Reporting

Splunk Host Reporting

scout29
Path Finder

I am trying to determine a hosts percent of time it logs to splunk within a summary index we created. We have an index called "summary_index" and a field called "host_reported" that shows if a host has been seen in the past hour. 

Here is the search i am using to see all hosts in the summary index that were seen within the last 24hrs:

index=summary_index  |  stats count by host_reported

What i am trying to do is develop a search that shows me what percent of the time over the past 7 days each host has reported to this summary index. So for example if host A only reported to the summary index 6 of the 7 days, i want it to show it's "up time "was 86% for the past 7 days. 

Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that your summary index has a single event for each host for each day that it has reported, then you should be able to divide your count (from the stats command you shared) by 7 and multiply by 100 to get the percentage "uptime"

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...