Splunk Search

How to reflect Disabled Data Input with some description in search results

ak9092
Path Finder

Hi Guys,

I am trying to figure out how can i represent DISABLED data input which is monitoring a web URL as planned_outage in my search results.

So to simplify, consider following 3 inputs which i am querying using below query to calculate availability and failure percentage.

title= abc,
title= pqr,
title= xyz

sourcetype=web_ping `website_monitoring_search_index`|search title IN(abc, pqr, xyz)| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) | fillnull value=1 success  |stats count as total, sum(success) as successes by title| eval availability=round(100*(successes/total),2)  |eval failures=(100-'availability') | stats count by title availability failures

This query seems to be working perfectly and giving desired results but when I disable any data input for planned outage, then that input completely disappears from the search results as if it is not monitored at all ..leaving us with no real-time data to represent on Dashboard.

So what I am trying to figure out is, is there anyway that i can overcome this issue by modifying the query and/or creating a lookup file to compare the title's and render the disabled input as planned outage in the search results.

All my efforts to achieve this so far has failed. Can someone please help me figure out if there is any possible way to achieve this.

Thanks in advance.

0 Karma
1 Solution

darrenfuller
Contributor

if there is a static list of titles, you could add something like this to your query :

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| makeresults 
    | eval title="abc|pqr|xyz" 
    | makemv title delim="|" 
    | mvexpand title 
    | fields - _time] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

if that works for you , perhaps add the list to a lookup and append that.

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| inputlookup LOOKUPNAME | table title ] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

View solution in original post

darrenfuller
Contributor

if there is a static list of titles, you could add something like this to your query :

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| makeresults 
    | eval title="abc|pqr|xyz" 
    | makemv title delim="|" 
    | mvexpand title 
    | fields - _time] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

if that works for you , perhaps add the list to a lookup and append that.

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| inputlookup LOOKUPNAME | table title ] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

ak9092
Path Finder

Great .. That helped.. Thanks a lot!

0 Karma

darrenfuller
Contributor

are the list of titles known, or are they dynamically changing?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...