Splunk Search

How to reflect Disabled Data Input with some description in search results

ak9092
Path Finder

Hi Guys,

I am trying to figure out how can i represent DISABLED data input which is monitoring a web URL as planned_outage in my search results.

So to simplify, consider following 3 inputs which i am querying using below query to calculate availability and failure percentage.

title= abc,
title= pqr,
title= xyz

sourcetype=web_ping `website_monitoring_search_index`|search title IN(abc, pqr, xyz)| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) | fillnull value=1 success  |stats count as total, sum(success) as successes by title| eval availability=round(100*(successes/total),2)  |eval failures=(100-'availability') | stats count by title availability failures

This query seems to be working perfectly and giving desired results but when I disable any data input for planned outage, then that input completely disappears from the search results as if it is not monitored at all ..leaving us with no real-time data to represent on Dashboard.

So what I am trying to figure out is, is there anyway that i can overcome this issue by modifying the query and/or creating a lookup file to compare the title's and render the disabled input as planned outage in the search results.

All my efforts to achieve this so far has failed. Can someone please help me figure out if there is any possible way to achieve this.

Thanks in advance.

0 Karma
1 Solution

darrenfuller
Contributor

if there is a static list of titles, you could add something like this to your query :

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| makeresults 
    | eval title="abc|pqr|xyz" 
    | makemv title delim="|" 
    | mvexpand title 
    | fields - _time] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

if that works for you , perhaps add the list to a lookup and append that.

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| inputlookup LOOKUPNAME | table title ] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

View solution in original post

darrenfuller
Contributor

if there is a static list of titles, you could add something like this to your query :

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| makeresults 
    | eval title="abc|pqr|xyz" 
    | makemv title delim="|" 
    | mvexpand title 
    | fields - _time] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

if that works for you , perhaps add the list to a lookup and append that.

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| inputlookup LOOKUPNAME | table title ] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

ak9092
Path Finder

Great .. That helped.. Thanks a lot!

0 Karma

darrenfuller
Contributor

are the list of titles known, or are they dynamically changing?

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...