Knowledge Management

How to pause log generation during downtime in service and track the duration of each pause?

dharudiya
Explorer

Hi Splunkers,

I need to stop a particular service from generating logs in Splunk during downtime, and resume generating logs when the service is restored. And, I want to find the time difference between the last log generated during downtime and the first log generated when service was restored.

Example log times :

6/3/20
12:32:03.000 AM ....... (after the service is up)
6/3/20
11:41:33.000 AM........(last log before the service went down)
6/3/20
11:41:20.000 AM
6/3/20
11:41:15.000 AM
6/3/20
11:41:05.000 AM

Waiting to hear solutions from you guys!

Thanks.

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How does Splunk know which event is the last before the service went down and which is the first after the service came back up?

---
If this reply helps you, an upvote would be appreciated.

dharudiya
Explorer

I need to calculate the time difference of each event to the next event

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, we know what you want to do. Can you answer my question?
How would I, as a person unfamiliar with your envionment, know which event is the last before the service went down and which is the first after the service came back up?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...