Splunk Search

How to calculate the downtime duration that a Jboss instance does not process any requests?

Norling80
Path Finder

Hi Guys.

We have a Jboss instance from which we index AccessLogs from, and we expect a fair amount of processes requests on this instance 24/7, I need to be able to calculate "downtime duration" based on the time when this instance does not process any requests, any ideas how to proceed?

Tags (4)

dwaddle
SplunkTrust
SplunkTrust

Here's one way of approaching this. For a "fair amount of requests" we'll make an assumption that you should have at least one request per minute. So any minute that has 0 requests is a "down" minute. To compute the "downtime duration" we count the number of minutes with no requests.

sourcetype = access_combined 
| bucket span=1m _time 
| stats count as requests_per_minute by _time 
| where requests_per_minute  = 0 
| stats count as downtime_duration

Norling80
Path Finder

Thanks a lot 🙂

0 Karma

Norling80
Path Finder

Hey, I just bumped into some problem when with the search you helped out with before. the where requests_per_minute = 0 does not work as expected, I think it´s because if the count is 0 it does not return any result, however if i do where requests_per_minute = 1 it find every single minute where the count is 1.

I changed it to where requests_per_minute < 10 and it founds every minute that has less then 10 events... except for the minutes that have a count = 0.

any ideas how to solve this? The most optimal would be if I could specify a

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...