Splunk Host Reporting

scout29 — Wed, 03 Apr 2024 19:08:03 GMT

I am trying to determine a hosts percent of time it logs to splunk within a summary index we created. We have an index called "summary_index" and a field called "host_reported" that shows if a host has been seen in the past hour.

Here is the search i am using to see all hosts in the summary index that were seen within the last 24hrs:

index=summary_index | stats count by host_reported

What i am trying to do is develop a search that shows me what percent of the time over the past 7 days each host has reported to this summary index. So for example if host A only reported to the summary index 6 of the 7 days, i want it to show it's "up time "was 86% for the past 7 days.

Re: Splunk Host Reporting

ITWhisperer — Wed, 03 Apr 2024 16:14:48 GMT

Assuming that your summary index has a single event for each host for each day that it has reported, then you should be able to divide your count (from the stats command you shared) by 7 and multiply by 100 to get the percentage "uptime"

topic Splunk Host Reporting in Reporting

Splunk Host Reporting

Re: Splunk Host Reporting