topic Re: EC2 instance uptime monthly basis in Splunk Search

EC2 instance uptime monthly basis

samindradey — Mon, 18 Dec 2017 10:27:21 GMT

The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to develop a report which will display how much hours an EC2 instance was up and down in a month. Please suggest if it is possible through Splunk or not?

Re: EC2 instance uptime monthly basis

nickhills — Mon, 18 Dec 2017 15:49:47 GMT

I would start by installing the Splunk App for AWS (and the TA, as per the instructions)
http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Installon-prem
This app, among other things, will collect events and actions taken on all your AWS resources and will allow you to search and filter them by tag/name/instance/id/Az/region etc.
You will also get access to the very comprehensive billing prediction and breakdown tools - not to mention user auditing, and performance metrics.

To directly answer your question, you will be able to see exactly how many hours each machine has been running.

Re: EC2 instance uptime monthly basis

samindradey — Tue, 19 Dec 2017 06:22:41 GMT

Thanks! I am able to search the instances but in a month how many hours the instance was up and down is not able to create as a report. Can you please help?

Re: EC2 instance uptime monthly basis

samindradey — Tue, 19 Dec 2017 06:24:24 GMT

Thanks! I am able to search the instances but not able to create a report which will show how long the instance was up and down in a month. Can you please help?

Re: EC2 instance uptime monthly basis

nickhills — Tue, 19 Dec 2017 08:31:42 GMT

You can run a search like this:

`aws-description-sourcetype` source="*:ec2_instances"  (aws_account_id="*")   (region="*")  state="running" | timechart count(id) minspan=1h by instance_type

which will give you a chart of instances running by type (remove the by instance_type) to get a total.

If your interested in the costs of these instances, you can modify one one the dashboard panels to restrict your search to ec2, and use something like this, to show you costs this month vs last:

`aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`|search AmazonEC2 
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "This Month"
                            | appendcols [ search earliest=-mon@mon latest=-mon `aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "Last Month"]
                            | fields _time "Last Month" "This Month"

Take a look at the dashboard panels available in the app, as these provide a great starting point for any queries you want to refine.