Splunk Enterprise

command to identify the downtime of splunk component

Path Finder

i want to find out the time for which a host was down , please share the query to check the same.


Thanks in advance

Labels (1)
0 Karma


Hi @vinitpathri ,

it's a best practice that all the Splunk componentes send their logs to Indexers, so if you run a search on Splunk _internal logs, you can have the downtime of a Splunk component.

you could create a lookup (called e.g. perimeter.csv) containing all the servers (in the column host) of your Splunk infrastructure to monitor and run a search like this:

| metasearch index=_internal [ | inputlookup perimeter.csv | fields host ]
| timechart span=10m count BY host
| where count=0
| delta _time AS diff
| where diff=600
| stats sum(diff) AS total BY host



0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...