Dashboards & Visualizations

Is there a way to modify it to search for a host on Splunk instead of for the actual Splunk server?

sizemorejm
Explorer

I found this search query online, is there a way to modify it to search for a host on splunk instead of for the actual splunk server? 

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime
Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sizemorejm ,

please try adding splunk_server=<your_host> to your search:

| rest /services/server/info splunk_server=<your_host>
| eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

Ciao.

Giuseppe

0 Karma

sizemorejm
Explorer

doing splunk_server=host does not work. I get a no results found error

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sizemorejm ,

as "host" you have to inserto the hostname of the Splunk server that you want to interrogate.

This is a correct approach as you cas see in this different answer https://community.splunk.com/t5/Getting-Data-In/Can-we-use-quot-rest-quot-to-call-Splunk-instances-o...

or in my screenshot:

gcusello_0-1690300510939.png

So check if you used the correct hostname.

Ciao.

Giuseppe

 

0 Karma

sizemorejm
Explorer

for some reason it doesnt recognize the individual servers only the main splunk server

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sizemorejm ,

if you run a search no that server, what's the value of splunk_server field?

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could use only those servers which have defined as search peers to this search head. If you want to query other full splunk instances, usually you found those on MC (monitoring console).

r. Ismo

0 Karma

sizemorejm
Explorer

I just typed host as a placeholder name, I did use the actual server's host name and that is what is giving me the no results error.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...