Splunk IT Service Intelligence

need splunk query for this we have two hosts and we want to display the status for these two hosts (up/down) but one host is not available in the list that host we dill display it as down

mahendra559
New Member

2hosts
one host logs are not coming in to the splunk that host we want display as a Down

Labels (1)
0 Karma

woodcock
Esteemed Legend

This has been solved many times including:

Meta Woot!: https://splunkbase.splunk.com/app/2949/
TrackMe: https://splunkbase.splunk.com/app/4621/,
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...
0 Karma

to4kawa
Ultra Champion
| tstats count  where host="A" OR host="B" by host
| append [|makeresults
| eval host=split("A,B",",")
| mvexpand host
| fields - _*]
| stats values(count) as status by host
| fillnull value=Down
| rex field=status mode=sed "s/\d+/Up/g"
0 Karma

wmyersas
Builder

Sounds like you may need a lookup so you can report on what's missing.

Let's say you have a csv named important_hosts.csv with a single field named host

Now you can do something like this:

index=ndx sourcetype=srctp (host="host_1" OR host="host_2")
| stats count by host
| append
    [ | inputlookup important_hosts.csv ]
| fillnull
| stats max(count) as count by host
| eval status=if(count>0,"up","down")
| fields - count
0 Karma

mahendra559
New Member

Hi I tried this query but not showing the down host
And it is metric log query I searched with system.system_up_time metric log

0 Karma

gaurav_maniar
Builder

Hi,

Run the given query for particular time range or real-time and get count of events by host.
If count is greater than 0 than host is UP, else DOWN.

host=host_1 OR host=host_2
| stats count by host
| eval status = if(count>0, "Up", "Down")
| table host, status

accept & up-vote the answer if it helps

0 Karma

wmyersas
Builder

If host1 isn't sending data, stats isn't going to find it

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...