I tried it and find by host, but id didn't work
host="host_name" | bucket _time span=1m| stats count by _time | where count = 0 | stats sum(count) AS NumMinutesWithNoData
Also tried asterisk, but to no avail...
* | bucket _time span=1m| stats count by _time | where count = 0 | stats sum(count) AS NumMinutesWithNoData
Is there something I missed?
No, there is something I missed, which is that
stats does not pass along empty buckets but
timechart does, so try this:
host="host_name" | timechart span=1m count | where count = 0 | stats sum(count) AS NumMinutesWithNoData
Unfortunately, it's still not returning anything. I even deleted "where count=0" to count those that are able to send, but still it returns nothing. Maybe at that specific minute, the forwarder did not send anything? is there like a duration in between 1 minute? There could be cases when the forwarder forwards data by 1m:15secs.
If you are not getting anything from
host="host_name" | timechart span=1m count then there is nothing more to say. There is something wrong with your question or your search. The
timechart based solution should work just fine.
Not knowing your role, just a quick note.... maybe you're not searching the desired indexes by default, so you can add index=* to your base search too. If you're literally not getting any results at all and you expect at least something, then that might be the issue.