How to count a sequence of events to track the number of consecutive SUCCESSes and FAILUREs?

[janoonan]

Hi:

I'm trying to count a sequence of events. Our events have a field status that can be either 'SUCCESS' or 'FAILURE'.

I would like to be able to track the number of consecutive successes, and failures.

So, if we go SSSSFFFSSSSF, that's 123400012340, or 0000123400001. The motivation is to show how long it takes us to change a Failure into Success.

I have the following, but the numbers don't grow.

| sort _time  
| fillnull a_last_value
| eval a_success_flag=if(status="SUCCESS", 1, 0) 
| streamstats last(a_last_value) AS a_tmp_last
| eval a_last_value=(a_tmp_last+a_success_flag)*a_success_flag

( a_tmp_last is always 0, a_success_flag 1 or 0 (that's good) and a_last_value is also 0 or 1)

Thanks

[janoonan · Accepted solution]

I was able to find an answer. Thanks all for you help.

This provides a chart which shows me how many consecutive fails occur each day (well, timechart span, but day by default).
search
| sort _time

| streamstats count as a_seq_num

| search status=SUCCESS

| delta a_seq_num AS a_not_successful_builds

| eval answer=a_not_successful_builds-1
| timechart max(a_not_successful_builds)

So, first, let's ensure that everything has a sequence number.
Next, get rid of the failures with the next search.
Now, find the difference between two sequence numbers.

So, let's say we have: S,S,SF,F,F,S,S,S
Then, we have seq_num, 1,2,3,4,5,6,7,8,9
Now, remove the F's : 1,2,3,7,8,9
Now, delta: 1,1,1,4,1,1
Subtract 1: 0,0,0,4,0,0

After that, it's formatting.

I'm happy. I am interested in other solutions. The search at the start means that I cannot combine results with a BY
e.g. -
| timechart max(a_not_successful_builds) by filter_term
does not work, because the seq_nums are not right....though, I could sort by two criteria. 🙂

[stephane_cyrill]

Hi ,

I think this can help you:

your_search | eval increment_success = 1 + [ search your_search|eval a_success_flag=if(status="SUCCESS", 1, 0) |return $a_success_flag] |eval increment_success =0 +  [ search your_search|eval a_faillure_flag=if(status!="SUCCESS", 0, 0) |return $a_faillure_flag] |table increment_success  _time

Note that you getthe true result of increment _success by removing 1

[janoonan]

I tried both of these, but neither were successful.

I've used a transaction to produce a better result:
| transaction status maxpause=90m | search status=FAILURE

and now eventcount seems to give me the number of fails in a row..

Except that the maxpause is not exactly right. The events can occur many hours apart - though are normally one hour apart.

Ideally, I'd prefer to say 'startswith=FAILURE' and endswith=SUCCESS, though this hasn't worked yet. When I try it, I get two transactions, one with all of the successes, the other with the failures.

[chimell]

Hi jannonan
I think that this search request will help you

......... |foreach status  [eval sta=if(status=="SUCCESS",1,0)]|streamstats sum(sta) as val|eval tu=if(status=="FAILURE",0,met)|table status  tu

Just test it