Hi,
We are trying to calculate the total system down time in minutes in a tabular format using the below query
sourcetype="nodecheck" | rex "System (?<upordown>.*)" | dedup upordown consecutive=true sortby +_time
| transaction startswith="System Up" endswith="System Down*" | EVAL Outage(Minutes)=ceiling(duration/60)
| TABLE _time Outage(Minutes) | rename _time as DownTimeStart | convert ctime(DownTimeStart)
| addcoltotals labelfield=Outage(Minutes) | fillnull value="Total"
But, somehow we are unable to combine these two types of system down logs "System Down" & "System Down - Unable to connect to the Database!" in our total calculation of outage. It somehow just takes the "System Down" into consideration. Below is the data set.
we are unable to use OR clause in the endswith utility under transaction.
2014-03-17 15:42:01-System Up
2014-03-17 15:37:01-System Up
2014-03-17 15:32:41-System Down
2014-03-17 15:25:01-System Down - Unable to connect to the Database!
2014-03-17 15:15:01-System Down - Unable to connect to the Database!
2014-03-17 15:05:02-System Down - Unable to connect to the Database!
2014-03-17 14:52:01-System Up
2014-03-17 14:47:01-System Up
2014-03-17 14:42:01-System Up
... View more