Monitoring Splunk

How to get instance health via splunk query

santosh12
New Member

Hi All,

I have 10 instances running 3 search head, 3 indexer, 1 monitoring console, 1 license manager, 1 deployment manager and 1 index master. How can we get all the instances and there status whether they are up and running or they are down via splunk query?

I know we can check in monitoring console but we need via query.

Regards,
Santosh.

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

View solution in original post

emafront
Explorer

Hi,
to display the localhost entry, you must use append instead of outer join since left and outer are the same thing in splunk.
See doc: http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Join

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

View solution in original post

realsplunk
Motivator

It works from search head, Splunk Enterprise V7.1.4

0 Karma

shaunpaul
New Member

I don't have an idea about this idea I am a student and currently working in Australian.So many stress because I have an assignment writing service leading firm.But this idea helps me for making an assignment.

0 Karma

MargoAdams
New Member

I don't know, because I'm not professional in this area. I am a student and I have complicated task. I'm ready to buy a coursework  paper from reliable writing company.

0 Karma

santosh12
New Member

Thanks Harshil it worked for me.

Regards,
Santosh.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.