How to combine two searches to evaluate uptime percentage?

[brywilk_umich]

Hello,

I have nagios feeding data into splunk. The below searches give me ping (up, down) and a service check (ok, critical). While the separate searches seem to work great, I would like to combine them and have a overall uptime percentage for availability, and in the future will likely add more nagios checks to combine. Both searches have a similar Server field.

index=nagios perfdata="HOSTPERFDATA" tag::src_host=collaboration hoststate | eventstats count as "totalCount" | eventstats count as "choiceCount" by hoststate | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by hoststate

index=nagios name="check__smtp" AND perfdata="SERVICEPERFDATA" tag::src_host=collaboration | eventstats count as "totalCount" | eventstats count as "choiceCount" by severity | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by severity

thanks.

[somesoni2 · Accepted solution]

Assuming host=down and severity=critical means host was not available, then try this.

index=nagios  tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check__smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="down" OR severity="critical","Unavailable","Available" | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count as totalCount | eval percentAvailable=(unavailCount/totalCount)*100 | table percentAvailable

[brywilk_umich]

Never mind I did a stats on Available and based the percentAvailable off of that.....

thanks again!

[brywilk_umich]

Found 1 little flaw, the percent available comes out to 0 if their arent any unavailable events. Any thoughts on fixing that?

[brywilk_umich]

Awesome looks like that did the trick after a small tweak!