SEARCH | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >150 |RENAME timeDeltaS as Sec_unavailable timeDelta as hh:mm:ss_unavailable |stats sum(Sec_unavailable) as total_unavail| eval seconds_in_month=(relative_time(_time,"@mon-1mon")-relative_time(_time,"@mon-2mon")) |sistats sum(total_unavail), sum(seconds_in_month)
This will return 0 results if we do not have any downtime during the month.
I use following search for the measurement report, in which I calculate the % availability:
index=summary REPORT=xxxxx |eval Month=strftime(_time,"%m") | Stats sum(total_unavail) sum(seconds_in_month) by date_year Month |rename sum(total_unavail) as unavail sum(seconds_in_month) as secmonth |eval avail=secmonth-unavail|eval AvailPct = round((avail/secmonth)*100,2)|chart sum(AvailPct) by Month |RENAME sum(AvailPct) as "Avail.Pct"
This gives following result - if the result of the summary search is <> 0 results.
1 04 99.99
2 06 99.99
The result of the summary search for Month 05 was zero (= no down time) - I would of course like to display the value for Month 05 as 100.00 - how do I accomplish this?