Splunk Search

How to calculate SLA?

Sekhar
Explorer

my query below

(Index=x source=xtype valid) or (index=y source= ytype  passed) | eval which=if(match(_raw, " valid"),"valid", "passed") | stats values( which) as msg by manid |  stats count(eval(msg=" valid")) as total_ count count(eval(msg= "passed"))   

getting  out like total count 54 respons count 58

But i want check this condition too 

Eval msgconur = mvcount(msg) | where >1 

Need to check duration time > 30 count duration time <30 count 

 

Labels (1)
0 Karma

Sekhar
Explorer

My SLA calculating  like this 100-(count of duration<30/total count)*100

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

| stats values( which) as msg count(eval(duration>30)) as gt30 count(eval(duration<30) as lt30 by manid | where mvcount(msg) > 1

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...