I would like to count the number of times a Server went down based on up/down status field.
How can i evaluate multiple(continuous)
down into one
down status, when i am receiving events every five minutes?
down for one host should be treated as one
Time| Server |Status
3:00 AM Host1 up
3:00 PM Host2 down
3:05 PM Host1 up
3:10 PM Host1 up
3:15 PM Host1 down
3:15 PM Host2 up
3:20 PM Host1 up
3:25 PM Host1 down
3:30 PM Host1 up
3:35 PM Host1 up
3:40 PM Host1 down
3:45 PM Host1 down
How can this help me to get the number of the times the server went down in a week?
index=index_names source="rest://" (server="host1" OR server="host2") | stats latest(_time) as Time values(server_state) as status by server _time | dedup server status
Your question was how to evaluate multiple instances of a status value to a single instance. The
dedup command does exactly that.
That doesn't tell you how many times a server went down, just the last time the status changed to Up or Down.