topic Re: Splunk OS Host Module Server uptime in All Apps and Add-ons

Splunk OS Host Module Server uptime

lloydknight — Mon, 10 Oct 2016 10:08:37 GMT

Is the (top) uptime of the Linux server included in the "Splunk Add-on for Unix and Linux" ?

If not, is there a workaround to show the uptime of the Linux server using "Splunk Add-on for Unix and Linux"?

Thanks!

Re: Splunk OS Host Module Server uptime

hunters_splunk — Mon, 10 Oct 2016 13:52:38 GMT

Hi lloydknight,

Yes, the Add-on for Unix and Linux does include the top sourcetype that captures output from the *nix top command.

Please refer to the following page for a full list of source types included in this add-on:
http://docs.splunk.com/Documentation/UnixAddOn/5.2.3/User/SourcetypesandCIMdatamodelinfo

Hope it helps. Thanks!
Hunter Shen

Re: Splunk OS Host Module Server uptime

lloydknight — Tue, 11 Oct 2016 03:19:56 GMT

Thank you for the link, but I can't seem to find the event/field where the server is up. For example, Server-A's top command is up 132 days, 17:24. Tried searching the 132 days and failed. Is it converted to seconds or something equivalent to 132 days that I am missing? Thanks.

Re: Splunk OS Host Module Server uptime

lloydknight — Tue, 11 Oct 2016 11:18:12 GMT

Hello, already figured this out. I used the process systemd to determine the server's uptime since systemd's process ID is 1. So I am just assuming that systemd daemon is parallel to server's uptime.

Here's my search:

index=os host=* source=ps PID=1 |
stats latest(ELAPSED) AS "DD -
HH:MM:SS" by host | sort - "DD -
HH:MM:SS"