I understood what you had explained. It will be helpful if you write that in sample query. My sample code. but downtime is not calculated. index=network | streamstats sparkline(avg(avg_ping)) as sparkline_ping avg(avg_ping) as ping max(max_ping) as max_ping latest(packet_loss) as packet_loss latest(_time) as last_checked range(avg_ping) as range min(avg_ping) as min by dest current=f | search | eval ping=round(ping, 0)." ms" | eval average=round(avg_ping, 0)." ms" | eval maximum=round(max_ping, 0)." ms" | eval range=round(min, 0)." - ".round(min+range, 0)." ms" | eval packet_loss=if(max_ping="NA",100,packet_loss) | table dest packet_loss last_checked ping max_ping range sparkline_ping | `timesince(last_checked,last_checked)` | sort -ping | lookup server_detail "Asset CI" as dest OUTPUTNEW "RDP IP" "Environment Specification" Category "Operating System" | eval Status = case(packet_loss = "100","Down",packet_loss = "0","Up") | eval Availability= case(packet_loss = "100",100,packet_loss = "0",0) | stats avg(Availability) by dest | sort +avg(Availability)
... View more