No 100% results

[bullbasin]

I have a report with a table where I am showing uptime availability of various products.  Currently the table is returning only results that fall below 100%.  Makes sense overall but I need all the data.  So I need results with no data to show as 100%.  For the life of me I can not figure it out.  Please all knowing Splunk gods help me.

index=my_data data.environment.application="MY APP" data.environment.environment="test"
| eval estack="my_stack"
| fillnull value="prod" estack data.environment.stack
| where 'data.environment.stack'=estack
| streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId
| eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False")
| transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m
| stats sum(duration) as downtime by data.componentId
| addinfo
| eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0)
| rename data.componentId AS Component, avail AS Availability
| table Component, Availability

[bullbasin]

Alright maybe not enough coffee....I am going in circles trying to get this to display the values in the csv.  Cant figure out what needs to go with the fillnull value.

index=my_data data.environment.application="MY APP" data.environment.environment="test"
| eval estack="my_stack"
| fillnull value="prod" estack data.environment.stack
| where 'data.environment.stack'=estack
| streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId
| eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False")
| transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m
| stats sum(duration) as downtime by data.componentId
| inputlookup append=true Component_avail.csv
| fillnull
| addinfo
| eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0)
| rename data.componentId AS Component, avail AS Availability
| table Component, Availability

[bullbasin]

Figured it out as it was a rename messing me up.

[PickleRick · Accepted solution]

As I understand, you're searching for events meaning that you have an outage/failure. Your 100% uptime would mean that you have no events at all, right?

Well, you can't find something that isn't there so you have to "cheat" a little.

See https://www.duanewaddle.com/proving-a-negative/

[bullbasin]

Ok I guess one last thing.  When the results for the report are 100% across the board.  I don't get any results it is blank.  There seems to be the need for a result below 100% to return all fields again.

[PickleRick]

A quick and ugly hack would be to run your original search (that one calculating availability) and then do

| append [ | inputlookup Component_avail.csv
    | eval Availability=100 ]
| stats min(Availability) as Availability by Component

Alternatively, you can define your lookup to contain both fields - Component and Availability (with Availability set to 100 across the board) and use

| inputlookup append=t Component_avail.csv

and then do the stats.

This way if your original search calculates some non-100% availability you'll get it in your final results. If there is no sub-100 availability calculated, you'll get the static 100 provided by the lookup.