Hi Guys,
I am trying to figure out how can i represent DISABLED data input which is monitoring a web URL as planned_outage in my search results.
So to simplify, consider following 3 inputs whic...
See more...
Hi Guys,
I am trying to figure out how can i represent DISABLED data input which is monitoring a web URL as planned_outage in my search results.
So to simplify, consider following 3 inputs which i am querying using below query to calculate availability and failure percentage.
title= abc,
title= pqr,
title= xyz
sourcetype=web_ping `website_monitoring_search_index`|search title IN(abc, pqr, xyz)| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="",0) | fillnull value=1 success |stats count as total, sum(success) as successes by title| eval availability=round(100*(successes/total),2) |eval failures=(100-'availability') | stats count by title availability failures
This query seems to be working perfectly and giving desired results but when I disable any data input for planned outage, then that input completely disappears from the search results as if it is not monitored at all ..leaving us with no real-time data to represent on Dashboard.
So what I am trying to figure out is, is there anyway that i can overcome this issue by modifying the query and/or creating a lookup file to compare the title's and render the disabled input as planned outage in the search results.
All my efforts to achieve this so far has failed. Can someone please help me figure out if there is any possible way to achieve this.
Thanks in advance.