Planned outage graph logic

[joydeep741]

I want to build a logic for SEARCH-2

My SEARCH -1
Gives me start and End time stamp of a Planned Outage.

My SEARCH-2
Gives me the availaiblity graph of my server.
Now in the availibility graph, if the timestamp is in the time range of planned outage (given by search 1) than I should mark that as "planned outage" (so that no one is confused whether its planned or an actual outage).

index=avail sourcetype=availaibility | if availaibility == 0 | check if the time of event is in the time range given by SUB SEARCH ""My Search 1

[niketn]

@joydeep741, if you are on Splunk 7+, seems a good candidate for Chart Event Annotation

Otherwise approach would be similar to what @renjith.nair mentioned. Refer to following old but useful blog on overlaying information on timechart: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html

[renjith_nair]

Hi @joydeep741,
Try something similar,

index=_* earliest=-4h@h|bucket span=1h _time|stats count by component,_time|eval time=_time|eval status=if(count>100,1,0) 
|appendcols [search index=_* earliest=-3h@h latest=-1h@h|stats earliest(_time) as earliest,latest(_time) as latest|fields earliest,latest]| filldown
|eval maintenance=if(_time>=earliest AND _time <= latest,1,0)

Here I take last 4 hours of data and compare it against a planned maintenance of 1 hr (between 3rd and 2nd hour). Do you have data in two different indexes? If the above doesnt work for you, please provide some sample data from both searches

[joydeep741]

My two searches are from 2 different indexes.

[renjith_nair]

@joydeep741,

That does not matter. Above is just an example. you could write your searches in the same way or if you could provide some sample events from both indexes, we could help you