How to calculate Total Downtime &Uptime duration for Nodes?

[udaypulipaka]

Hi,I have one query that we need to submit node downtime duration report based on node monthly.Every month how much time that node down and how much time it is up.Please help me with the query.Please find the sample log(100 is up ,200 is down)

08/29/2022 10:05:00 +0000,host="0.0.1.1:NodeUp",alert_value="100"             

08/29/2022 10:05:00 +0000,host="0.1.1.1:NodeUp",alert_value="100"

08/29/2022 10:00:00 +0000,host="0.0.1.1:NodeDown",alert_value="200"

08/23/2022 10:10:00 +0000,host="0.0.1.1:NodeUp",alert_value="100" 

08/23/2022 09:55:00 +0000,host="0.0.1.1:NodeDown",alert_value="200"

Example:If node down for 30 min overall in a month different dates.still we need to display hostname along with dowtime(i.e 30min) and remaining uptime duration in one row

Note:Every 5min our Saved search will run and show this log data like above so that time stamp is will be every 5min

[isoutamo]

Hi

you could try something like this

| makeresults 
| eval _raw = "time,host,alert_value,status
08/29/2022 10:20:00 +0000,Node2,100
08/29/2022 10:05:00 +0000,Node1,100
08/29/2022 10:05:00 +0000,Node2,200
08/29/2022 10:00:00 +0000,Node1,200
08/23/2022 10:10:00 +0000,Node1,100
08/23/2022 09:55:00 +0000,Node1,200
| multikv forceheader=1
| eval _time = strptime(time, "%m/%d/%Y %H:%M:%S %z")
```prepare samples, real code is in next lines```
| sort 0 - _time
| transaction startswith=(alert_value="200") endswith=(alert_value="100") host
| stats sum(duration) as duration by host
| eval downtime = tostring(duration, "duration")

 If when there are "open status" within your period (like down, but not up or it's down before period and bring up on period), you must cover somehow.

r. Ismo