topic How to find out Server Uptime & Downtime in Splunk Search

How to find out Server Uptime & Downtime

jaibalaraman — Mon, 14 Oct 2024 23:53:35 GMT

Hi All

I am trying to find out Server Up time & Downtime or offline

However i am using the below command which i am not getting what i want

| mstats max(System.System_Up_Time) AS "Uptime" WHERE index="permon_metrics" host=system1* BY host span=1m | dedup host | rex field=host "\w{6}(?<function_abbr>\w{4})" | search function_abbr=ADDS | sort Uptime asc | eval Uptime = round((now() - _time) / (60 * 60), 1) | search Uptime="4.0"

I would like to see the output in a single tile like HH:MM:SS

Re: How to find out Server Uptime & Downtime

inventsekar — Tue, 15 Oct 2024 00:18:50 GMT

Hi @jaibalaraman

You have a field "Uptime" and then using the eval you are calculating the same field.
Could you pls suggest us with more details, thanks.

| mstats max(System.System_Up_Time) AS "Uptime" WHERE index="permon_metrics" host=system1* BY host span=1m | dedup host | rex field=host "\w{6}(?<function_abbr>\w{4})" | search function_abbr=ADDS | sort Uptime asc | eval UptimeNew = round((now() - _time) / (60 * 60), 1) | table Uptime UptimeNew function_abbr host

Re: How to find out Server Uptime & Downtime

jaibalaraman — Tue, 15 Oct 2024 00:26:28 GMT

Sorry what information are you looking for

Re: How to find out Server Uptime & Downtime

inventsekar — Tue, 15 Oct 2024 02:14:33 GMT

1) >>> I am trying to find out Server Up time & Downtime or offline
the logs got a field "Uptime", may i know if the unit is seconds?

2) how to find out the downtime or offline?

3) this command will give you number of hours before the logline was received

| eval Uptime = round((now() - _time) / (60 * 60), 1)

pls suggest us how you like to use this value

4) may i know why you use the

| search Uptime="4.0"