Is there a way to modify it to search for a host on Splunk instead of for the actual Splunk server?

[sizemorejm]

I found this search query online, is there a way to modify it to search for a host on splunk instead of for the actual splunk server? 

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

[gcusello]

Hi @sizemorejm ,

please try adding splunk_server=<your_host> to your search:

| rest /services/server/info splunk_server=<your_host>
| eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

Ciao.

Giuseppe

[sizemorejm]

doing splunk_server=host does not work. I get a no results found error

[gcusello]

Hi @sizemorejm ,

as "host" you have to inserto the hostname of the Splunk server that you want to interrogate.

This is a correct approach as you cas see in this different answer https://community.splunk.com/t5/Getting-Data-In/Can-we-use-quot-rest-quot-to-call-Splunk-instances-o...

or in my screenshot:

So check if you used the correct hostname.

Ciao.

Giuseppe

[sizemorejm]

for some reason it doesnt recognize the individual servers only the main splunk server

[gcusello]

Hi @sizemorejm ,

if you run a search no that server, what's the value of splunk_server field?

Ciao.

Giuseppe

[isoutamo]

Hi

you could use only those servers which have defined as search peers to this search head. If you want to query other full splunk instances, usually you found those on MC (monitoring console).

r. Ismo

[sizemorejm]

I just typed host as a placeholder name, I did use the actual server's host name and that is what is giving me the no results error.