Hi, So I am trying to build SPL for how long does it take to restart splunk. BIt of context, We do sometimes do rolling restart through Cluster Master. So I am trying to determine, how long does rolling restart take.
So far from research, I can find splunk starting log from splunkd event. But that's just tells me one instance splunk starting. But i can't find logs from when splunk is shutting down.
Hi
this should work
index=_internal host IN (<List of Your CM nodes>) component=CMMaster "Starting a rolling restart of the peers." OR "rolling restart finished"
| transaction startswith="Starting a rolling restart of the peers." endswith="rolling restart finished"
| eval restartTime = tostring (duration, "duration")
| table _time restartTime _raw
r. Ismo
Query is not working anymore.