Splunk Search

How do I calculate application availability based on status code?

mahenders
New Member

How do you calculate application availability in minutes based on a status code? I want to determine the outage if 50% of the events gives status codes of 400 & 500 in a 5 minute span. And then, finally, add just minutes to capture the total outage daily, weekly or monthly.

Below shows the status as healthy and unhealthy. How can I calculate the duration of outage?

Failure|| eval Health=case((status>399 ), "UnHealthy", (status<399), "Healthy")| eventstats count(eval(Health="Healthy")) as "success_count" by uri_path| eventstats count(eval(Health="UnHealthy")) as "unsuccess_count" by uri|stats values(success_count) as "Healthy" values(unsuccess_count) as "Unhealthy" by uri_path| stats sum(Unhealthy) as "overallstatus"|eval sloAlertLevel=case(overallstatus >= 9, "IMPACTED", overallstatus >=5 AND overallstatus <=9, "WARNING",overallstatus <=2, "HEALTHY") 
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...