I have a dashboard where I have 4 multi select boxes and a input file with all possible results for each app. When there are no results for an app it is sent as a 100%. Problem is that the results ...
See more...
I have a dashboard where I have 4 multi select boxes and a input file with all possible results for each app. When there are no results for an app it is sent as a 100%. Problem is that the results have all apps and ignore the multi-select because of the input file. Below is the code....
data.environment.application
data.environment.environment
data.environment.stack
data.componentId
app1
prod
AZ
Acomp
app1
prod
AZ
Bcomp
app2
uat
AW
Zcomp
app2
uat
AW
Ycomp
app2
uat
AW
Xcomp
app3
prod
GC
Mcomp
index=MINE data.environment.application="app2" data.environment.environment="uat"
| eval estack="AW"
| fillnull value="uat" estack data.environment.stack
| where 'data.environment.stack'=estack
| streamstats window=1 current=False global=False values(data.result) AS nextResult BY data.componentId
| eval failureStart=if((nextResult="FAILURE" AND 'data.result'="SUCCESS"), "True", "False"), failureEnd=if((nextResult="SUCCESS" AND 'data.result'="FAILURE"), "True", "False")
| transaction data.componentId, data.environment.application, data.environment.stack startswith="failureStart=True" endswith="failureEnd=True" maxpause=15m
| stats sum(duration) as downtime by data.componentId
| inputlookup append=true all_env_component.csv
| fillnull value=0
| addinfo
| eval uptime=(info_max_time - info_min_time)-downtime, avail=(uptime/(info_max_time - info_min_time))*100, downMins=round(downtime/60, 0)
| rename data.componentId AS Component, avail AS Availability
| fillnull value=100 Availability
| dedup Component
| table Component, Availability
Thank you in advance for the help.