I found this search query online, is there a way to modify it to search for a host on splunk instead of for the actual splunk server?
| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime
Hi @sizemorejm ,
please try adding splunk_server=<your_host> to your search:
| rest /services/server/info splunk_server=<your_host>
| eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime
Ciao.
Giuseppe
doing splunk_server=host does not work. I get a no results found error
Hi @sizemorejm ,
as "host" you have to inserto the hostname of the Splunk server that you want to interrogate.
This is a correct approach as you cas see in this different answer https://community.splunk.com/t5/Getting-Data-In/Can-we-use-quot-rest-quot-to-call-Splunk-instances-o...
or in my screenshot:
So check if you used the correct hostname.
Ciao.
Giuseppe
for some reason it doesnt recognize the individual servers only the main splunk server
Hi @sizemorejm ,
if you run a search no that server, what's the value of splunk_server field?
Ciao.
Giuseppe
Hi
you could use only those servers which have defined as search peers to this search head. If you want to query other full splunk instances, usually you found those on MC (monitoring console).
r. Ismo
I just typed host as a placeholder name, I did use the actual server's host name and that is what is giving me the no results error.