Splunk Search

How to calculate SLA?

Sekhar
Explorer

my query below

(Index=x source=xtype valid) or (index=y source= ytype  passed) | eval which=if(match(_raw, " valid"),"valid", "passed") | stats values( which) as msg by manid |  stats count(eval(msg=" valid")) as total_ count count(eval(msg= "passed"))   

getting  out like total count 54 respons count 58

But i want check this condition too 

Eval msgconur = mvcount(msg) | where >1 

Need to check duration time > 30 count duration time <30 count 

 

Labels (1)
0 Karma

Sekhar
Explorer

My SLA calculating  like this 100-(count of duration<30/total count)*100

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

| stats values( which) as msg count(eval(duration>30)) as gt30 count(eval(duration<30) as lt30 by manid | where mvcount(msg) > 1

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...