Hello,
I have nagios feeding data into splunk. The below searches give me ping (up, down) and a service check (ok, critical). While the separate searches seem to work great, I would like to combine them and have a overall uptime percentage for availability, and in the future will likely add more nagios checks to combine. Both searches have a similar Server field.
index=nagios perfdata="HOSTPERFDATA" tag::src_host=collaboration hoststate | eventstats count as "totalCount" | eventstats count as "choiceCount" by hoststate | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by hoststate
index=nagios name="check__smtp" AND perfdata="SERVICEPERFDATA" tag::src_host=collaboration | eventstats count as "totalCount" | eventstats count as "choiceCount" by severity | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by severity
thanks.
Assuming host=down and severity=critical means host was not available, then try this.
index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check__smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="down" OR severity="critical","Unavailable","Available" | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count as totalCount | eval percentAvailable=(unavailCount/totalCount)*100 | table percentAvailable
Assuming host=down and severity=critical means host was not available, then try this.
index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check__smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="down" OR severity="critical","Unavailable","Available" | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count as totalCount | eval percentAvailable=(unavailCount/totalCount)*100 | table percentAvailable
Never mind I did a stats on Available and based the percentAvailable off of that.....
thanks again!
Found 1 little flaw, the percent available comes out to 0 if their arent any unavailable events. Any thoughts on fixing that?
Awesome looks like that did the trick after a small tweak!