About janoonan

janoonan · ‎04-17-2015

I was able to find an answer. Thanks all for you help. This provides a chart which shows me how many consecutive fails occur each day (well, timechart span, but day by default). search | sort _time | streamstats count as a_seq_num | search status=SUCCESS | delta a_seq_num AS a_not_successful_builds | eval answer=a_not_successful_builds-1 | timechart max(a_not_successful_builds) So, first, let's ensure that everything has a sequence number. Next, get rid of the failures with the next search. Now, find the difference between two sequence numbers. So, let's say we have: S,S,SF,F,F,S,S,S Then, we have seq_num, 1,2,3,4,5,6,7,8,9 Now, remove the F's : 1,2,3,7,8,9 Now, delta: 1,1,1,4,1,1 Subtract 1: 0,0,0,4,0,0 After that, it's formatting. I'm happy. I am interested in other solutions. The search at the start means that I cannot combine results with a BY e.g. - | timechart max(a_not_successful_builds) by filter_term does not work, because the seq_nums are not right....though, I could sort by two criteria. 🙂

janoonan · ‎04-16-2015

I tried both of these, but neither were successful. I've used a transaction to produce a better result: | transaction status maxpause=90m | search status=FAILURE and now eventcount seems to give me the number of fails in a row.. Except that the maxpause is not exactly right. The events can occur many hours apart - though are normally one hour apart. Ideally, I'd prefer to say 'startswith=FAILURE' and endswith=SUCCESS, though this hasn't worked yet. When I try it, I get two transactions, one with all of the successes, the other with the failures.

janoonan · ‎04-15-2015

Hi: I'm trying to count a sequence of events. Our events have a field status that can be either 'SUCCESS' or 'FAILURE'. I would like to be able to track the number of consecutive successes, and failures. So, if we go SSSSFFFSSSSF, that's 123400012340, or 0000123400001. The motivation is to show how long it takes us to change a Failure into Success. I have the following, but the numbers don't grow. | sort _time | fillnull a_last_value | eval a_success_flag=if(status="SUCCESS", 1, 0) | streamstats last(a_last_value) AS a_tmp_last | eval a_last_value=(a_tmp_last+a_success_flag)*a_success_flag ( a_tmp_last is always 0, a_success_flag 1 or 0 (that's good) and a_last_value is also 0 or 1) Thanks

janoonan · ‎03-25-2015

I'm going to suggest this is a bug, and I believe I've a workaround. I wonder if I've missed something. My JSON is of form attr=true or attr=false, and I want to put this into a graph. However, it's a little bit down, so it's global.container.attr So, I have: | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm Which works, and provides true or false, but I would prefer "attr" or "opposite" (for the opposite of attr). | expr if(global.container.attr==true, "attr", "opposite") | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm would always equal 'opposite'. What I found would work was to rename before hand.. | rename global.container.attr AS tmp | expr if(tmp==true, "attr", "opposite") | .... (and so on). this might help someone else, and there may be a better way.

Posts	4
Solutions	1
Karma Given	1
Karma Received	2
Member Since	‎02-17-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to count a sequence of events to track the num...

How to use eval on JSON data

Re: How to count a sequence of events to track the...

Re: How to count a sequence of events to track the...

How to count a sequence of events to track the num...

How to use eval on JSON data