Dashboards & Visualizations

Windows serveruptime Dashboard

bsaujla131984
Path Finder

I would like to create a dashboard to show Windows server up time where it is more than 60 days..

Basically I would like to present as a count of servers running continuously for more than 60 days.

Tags (1)
0 Karma

bsaujla131984
Path Finder

Thanks to4kawa for you reply.

It is not working for me... All I want to take the count of server which have been running for more than 60 days by using following query :-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | stats count by host | where Uptime_Days>60

0 Karma

to4kawa
Ultra Champion

my answer is updated. please confirm.

0 Karma

to4kawa
Ultra Champion

sorry, I've mistake, typo. my answer is amended. please confirm.

0 Karma

bsaujla131984
Path Finder

I cant find your amended answer?

0 Karma

to4kawa
Ultra Champion

I put label.

0 Karma

bsaujla131984
Path Finder

can you copy your answer her again please?

0 Karma

to4kawa
Ultra Champion
|tstats count prestats=t where index=win_perf host=A OR host=B OR host=C OR host=D by host _time span=1d
| timechart count by host
0 Karma

bsaujla131984
Path Finder

I am getting following error :-

Error in 'TsidxStats': WHERE clause is not an exact query

0 Karma

to4kawa
Ultra Champion

my answer amended, please confirm.

to4kawa
Ultra Champion

amended:

|tstats count prestats=t where index=win_perf by host _time span=1d
| timechart count by host

check this results and modify query.

bsaujla131984
Path Finder

Actually I have got the search to display the servers which have been running for more than 60 days, however I am trying to get the count of servers which are running for more than 60 days..

Search to display up time is as below:-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime in Days" by host

What I want to know the count of servers running more than 60 days ... I am trying following :-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | stats count by host | where Uptime_Days>60

However I am not getting any result back...

0 Karma

to4kawa
Ultra Champion
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...