciao.
Giuseppe
Hi @gcusello ,
For transpose command , i am getting an error like below
Error in 'transpose' command: Numerical limit expected.