I would like to calculate availability time based on gaps between logs
so far I have this:
index=servers sourcetype=servers_data HostName=examplehost | streamstats current=f last(_time) as last_time by HostName | eval gap = last_time - _time | where gap > 320 | convert ctime(last_time) as last_time | stats sum(gap) AS Unavailability_sec by HostName | addinfo | eval range = info_max_time - info_min_time | eval Availability= 100 - (Unavailability_sec* 100 / range) | stats count | eval msg = if(count!=0, Availability, "100" ) | table msg
But when it reach gaps means count != 0 then its always showing no results found.
... View more