Hi tmarlette,
this will be tricky to answer without knowing the real data of your events, but I show you some example. Here I assume that the events contain the following data:
time, service_name, service_status
You should have a time field, some service name field and at least one status field if the service is up or down.
Now we start some streamstats -Fu:
yourBaseSearchHere
| streamstats current=false last(service_status) as last_servcie_status last(_time) as time_of_change by service_name
| where service_status!=last_service_status
| eval outage=now()-time_of_change
| eval duration=strftime(outage, "%H:%M")
| rename service_status as current_service_status
| table time_of_change, service, last_service_status, current_service_status, duration
This will show a table with the time of the status changes for each service and how long the time between the status changes was, so you would get not only down time but also up times as well.
Don't nail me on the two eval's for the time operations, it just an example and you would have to adapt to match your real world events.
Hope this helps to get you started ...
cheers, MuS
... View more
