_time and duration

[SeanC]

My Search are as follow:

sourcetype = linux_audits (type=system_shutdown) OR (type=system_reboot) | table ...

I would like to have a table display the following:

1. host

2. time (of when system_shutdown happen)

3. time ( of when system_reboot happen)

4.  duration (of how long that take the system been down for)

How do i do that?

[PickleRick]

And what if the system crashed and didn't generate proper events? It's not a reliable monitoring technique.

[SeanC]

I get your point, right now am I just trying to learn how Splunk inquiry work.  I'm still a noob here.