Getting Data In

Splunk server uptime - missing Splunk server details

pbrinkman
Path Finder

Hi all,

I am running the below query, I get responses from some of my Splunk servers but not all ?

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

Is there anything I am missing on the servers that are not reporting back ?

Cheers
Paul

Tags (2)
0 Karma

ivanreis
Builder

Please, check this splunk answers, maybe it fits your purposes:
https://answers.splunk.com/answers/105128/how-to-determine-how-long-splunk-has-been-up.html

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rest command is only sent to indexers so only those servers will respond. You will not get any data about search heads and other non-indexer instances.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pbrinkman
Path Finder

cheers for the info richgalloway

0 Karma

coreyCLI
Communicator

I found this to work from our DMC for all instances.  I can see retrieve info for all instances that are search peers of the DMC.  Without "splunk_server=*" then I only see the indexers.

 

| rest splunk_server=* /services/server/info

| table host, startup_time

| eval uptime=tostring(now() - startup_time, "duration")

 

hope this helps

amatodersp
Engager

Thank you, Can confirm that this works as expected. I was also looking for a way to see all of the splunk instances:

 

Run from the DMC:

| rest splunk_server=* /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Shortly, you could run rest towards all defined search peers. This is the reason why it works on MC. Basically you could add additional peers (like HFs, currently as indexers) and then get that information from them.
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...