Calculate percent of missing events

[Cuyose]

I swear I have done this before but I want to use the existence of events from a log file to calculate if the service writing them is up.

If I search over last 24 hours and there are events listed up until 12 hours ago, it would be 50% uptime. Problem is that the 12 hours when there are no logs are ignored and I cant remember how to count empty time buckets to make the calculation.

Now obviously I could use a latest if I only ever wanted to calculate things currently down, but I want to be able to sum all the time buckets where logs dont exist to the ones where they do.

[Cuyose · Accepted solution]

I was able to finally figure out the right search to get what I needed. For any one coming across this, this solved my issue.

https://answers.splunk.com/answers/409513/how-to-edit-my-search-to-calculate-time-availabili.html