Splunk ITSI

I had a issue with Splunk server Availability Query. Can anyone check and correct me?

Rajasekhar90
New Member

Hi All,

I had a issue with Splunk server Availability Query. Can anyone check and correct me?

index=itsi_summary kpi="Splunk Agent Availability" NOT "entity_title=service_aggregate"
| eval test = replace(alert_value, "N.A", "1")
| stats sum(test) as off dc(date_mday) as day by entity_title
| eventstats max(day) as max_day
| eval max = max_day*1440
| eval server_off = off*5
| eval percent_off = (server_off / max) * 100
| eval percent_on = 100 - percent_off
| table entity_title, percent* day server_off
| rename entity_title as Host percent_off as "Unavailability Percentage" percent_on as "Availability Percentage" day as "Number of running days" server_off as "Server Unavailable in Minutes"

Thanks in Advance!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What results are you getting and what are the expected results?

---
If this reply helps you, Karma would be appreciated.
0 Karma

rajasekharsplun
Engager

I didn't find the results. I want to see the results till date. Any changes need to done in query?

Regards,
Raj

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's difficult to determine the correctness of a query without knowing the data being searched as well as the desired output.

There are, however, some problems with the query. Some may be the result of errors entering the query into the question.

The table command makes only 4 fields available, but the following rename command attempts to rename two fields that no longer exist (percent_off, percent_on).

The base query is searching for the string "entity_title=service_aggregate". Perhaps it intends to search for the field entity_title containing the value "service_aggregate" (entity_title="service_aggregate").

The calculation of percent_off is missing a * character.

The field server_off claims to be in minutes, but is multiplied by 5 for no apparent reason.

Please verify the alert_value field contains "N.A" and not "N/A".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...