Deployment Architecture

Measure availablity in during certain hours during the day


Hi I have created following search to measure availability per day (24 hours)

host=xxxxxp*   | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >15 |RENAME timeDeltaS as Sec_unavailable   |APPEND [SEARCH host=xxxxxp*  PRJ=PRJABC| eval Sec_unavailable=0 ]|bucket _time span=1d |stats  sum(Sec_unavailable)  by _time| RENAME sum(Sec_unavailable) as sec_unavail |eval avail=86400-sec_unavail|eval AvailPct = round((avail/86400)*100,2)|timechart span=1d sum(AvailPct)|RENAME sum(AvailPct) as "Avail.Pct"

This calculates availabilty % per day round((avail/86400)*100,2)

Now I want to calculate the availability within the service hours (07 to 19 GMT) per day.
I know how to select the service hours (date_hour >07 AND date_hour <19) - and I have changed the 86400 (24 hours) seconds to 46800 (=13 hours) - but I am getting negative availabilty...

I believe this is due to the *bucket _time span=1d* - but I am very most lost as to which bucket command I should use?

Tags (1)
0 Karma


Well without having had a closer look at your search, if your search that spans 1 day is to be changed into a search that spans 12 hours, then the bucket command should likely be changed accordingly. So: bucket _time span=12h

0 Karma


I found the reason why I was getting a negative value. this is because the search calculates the difference in time between 20:00 to 07:00 - how do I avoid that?
I only want to calculate any difference in time between 07:00 to 20:00 - how do I accomplish that?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...