How to reflect Disabled Data Input with some description in search results

[ak9092]

Hi Guys,

I am trying to figure out how can i represent DISABLED data input which is monitoring a web URL as planned_outage in my search results.

So to simplify, consider following 3 inputs which i am querying using below query to calculate availability and failure percentage.

title= abc,
title= pqr,
title= xyz

sourcetype=web_ping `website_monitoring_search_index`|search title IN(abc, pqr, xyz)| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) | fillnull value=1 success  |stats count as total, sum(success) as successes by title| eval availability=round(100*(successes/total),2)  |eval failures=(100-'availability') | stats count by title availability failures

This query seems to be working perfectly and giving desired results but when I disable any data input for planned outage, then that input completely disappears from the search results as if it is not monitored at all ..leaving us with no real-time data to represent on Dashboard.

So what I am trying to figure out is, is there anyway that i can overcome this issue by modifying the query and/or creating a lookup file to compare the title's and render the disabled input as planned outage in the search results.

All my efforts to achieve this so far has failed. Can someone please help me figure out if there is any possible way to achieve this.

Thanks in advance.

[darrenfuller · Accepted solution]

if there is a static list of titles, you could add something like this to your query :

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| makeresults 
    | eval title="abc|pqr|xyz" 
    | makemv title delim="|" 
    | mvexpand title 
    | fields - _time] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

if that works for you , perhaps add the list to a lookup and append that.

sourcetype=web_ping `website_monitoring_search_index` 
| search title IN(abc, pqr, xyz) 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100*(successes/total),2) 
| eval failures=(100-'availability') 
| stats count by title availability failures 
| append 
    [| inputlookup LOOKUPNAME | table title ] 
| stats sum(availability) AS availability sum(failures) AS failures sum(count) AS count by title 
| fillnull value=0

[ak9092]

Great .. That helped.. Thanks a lot!

[darrenfuller]

are the list of titles known, or are they dynamically changing?