Query to check the indexer is down, up or in unknown state

[Praz_123]

Is there is any Query  to check whether the indexers status  is  down, up or in unknown state . 

I can check in monitoring console but need a query to see for all indexer.

[gcusello]

Hi @Praz_123 ,

you can use the correct searches of @livehybrid or a simple:

index=_internal host IN (indexer1,indexer2)
| stats count BY host
| append [ | makeresults | eval host=indexer1, count=0 | fields host count ]
| append [ | makeresults | eval host=indexer2, count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

eventually you can replace the append commands with a lookup containing the list of servers to monitor

index=_internal host IN (indexer1,indexer2)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe

[livehybrid]

Hi @Praz_123 

You could try running

| rest /services/server/info | table serverName, server_roles, status

This query uses the rest command to access the Splunk REST API endpoint that provides information about the servers in your Splunk deployment. The server_roles field will help you identify which servers are indexers, and the status field will show their current status.

If you want to specifically check the health of your indexers, you can use the following query:

| rest /services/server/status/health/overview
| search title="Indexer"
| table title, health, messag 

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Praz_123 · Accepted solution]

@livehybrid @gcusello 

Thanks for your help but I created a query which shows me the required results 

| rest /services/server/introspection/indexer 
| where match(splunk_server, "indexer") 
| eval status = if(status == "normal", "up", "down")
| table splunk_server, status

[gcusello]

Hi @Praz_123 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉