Deployment Architecture

How long does monitor rolling restart take?


Hi, So I am trying to build SPL for how long does it take to restart splunk. BIt of context, We do sometimes do rolling restart through Cluster Master. So I am trying to determine, how long does rolling restart take. 


So far from research, I can find splunk starting log from splunkd event. But that's just tells me one instance splunk starting. But i can't find logs from when splunk is shutting down. 

Labels (1)
0 Karma



this should work


index=_internal host IN (<List of Your CM nodes>) component=CMMaster "Starting a rolling restart of the peers." OR "rolling restart finished"
| transaction startswith="Starting a rolling restart of the peers." endswith="rolling restart finished"
| eval restartTime = tostring (duration, "duration")
| table _time restartTime _raw


r. Ismo 

Path Finder

Query is not working anymore.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...