Splunk Search

## How to edit my search to calculate time availability based on gaps between logs?

New Member

I would like to calculate availability time based on gaps between logs
so far I have this:

``````index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | where gap > 320  | convert ctime(last_time) as last_time | stats sum(gap) AS Unavailability_sec by HostName | addinfo  | eval range = info_max_time - info_min_time  | eval Availability= 100 - (Unavailability_sec* 100 / range) | stats count | eval msg = if(count!=0, Availability, "100" ) | table msg
``````

But when it reach gaps means count != 0 then its always showing no results found.

Tags (3)
1 Solution
Revered Legend

Try this

``````index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | eval Unavailability=if(gap > 320,gap,0)  | addinfo  | eval range = info_max_time - info_min_time | stats sum(Unavailability) AS Unavailability_sec max(range) as range by HostName  | eval Availability= 100 - (Unavailability_sec* 100 / range)
``````

Gives availability per host.

Revered Legend

Try this

``````index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName  | eval gap = last_time - _time | eval Unavailability=if(gap > 320,gap,0)  | addinfo  | eval range = info_max_time - info_min_time | stats sum(Unavailability) AS Unavailability_sec max(range) as range by HostName  | eval Availability= 100 - (Unavailability_sec* 100 / range)
``````

Gives availability per host.

New Member

Thanks! it is working as should 🙂

Get Updates on the Splunk Community!

#### Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

#### Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

#### Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...