okay i  did it  !!!!   | appendpipe [ stats count | where count=0|eval count=100] 🙂 ... View more

@gcusello  one more question  if i get the last field ... .........|table availability as 92.9 it shows in the dashboard, but if its blank then it shows "no results" Can i show it as 100 ? which ideally means theer's no p1 and my service is 100% avialable   i tried with if command --but not working   ...|eval availability=if (availability=0,"100",availability)   its beacuse 0 events are results which ideally means no p1 in servce now  ... View more

@gcusello @ITWhisperer  i'm using this code - My intention is to - 1. Calculate duration (passed from earliest latest tokens in my dashboard - earliest="$time.earliest$" latest="$time.latest$" 2. Calculate Days when service was unavailable 3. Calculate service avialability problem statement : duration is not working -    could you please help me . And thanks a lottt @gcusello  for your code 🙂   index=servicenow earliest="01/07/2021:00:00:00" latest=now() | addinfo | eval duration=round((info_max_time - info_min_time)/3600/24 ,0) | dedup duration | table duration |appendcols [ search index="generic_servicenow" "xxxx" dv_priority="1 - Critical" | dedup dv_closed_at | dedup dv_sys_created_on | timechart partial=f values(dv_closed_at) as endT values(dv_sys_created_on) as startT | fields - _time | sort startT | eval startTime=strptime(startT,"%Y-%m-%d %T.%3Q") | eval endTime=strptime(endT,"%Y-%m-%d %T.%3Q") | eval diff=abs(startTime-endTime)/3600/24 | table endT startT endTime startTime diff | fields diff | stats sum(diff) as unavailability ] | eval availability=round(((duration-unavailability)/duration)*100,2) ... View more

@weidertc thanks 🙂 ... View more

@gcusello @ITWhisperer    Example: We have 2 P1 Incidents’s for AppName: ToolsGra1 in October P1 : 10/23/2021 10:05 am  to 10/23/2021 11:05 am  P1 : 10/25/2021 7:15 am  to 10/23/2021 09:15 am  For October ,we have = 24 hours *30 days =720 hours in the month Total Duration of P1’s for ToolsGra1 for the month=3 hours Availability of ToolsGra1 = ((720-3)/720)*100 =99.58 ... View more

Example: We have 2 P1 Incidents’s for AppName: ToolsGra1 in October P1 : 10/23/2021 10:05 am  to 10/23/2021 11:05 am  P2 : 10/25/2021 7:15 am  to 10/23/2021 09:15 am  For October ,we have = 24 hours *30 days =720 hours in the month Total Duration of P1’s for ToolsGra1 for the month=3 hours Availability of ToolsGra1 = ((720-3)/720)*100 =99.58 ... View more

#1.1 Service Continuity Description: This is a child-view of the Business Parent View. This displays the Availability of applications based on the duration of all P1 incidents for the application in the month.   Data Flow: Example: We have 2 P1 Incidents’s for AppName: ToolsGra1 in October P1 : 10/23/2021 10:05 am  to 10/23/2021 11:05 am  P2 : 10/25/2021 7:15 am  to 10/23/2021 09:15 am  For October ,we have = 24 hours *30 days =720 hours in the month Total Duration of P1’s for ToolsGra1 for the month=3 hours Availability of ToolsGra1 = ((720-3)/720)*100 =99.58 ... View more

#1.1 Service Continuity Description: This is a child-view of the Business Parent View. This displays the Availability of applications based on the duration of all P1 incidents for the application in the month.   Data Flow: Example: We have 2 P1 Incidents’s for AppName: ToolsGra1 in October P1 : 10/23/2021 10:05 am  to 10/23/2021 11:05 am  P2 : 10/25/2021 7:15 am  to 10/23/2021 09:15 am  For October ,we have = 24 hours *30 days =720 hours in the month Total Duration of P1’s for ToolsGra1 for the month=3 hours Availability of ToolsGra1 = ((720-3)/720)*100 =99.58 ... View more

when i am using one token , its working but multiple tokens wen i am selecting using multiselct , its not working ... View more

if i try to do an average , this is the problem, token issue index=idxrod $swap$ $host$ source=Apicessor | table _time host $swap$ | fields - OR | timechart span=$span$ avg($swap$) index=idrod MemoryBuffers MemoryUsedPercent MemoryTotal (host="vgapx5vr") source=Apor | table _time host MemoryBuffers MemoryUsedPercent MemoryTotal | fields - OR | timechart span=1h avg(MemoryBuffers MemoryUsedPercent MemoryTotal) ... View more

used tokens : index=idix_infra_prod $swap$ $host$ source=Apigssor | table _time host $swap$ | fields - OR | timechart span=$span$ count by $swap$ translates to : index=iod MemoryBuffers MemoryUsedPercent MemoryTotal (host="vgapx5vr") source=Apigor | table _time host MemoryBuffers MemoryUsedPercent MemoryTotal | fields - OR | timechart span=1h count by MemoryBuffers MemoryUsedPercent MemoryTotal ... View more

we create fields to tokens , here i want to create fields /colomns for each token value ... View more

the results i am getting under host are values for the token host . but memory* and Swap* are the field names i am [passing as tokens . And i want to display their values for each host . is there a way to create a new field for each token ...like $1=memoryfree , $2=swapfree and i can display | table host $1 $2 ... View more

@niketn index=idx_aprod (SwapFree OR MemoryTotal*) (host="*") source=Apigssor | table _time host MemoryTotal SwapFree Problem is : multiselct tokens: these are fields : (SwapFree OR MemoryTotal*) host is a field : (host="") host i can display as stats table , but when i am passing fields like swap/memory* as tokens how to extract them and display as coloiumn values ... hope u understand...if u wont mind, can u share your phone number My results : _time host MemoryTotal SwapFree 2018-11-13 15:00:02 vgax77vr 16649756672 9793662976 2018-11-13 15:00:02 vgax29vr 16649756672 9746841600 2018-11-13 15:00:01 vgax22vr 16649756672 10090438656 2018-11-13 15:00:02 vgax78vr 16649756672 9784999936 2018-11-13 15:00:01 ... View more

i mean these token values are my fields in my index so if i am using a multiselect to select (swapmemoryfree OR swapmemorycached) then passing them as a token value to my panel.. how can i display values of swapmemoryfree , swapmemorycached as table swapmemoryfree swapmemorycached because these are my fileds in the index and these are passed as one token value pls help ... View more

@niketnilay ... View more

@renjith.nair ... View more