topic Re: Splunk server uptime - missing Splunk server details in Getting Data In

Splunk server uptime - missing Splunk server details

pbrinkman — Wed, 30 Sep 2020 02:36:43 GMT

Hi all,

I am running the below query, I get responses from some of my Splunk servers but not all ?

Is there anything I am missing on the servers that are not reporting back ?

Cheers
Paul

Re: Splunk server uptime - missing Splunk server details

richgalloway — Mon, 14 Oct 2019 12:56:30 GMT

The rest command is only sent to indexers so only those servers will respond. You will not get any data about search heads and other non-indexer instances.

Re: Splunk server uptime - missing Splunk server details

ivanreis — Mon, 14 Oct 2019 22:53:38 GMT

Please, check this splunk answers, maybe it fits your purposes:
https://answers.splunk.com/answers/105128/how-to-determine-how-long-splunk-has-been-up.html

Re: Splunk server uptime - missing Splunk server details

pbrinkman — Tue, 12 Nov 2019 14:06:22 GMT

cheers for the info richgalloway

Re: Splunk server uptime - missing Splunk server details

coreyCLI — Tue, 01 Dec 2020 17:28:00 GMT

I found this to work from our DMC for all instances. I can see retrieve info for all instances that are search peers of the DMC. Without "splunk_server=*" then I only see the indexers.

| rest splunk_server=* /services/server/info

| table host, startup_time

| eval uptime=tostring(now() - startup_time, "duration")

hope this helps

Re: Splunk server uptime - missing Splunk server details

amatodersp — Wed, 22 Dec 2021 16:42:20 GMT

Thank you, Can confirm that this works as expected. I was also looking for a way to see all of the splunk instances:

Run from the DMC:

| rest splunk_server=* /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S") | eval timenow=now() | eval daysup = round((timenow - startup_time) / 86400,0) | eval Uptime = tostring(daysup) + " Days" | table splunk_server LastStartupTime Uptime

Re: Splunk server uptime - missing Splunk server details

isoutamo — Wed, 22 Dec 2021 19:54:30 GMT

Shortly, you could run rest towards all defined search peers. This is the reason why it works on MC. Basically you could add additional peers (like HFs, currently as indexers) and then get that information from them.