topic Re: how to get when server goes down status. in Splunk Search

How to get when server goes down status?

Anud — Thu, 01 Jun 2023 14:08:34 GMT

HI Team,

I want to get when server goes down time.

MY output want to display server down at 12:45

6/4/2023 12:45

down

Thanks in Advance..!!

gcusello — Thu, 01 Jun 2023 13:14:14 GMT

the search depends on your events.

If in each event there's the status field, you could run something like this:

index=your_index | stats last(status) AS status BY host | search status="Down"

and schedule this search as an alert.

Ciao.

Giuseppe

Anud — Thu, 01 Jun 2023 13:26:36 GMT

Thanks for the response..!!
This one tried giving all down status but i need when down time started first for the server.

Anud — Fri, 02 Jun 2023 11:12:01 GMT

Hi gcusello,
I want first down time server status, any idea

MY output want to display server down at 12:45

6/4/2023 12:45

down