Splunk Search

Calculate percent of missing events

Cuyose
Builder

I swear I have done this before but I want to use the existence of events from a log file to calculate if the service writing them is up.

If I search over last 24 hours and there are events listed up until 12 hours ago, it would be 50% uptime. Problem is that the 12 hours when there are no logs are ignored and I cant remember how to count empty time buckets to make the calculation.

Now obviously I could use a latest if I only ever wanted to calculate things currently down, but I want to be able to sum all the time buckets where logs dont exist to the ones where they do.

0 Karma
1 Solution

Cuyose
Builder

I was able to finally figure out the right search to get what I needed. For any one coming across this, this solved my issue.

https://answers.splunk.com/answers/409513/how-to-edit-my-search-to-calculate-time-availabili.html

View solution in original post

0 Karma

Cuyose
Builder

I was able to finally figure out the right search to get what I needed. For any one coming across this, this solved my issue.

https://answers.splunk.com/answers/409513/how-to-edit-my-search-to-calculate-time-availabili.html

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>