Calculate availability as percent per month

[JYTTEJ]

I have following search which calculates seconds UNavailablity:

host=psdkxp* FMT=IOSTAT* APP=TMA PRJ=IPSMON RCD=0 | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >150 |TABLE STM timeDeltaS timeDelta |RENAME timeDeltaS as Sec_unavailable timeDelta as hh:mm:ss_unavailable

I would like to have a search which gives me the percent availability by month - and preferably also YTD.

The calculation should be as follows: Number of days in month * 24 * 60 *60 = TOTAL seconds by month.
Availability calculated as: TOTAL seconds by month minus unavailability seconds divided by total seconds by month.

Example:

TOTAL seconds in April: 31*24*60*60 = 2678400 seconds
Unavailability April = 5 seconds
((2678400-5)/2678400)*100=99.99%

Question 1: How do I do this in a search?

Question 2: There are different number of days in the months - how do I manage this?

Question 3: How do I make a YTD summary availability?

Thank you in advance for your help!

[dwaddle · Accepted solution]

I think I can answer questions 1 and 2. You can use eval and its friends to compute this in a search. The following eval expression will give you the # of seconds in a month for the month that an event occurs in:

... | eval seconds_in_month=(relative_time(_time,"@mon+1mon")-relative_time(_time,"@mon"))

You should be able to use an additional eval to calculate your percent-availability. http://www.splunk.com/base/Documentation/latest/SearchReference/Eval

On further thought, YTD might be possible using a similar approach:

... | eval seconds_ytd = (_time - relative_time(_time,"@y"))

[JYTTEJ]

thanks! that was very useful!