How to count and chart by minute an error exists, not the count of the number of errors? (ex: each minute = 1 count)

[subtrakt]

Hi,

Anyone know what's the best way to count by minute the error exists, and not by the count of the number of errors?

I'm looking for the duration of errors and don't care about the volume. Each minute = 1 count

So an issue lasting 7 minutes has a count of 7.

Would that be with the eventstats command?

[woodcock]

Let us assume that you have an status field that says either "Fail" or "Clear" (it could be "OK" or "Bad" or whatever; it doesn't really matter). You can do it like this:

... | streamstats current=f last(_time) AS nextTime by host | eval secondsInCurrentState = nextTime - _time | eval minutesInCurrentState = round(secondsInCurrentState /60, 0) | where status="Fail" | timechart span=1h count by minutesInCurrentState

This shows how many errors started in each hour of the day and counts them in buckets of minutes-of-duration. I believe that this is what you were asking but if it is not exactly, it should get you close.