Hi All, in Splunk xenapp deashboard user experiace and server performance data is not visible, in deatils we observed that no data available with sourcetype=perfmonmk.
... View more
sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events, sum(up_int) as num_up by server| eval uptime=num_up*100/num_events|fields server uptime
... View more
thanks dwaddle,
i have modified above search to
sourcetype=result| eval up_int=if(status="Up",1,0)| stats count as num_events , sum(up_int) as num_up| eval uptime=num_up*100/num_events
result:
num_events num_up uptime
1 366 305 83.333333
how can we get the result by server
... View more
8/27/12 10:24:04.000 AM server=Test and status=Up host=test1
8/27/12 10:24:04.000 AM server=test1 and status=Up host=test1
8/27/12 10:24:04.000 AM server=test2 and status=Down host=test1
8/27/12 10:24:00.000 AM server=test3 and status=Up host=test1
8/27/12 10:23:04.000 AM server=test4 and status=Down host=test1
i tried running the query:
sourcetype="result"| stats count as num_events , count(eval(status=Up)) as upevent by server
but not working as expected, unable to get the numbers of up event and total events together
... View more