How to get instance health via splunk query

[santosh12]

Hi All,

I have 10 instances running 3 search head, 3 indexer, 1 monitoring console, 1 license manager, 1 deployment manager and 1 index master. How can we get all the instances and there status whether they are up and running or they are down via splunk query?

I know we can check in monitoring console but we need via query.

Regards,
Santosh.

[emafront]

Hi,
to display the localhost entry, you must use append instead of outer join since left and outer are the same thing in splunk.
See doc: http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Join

[harsmarvania57 · Accepted solution]

Hi @santosh12,

You can use below query that I have created based on DMC query but it will work from DMC server only because from one search head you can't run rest query of other heads, cluster master, deployment server.

| rest splunk_server=local /services/search/distributed/peers | rename title as peerURI  | join type=outer peerURI [| rest splunk_server=local /services/server/info | eval peerURI = "localhost" | eval status = "Up"]  | eval status = if(status == "Up", status, "Unreachable") | eval OS = os_name | eval ram = round(physicalMemoryMB / 1024, 2)." GB" | fields host, server_roles, OS, numberOfCores, ram, version, status| sort status, host| rename host as Instance, server_roles as Role, numberOfCores as "Cores", ram as RAM, version as Version, status as Status

I hope this helps.

Thanks,
Harshil

[splunkreal]

It works from search head, Splunk Enterprise V7.1.4

[shaunpaul]

I don't have an idea about this idea I am a student and currently working in Australian.So many stress because I have an assignment writing service leading firm.But this idea helps me for making an assignment.

[MargoAdams]

I don't know, because I'm not professional in this area. I am a student and I have complicated task. I'm ready to buy a coursework  paper from reliable writing company.

[santosh12]

Thanks Harshil it worked for me.

Regards,
Santosh.