How to count number of instances when a forwarder is down?

[rongruspe]

I have a forwarder that forwards data every 60 seconds.

I would like to know the count when the forwarder is down (means there's no network and/or the machine is off/no power)

[woodcock · Accepted solution]

Like this:

... | bucket _time span=1m | stats count by _time | where count = 0 | stats sum(count) AS NumMinutesWithNoData

[rongruspe]

I tried it and find by host, but id didn't work

host="host_name" | bucket _time span=1m| stats count by _time | where count = 0 | stats sum(count) AS NumMinutesWithNoData

Also tried asterisk, but to no avail...

* | bucket _time span=1m| stats count by _time | where count = 0 | stats sum(count) AS NumMinutesWithNoData

Is there something I missed?

[woodcock]

No, there is something I missed, which is that stats does not pass along empty buckets but timechart does, so try this:

host="host_name" | timechart span=1m count | where count = 0 | stats sum(count) AS NumMinutesWithNoData

[rongruspe]

Unfortunately, it's still not returning anything. I even deleted "where count=0" to count those that are able to send, but still it returns nothing. Maybe at that specific minute, the forwarder did not send anything? is there like a duration in between 1 minute? There could be cases when the forwarder forwards data by 1m:15secs.

[woodcock]

If you are not getting anything from host="host_name" | timechart span=1m count then there is nothing more to say. There is something wrong with your question or your search. The timechart based solution should work just fine.

[maciep]

Not knowing your role, just a quick note.... maybe you're not searching the desired indexes by default, so you can add index=* to your base search too. If you're literally not getting any results at all and you expect at least something, then that might be the issue.

[woodcock]

Good point, fully qualify your search by adding index= and sourcetype= phrases and maybe it will work.