topic Re: How to get instance health via splunk query in Monitoring Splunk

How to get instance health via splunk query

santosh12 — Thu, 09 Nov 2017 11:23:32 GMT

Hi All,

I have 10 instances running 3 search head, 3 indexer, 1 monitoring console, 1 license manager, 1 deployment manager and 1 index master. How can we get all the instances and there status whether they are up and running or they are down via splunk query?

I know we can check in monitoring console but we need via query.

Regards,
Santosh.

Re: How to get instance health via splunk query

harsmarvania57 — Thu, 09 Nov 2017 12:30:25 GMT

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

Re: How to get instance health via splunk query

shaunpaul — Thu, 09 Nov 2017 12:39:05 GMT

I don't have an idea about this idea I am a student and currently working in Australian.So many stress because I have an assignment writing service leading firm.But this idea helps me for making an assignment.

Re: How to get instance health via splunk query

santosh12 — Tue, 14 Nov 2017 08:51:55 GMT

Thanks Harshil it worked for me.

Regards,
Santosh.

Re: How to get instance health via splunk query

emafront — Fri, 04 May 2018 10:27:09 GMT

Hi,
to display the localhost entry, you must use append instead of outer join since left and outer are the same thing in splunk.
See doc: http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Join

Re: How to get instance health via splunk query

splunkreal — Tue, 18 Jun 2019 22:38:45 GMT

It works from search head, Splunk Enterprise V7.1.4

Re: How to get instance health via splunk query

MargoAdams — Tue, 25 May 2021 06:42:11 GMT

I don't know, because I'm not professional in this area. I am a student and I have complicated task. I'm ready to buy a coursework paper from reliable writing company.