Archive
Highlighted

EC2 instance uptime monthly basis

New Member

The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to develop a report which will display how much hours an EC2 instance was up and down in a month. Please suggest if it is possible through Splunk or not?

0 Karma
Highlighted

Re: EC2 instance uptime monthly basis

Ultra Champion

I would start by installing the Splunk App for AWS (and the TA, as per the instructions)
http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Installon-prem
This app, among other things, will collect events and actions taken on all your AWS resources and will allow you to search and filter them by tag/name/instance/id/Az/region etc.
You will also get access to the very comprehensive billing prediction and breakdown tools - not to mention user auditing, and performance metrics.

To directly answer your question, you will be able to see exactly how many hours each machine has been running.

0 Karma
Highlighted

Re: EC2 instance uptime monthly basis

New Member

Thanks! I am able to search the instances but not able to create a report which will show how long the instance was up and down in a month. Can you please help?

0 Karma
Highlighted

Re: EC2 instance uptime monthly basis

Ultra Champion

You can run a search like this:

`aws-description-sourcetype` source="*:ec2_instances"  (aws_account_id="*")   (region="*")  state="running" | timechart count(id) minspan=1h by instance_type

which will give you a chart of instances running by type (remove the by instance_type) to get a total.

If your interested in the costs of these instances, you can modify one one the dashboard panels to restrict your search to ec2, and use something like this, to show you costs this month vs last:

`aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`|search AmazonEC2 
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "This Month"
                            | appendcols [ search earliest=-mon@mon latest=-mon `aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "Last Month"]
                            | fields _time "Last Month" "This Month"

Take a look at the dashboard panels available in the app, as these provide a great starting point for any queries you want to refine.

0 Karma
Highlighted

Re: EC2 instance uptime monthly basis

New Member

Thanks! I am able to search the instances but in a month how many hours the instance was up and down is not able to create as a report. Can you please help?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.