Archive

How to get instance health via splunk query

New Member

Hi All,

I have 10 instances running 3 search head, 3 indexer, 1 monitoring console, 1 license manager, 1 deployment manager and 1 index master. How can we get all the instances and there status whether they are up and running or they are down via splunk query?

I know we can check in monitoring console but we need via query.

Regards,
Santosh.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

View solution in original post

Explorer

Hi,
to display the localhost entry, you must use append instead of outer join since left and outer are the same thing in splunk.
See doc: http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Join

0 Karma

SplunkTrust
SplunkTrust

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

View solution in original post

Builder

It works from search head, Splunk Enterprise V7.1.4

0 Karma

New Member

I don't have an idea about this idea I am a student and currently working in Australian.So many stress because I have an assignment writing service leading firm.But this idea helps me for making an assignment.

0 Karma

New Member

Thanks Harshil it worked for me.

Regards,
Santosh.

0 Karma