Calculate duration sum of consecutive events with other events in between.

[smahoney]

Haven't been able to find this, but I want to basically calculate up time percentage for a host based on 2 unique events.  One gets logged when something is bad, the other gets logged when everything is fine.  

An example would be to have a host log 10 minutes of "ok" events, then 4 minutes of "bad" events, then 18 minutes of "on" events, etc.

I need to out put the following based on the search range of the query.

Host | total_ok_duration | total_bad_duration | percentage_ok_duration

this need to be run and return for multiple hosts as well.

[PickleRick]

The problem is not well defined. If you simply want ratio of good vs. bad, stats count by state (good/bad) should be enough.

If you have events indicating start/stop of periods of good/bad state it's gonna be harder and you'll have to use streamstats.

[smahoney]

Its the second one, but no streamstats solution provided will work that I have seen.  lets say I have between 40 and 1000 events, any ratio can be good vs bad, with no correlation on how often each good vs bad occurs on a time basis and no set amount that occurs before a transition happens for each host.

That is the problem I have not seen anyone be able to solve.

[PickleRick]

The typical approach to such case is to use streamstats to find last occurrence of different state than it is at given moment (using reset_on_change=t or reset_before/reset_after).

That's probably your only reasonable approach since you need to "carry over" information from some events into other ones and this (along with the autoregress) is the command to do so.

[smahoney]

The problem I am having is adding up all the consecutive durations of each "period" good and bad, when they occur in random lengths repeatedly throughout the time searched.

[_JP]

While not the most efficient command in the book, perhaps the transaction command could be helpful because you can define the start/end events and it will calculate stuff like duration for you of the overall transaction.

Also, this discussion seemed to be similar to yours:

How to calculate uptime percentage based on my dat... - Splunk Community

[smahoney]

Unfortunately that wont work as there can be an unlimited number of consecutive strings of events between the 2 logged events and it needs to calculate the durations of each, which I haven't seen any solutions in the community successfully solve.

[_JP]

It sounds like you will have to build an SPL query using the eventstats  command, or possibly the streamstats command.  Since I can't see your data I'm not sure what would be the best approach, but there is a slight difference between these two commands. 

Eventstats is like the stats command where it looks at all of your events matching found by your query, but it does not transform the stream, it just adds additional fields to every event. For example, you could count your up and bad events using eventstats by host.  Then, each event for that host would have the total counts on every event.  So if there were six up events, and seven bad events for a host, then each of those 13 events would have an up value of six and bad value of seven.

Alternatively, streamstats only looks at events in the stream up to and including the point where you are in the stream - it doesn't know about "future" events in the result set.  This is good for stuff like running average, but has other uses.  So in your case, the first up event would have a count of 1, the second up event a count of two, the first bad event a count of 1, and so on...the last up would have a count of six and the last bad a count of seven.

I know you mentioned duration...you can also add-up the time differences using these commands, too, by doing math on _time.