Dashboards & Visualizations

Windows serveruptime Dashboard

bsaujla131984
Path Finder

I would like to create a dashboard to show Windows server up time where it is more than 60 days..

Basically I would like to present as a count of servers running continuously for more than 60 days.

Tags (1)
0 Karma

bsaujla131984
Path Finder

Thanks to4kawa for you reply.

It is not working for me... All I want to take the count of server which have been running for more than 60 days by using following query :-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | stats count by host | where Uptime_Days>60

0 Karma

to4kawa
Ultra Champion

my answer is updated. please confirm.

0 Karma

to4kawa
Ultra Champion

sorry, I've mistake, typo. my answer is amended. please confirm.

0 Karma

bsaujla131984
Path Finder

I cant find your amended answer?

0 Karma

to4kawa
Ultra Champion

I put label.

0 Karma

bsaujla131984
Path Finder

can you copy your answer her again please?

0 Karma

to4kawa
Ultra Champion
|tstats count prestats=t where index=win_perf host=A OR host=B OR host=C OR host=D by host _time span=1d
| timechart count by host
0 Karma

bsaujla131984
Path Finder

I am getting following error :-

Error in 'TsidxStats': WHERE clause is not an exact query

0 Karma

to4kawa
Ultra Champion

my answer amended, please confirm.

to4kawa
Ultra Champion

amended:

|tstats count prestats=t where index=win_perf by host _time span=1d
| timechart count by host

check this results and modify query.

bsaujla131984
Path Finder

Actually I have got the search to display the servers which have been running for more than 60 days, however I am trying to get the count of servers which are running for more than 60 days..

Search to display up time is as below:-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime in Days" by host

What I want to know the count of servers running more than 60 days ... I am trying following :-

index = win_perf host= A OR host=B OR host=C OR host=D | eval Uptime_Days = System_Up_Time/86400 | stats count by host | where Uptime_Days>60

However I am not getting any result back...

0 Karma

to4kawa
Ultra Champion
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...