Splunk Search

How do I calculate application availability based on status code?

mahenders
New Member

How do you calculate application availability in minutes based on a status code? I want to determine the outage if 50% of the events gives status codes of 400 & 500 in a 5 minute span. And then, finally, add just minutes to capture the total outage daily, weekly or monthly.

Below shows the status as healthy and unhealthy. How can I calculate the duration of outage?

Failure|| eval Health=case((status>399 ), "UnHealthy", (status<399), "Healthy")| eventstats count(eval(Health="Healthy")) as "success_count" by uri_path| eventstats count(eval(Health="UnHealthy")) as "unsuccess_count" by uri|stats values(success_count) as "Healthy" values(unsuccess_count) as "Unhealthy" by uri_path| stats sum(Unhealthy) as "overallstatus"|eval sloAlertLevel=case(overallstatus >= 9, "IMPACTED", overallstatus >=5 AND overallstatus <=9, "WARNING",overallstatus <=2, "HEALTHY") 
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...