Splunk Search
Highlighted

Planned outage graph logic

Path Finder

I want to build a logic for SEARCH-2

My SEARCH -1
Gives me start and End time stamp of a Planned Outage.

My SEARCH-2
Gives me the availaiblity graph of my server.
Now in the availibility graph, if the timestamp is in the time range of planned outage (given by search 1) than I should mark that as "planned outage" (so that no one is confused whether its planned or an actual outage).

index=avail sourcetype=availaibility | if availaibility == 0 | check if the time of event is in the time range given by SUB SEARCH ""My Search 1

0 Karma
Highlighted

Re: Planned outage graph logic

SplunkTrust
SplunkTrust

Hi @joydeep741,
Try something similar,

index=_* earliest=-4h@h|bucket span=1h _time|stats count by component,_time|eval time=_time|eval status=if(count>100,1,0) 
|appendcols [search index=_* earliest=-3h@h latest=-1h@h|stats earliest(_time) as earliest,latest(_time) as latest|fields earliest,latest]| filldown
|eval maintenance=if(_time>=earliest AND _time <= latest,1,0)

Here I take last 4 hours of data and compare it against a planned maintenance of 1 hr (between 3rd and 2nd hour). Do you have data in two different indexes? If the above doesnt work for you, please provide some sample data from both searches

0 Karma
Highlighted

Re: Planned outage graph logic

Path Finder

My two searches are from 2 different indexes.

0 Karma
Highlighted

Re: Planned outage graph logic

SplunkTrust
SplunkTrust

@joydeep741,

That does not matter. Above is just an example. you could write your searches in the same way or if you could provide some sample events from both indexes, we could help you

0 Karma
Highlighted

Re: Planned outage graph logic

Legend

@joydeep741, if you are on Splunk 7+, seems a good candidate for Chart Event Annotation

Otherwise approach would be similar to what @renjith.nair mentioned. Refer to following old but useful blog on overlaying information on timechart: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html




| eval message="Happy Splunking!!!"


0 Karma