Archive

Search for Server Uptime for last 24hrs

splunker9999
Path Finder

Hi ,

We are looking for a search for server uptime and downtime.

Server is up from last 20days, and results will be retireved only if we select 20days from timepicker,

We are looking a search for below scenarios.

1.but we are looking for 24hrs period where if the search has not retireved any results during this period then it can say the status as UP.
2.If it retrieves any results during that period, then it should verify status and displays the result.

Will this be possible?

Below is our sample search we are using which could display lastuptime and current status.(this we needs to select timepicker for 20days)

index=f5 Server1 monitor status | head 1 | eval status=if(F5_TCPStatus="up",10,0) | stats sum(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try

|stats count |eval dummy=10|appendcols [search index=f5 Server1 monitor status | head 1 
|eval tmpstatus=if(F5_TCPStatus="up",10,0)|fields tmpstatus]
|eval status=coalesce(tmpstatus,dummy)
|stats sum(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

Do you happen to have a list of what servers you actually have already? Or will we need to help you generate that?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

|stats count |eval dummy=10|appendcols [search index=f5 Server1 monitor status | head 1 
|eval tmpstatus=if(F5_TCPStatus="up",10,0)|fields tmpstatus]
|eval status=coalesce(tmpstatus,dummy)
|stats sum(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated

View solution in original post

0 Karma

splunker9999
Path Finder

This seems to be working, Thank you very much 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this. It sets F5_TCPStatus to "up" if it is not found in an event.

index=f5 Server1 monitor status | head 1 | fillnull value="up" F5_TCPStatus | eval status=if(F5_TCPStatus="up",10,0) | stats sum(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated
---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunker9999
Path Finder

HI, Thanks.

Just for Confirmation, If we have count =1 and status as down/up ,does this query retrieves the result from F5_TCPStatus?

0 Karma

splunker9999
Path Finder

Thank you very much @richgalloway, this search works good and liked it much!!

0 Karma

splunker9999
Path Finder

Still this search displaying "no results found" if we select for last 24 hrs.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your search returns no events at all then fillnull won't help. Try this instead.

index=f5 Server1 monitor status | head 1 | fillnull value="up" F5_TCPStatus | eval status=if(F5_TCPStatus="up",10,0) | appendpipe [ stats count | eval status=10 | where count==0 | fields - count ] | stats sum(status) AS severity | rangemap field=severity severe=0-9 low=10-11 default=elevated
---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunker9999
Path Finder

Hi,

Thanks , Just for confirmation as we dont have sample data to test this.
What happens if we have count =1 and F5_TCPStatus=down/up , this query will display the value in F5_TCPStatus?

Thanks
Sarath

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!