Splunk Enterprise

command to identify the downtime of splunk component

Path Finder

i want to find out the time for which a host was down , please share the query to check the same.


Thanks in advance

Labels (1)
0 Karma


Hi @vinitpathri ,

it's a best practice that all the Splunk componentes send their logs to Indexers, so if you run a search on Splunk _internal logs, you can have the downtime of a Splunk component.

you could create a lookup (called e.g. perimeter.csv) containing all the servers (in the column host) of your Splunk infrastructure to monitor and run a search like this:

| metasearch index=_internal [ | inputlookup perimeter.csv | fields host ]
| timechart span=10m count BY host
| where count=0
| delta _time AS diff
| where diff=600
| stats sum(diff) AS total BY host



0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...