How can I quantify the intermittent failure of a regular event?

[dreeck]

My logs contain records of scheduled events. Sometimes the events fail, usually in 1 of 2 modes: systematic - once they fail they always fail (until corrected) or intermittent (they fail, the succeed, succeed, succeed, then fail fail fail then succeed). I'd like to produce a report that shows
- per time period (say a day)
- for all events belonging to a schedule
- how intermittently are the scheduled events failing
- what percentage of events are failures

For example
For 1/1/2016
Schedule #1728 70% success 0% itermittency (for a schedule in which 30% of events were failures, and once the failures start they never stop)
Schedule #1821 70% success 100% intermittency (for a schedule in which 30% were failures, and after every failure the next event was a success)

[sundareshr · Accepted solution]

See if this gets your going

base search | eval score=if(status="success", 1, 0) | streamstats window=1 current=f values(score) as nscore by schedule | streamstats count(eval(score=nscore)) as c by schedule | stats count count(eval(status="success")) as success count(eval(status="fail")) as fail max(c) as inter by schedule | eval s_perc=success/count*100 | eval f_perc=fail/count*100 | eval i_perc=inter/fail

Basically, the higher the value for inter, the higher the intermitancy

[dreeck]

This is generating results for me, but I had to mess around a bit to get my JSON fields evaluated. Tip: for a JSON field, enclose the field name in single quotes, and the value in double quotes. eval score = if('json.field1'="banana", 1, 0) works. eval score = if(json.field1=banana, 1, 0) don't.