topic Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes? in Splunk Search

How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

idab — Wed, 09 Sep 2015 19:32:38 GMT

Hi everyone,

My goal is to create a drop-down that shows the uptime and downtime of a server.
The SPL I have isn't coming out well as planned. I want it to be possible to show the time the server went down and the time it came back up on the chart. Can someone help me?
This is all I have so far.

index=perfmon collection=System counter="System up Time"  sourcetype="Perfmon:System"   state_to=* | transaction Uptime startswith=(state_to=Up) endswith=(state_to=Down)

Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

woodcock — Thu, 10 Sep 2015 00:03:44 GMT

Try this:

index=perfmon collection=System counter="System up Time" sourcetype="Perfmon:System" state_to=* | streamstats current=f last(_time) AS nextTime by host | eval nextTime=coalesce(nextTime, now()) | eval secondsInThisState = nextTime - _time

This is your base search and I believe that you are looking to do something further like appending this:

... | eval upSeconds=if(like(_raw, "%state_to=Up%"), secondsInThisState, null()) | eval downSeconds=if(isnull(upSeconds), secondsInThisState, null()) | stats list(upSeconds) list(downSeconds) by host

Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

idab — Tue, 29 Sep 2020 07:14:28 GMT

So, I used the SPL this way appending the second row - using a server host that we just restarted as a test.But, there were no values displayed for the list(upseconds) .Couldn't see any chart either.I was thinking the search would display the uptime and downtime period for a host machine.
Need help!

index=perfmon host="hostName" collection=System counter="System up Time" sourcetype="Perfmon:System" | streamstats current=f last(_time) AS nextTime by host | eval nextTime=coalesce(nextTime, now()) | eval secondsInThisState = nextTime - _time | eval upSeconds=if(like(_raw, "%state_to=Up%"), secondsInThisState, null()) | eval downSeconds=if(isnull(upSeconds), secondsInThisState, null()) | stats list(upSeconds) list(downSeconds) by host

Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

woodcock — Thu, 10 Sep 2015 03:06:03 GMT

Does the first half look correct when run by itself?

Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

idab — Thu, 10 Sep 2015 16:32:51 GMT

So, the first half gave no result found. But, when I took out the state_to=* it gave some event data., with no timechart .

Re: How to generate a timechart for servers showing the uptime and downtime within a span of 5 minutes?

woodcock — Thu, 10 Sep 2015 17:07:17 GMT

I got the state_to=* part from you in your question! My solution does not have timechart so you are not making sense. Does the first half generate events where each has a field called secondsInThisState whose values are sensible?