Splunk Search
Highlighted

How to use streamstats to calculate device availability

New Member

I have some device logs and am trying to determine the outage (downtime) duration. 
Problem I have here is that events are being constantly thrown and I have difficulty capturing the right one to determine the downtime

            FIRSTOCCURRENCE                LASTOCCURRENCE                         SUMMARY
1          2016-10-12 16:11:17              2016-10-12 16:11:17               Interface Down:                              
3          2016-11-06 01:59:14              2016-11-06 01:59:14               Interface Down:              
4          2016-11-06 01:59:14              2016-11-06 01:59:14               Interface Down:               
5          2016-11-06 02:00:01              2016-11-06 02:00:01               Interface Up:     
6          2016-11-06 02:00:01              2016-11-06 02:00:01               Interface Up:     
7         2016-11-08 00:56:09               2016-11-08 00:56:09               Interface Down:               
8         2016-11-08 00:56:09               2016-11-08 00:56:09               Interface Down:  
10         2016-11-08 00:56:09               2016-11-08 00:56:09               Interface Down: 
11         2016-11-08 00:56:55               2016-11-08 00:56:55               Interface Up: 
12         2016-11-08 00:56:55               2016-11-08 00:56:55               Interface Up: 
13         2016-11-08 01:05:55               2016-11-08 01:05:55               Interface Up: 

Difference between The FIRSTOCCURRENCE of the First "Interface Down" and the FIRSTOCCURRENCE of the First "Interface up" is the Total Outage Hours
According to the Example above  :  outage 1 (2016-10-12 16:11:17 - 2016-11-06 02:00:01)  outage 2 (2016-11-08 00:56:09  - 2016-11-08 00:56:55) 

Currently am using transaction command. But it takes the whole outage as outage hours i.e. outage_hours is 2016-10-12 16:11:17 - 2016-11-08 01:05:55

basic search | transaction HOSTNAME, startswith=(SUMMARY="Interface Down:") endswith=(SUMMARY="Interface Up:") keeporphans=true keepevicted=true maxspan=28d

Any suggestions is appreciated !

0 Karma
Highlighted

Re: How to use streamstats to calculate device availability

Communicator

any chance you can adjust the logs to also add the name of the actual interface as a field? You could then try "| transaction hostname interface startswith..."

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.