topic Re: Query to check the indexer is down, up or in unknown state in Monitoring Splunk

Query to check the indexer is down, up or in unknown state

Praz_123 — Wed, 12 Mar 2025 06:46:25 GMT

Is there is any Query to check whether the indexers status is down, up or in unknown state .

I can check in monitoring console but need a query to see for all indexer.

Re: Query to check the indexer is down, up or in unknown state

livehybrid — Wed, 12 Mar 2025 07:24:57 GMT

Hi @Praz_123

You could try running

| rest /services/server/info | table serverName, server_roles, status

This query uses the rest command to access the Splunk REST API endpoint that provides information about the servers in your Splunk deployment. The server_roles field will help you identify which servers are indexers, and the status field will show their current status.

If you want to specifically check the health of your indexers, you can use the following query:

| rest /services/server/status/health/overview
| search title="Indexer"
| table title, health, messag

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Query to check the indexer is down, up or in unknown state

gcusello — Wed, 12 Mar 2025 08:49:20 GMT

Hi @Praz_123 ,

you can use the correct searches of @livehybrid or a simple:

eventually you can replace the append commands with a lookup containing the list of servers to monitor

Ciao.

Giuseppe

Re: Query to check the indexer is down, up or in unknown state

Praz_123 — Thu, 13 Mar 2025 06:52:50 GMT

@livehybrid @gcusello

Thanks for your help but I created a query which shows me the required results

| rest /services/server/introspection/indexer
| where match(splunk_server, "indexer")
| eval status = if(status == "normal", "up", "down")
| table splunk_server, status

Re: Query to check the indexer is down, up or in unknown state

gcusello — Thu, 13 Mar 2025 07:57:34 GMT

Hi @Praz_123 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉