Splunk Search

Calculate percent of missing events

Cuyose
Builder

I swear I have done this before but I want to use the existence of events from a log file to calculate if the service writing them is up.

If I search over last 24 hours and there are events listed up until 12 hours ago, it would be 50% uptime. Problem is that the 12 hours when there are no logs are ignored and I cant remember how to count empty time buckets to make the calculation.

Now obviously I could use a latest if I only ever wanted to calculate things currently down, but I want to be able to sum all the time buckets where logs dont exist to the ones where they do.

0 Karma
1 Solution

Cuyose
Builder

I was able to finally figure out the right search to get what I needed. For any one coming across this, this solved my issue.

https://answers.splunk.com/answers/409513/how-to-edit-my-search-to-calculate-time-availabili.html

View solution in original post

0 Karma

Cuyose
Builder

I was able to finally figure out the right search to get what I needed. For any one coming across this, this solved my issue.

https://answers.splunk.com/answers/409513/how-to-edit-my-search-to-calculate-time-availabili.html

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...