Splunk Search

EC2 instance uptime monthly basis

samindradey
New Member

The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to develop a report which will display how much hours an EC2 instance was up and down in a month. Please suggest if it is possible through Splunk or not?

0 Karma

samindradey
New Member

Thanks! I am able to search the instances but in a month how many hours the instance was up and down is not able to create as a report. Can you please help?

0 Karma

nickhills
Ultra Champion

I would start by installing the Splunk App for AWS (and the TA, as per the instructions)
http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Installon-prem
This app, among other things, will collect events and actions taken on all your AWS resources and will allow you to search and filter them by tag/name/instance/id/Az/region etc.
You will also get access to the very comprehensive billing prediction and breakdown tools - not to mention user auditing, and performance metrics.

To directly answer your question, you will be able to see exactly how many hours each machine has been running.

If my comment helps, please give it a thumbs up!
0 Karma

samindradey
New Member

Thanks! I am able to search the instances but not able to create a report which will show how long the instance was up and down in a month. Can you please help?

0 Karma

nickhills
Ultra Champion

You can run a search like this:

`aws-description-sourcetype` source="*:ec2_instances"  (aws_account_id="*")   (region="*")  state="running" | timechart count(id) minspan=1h by instance_type

which will give you a chart of instances running by type (remove the by instance_type) to get a total.

If your interested in the costs of these instances, you can modify one one the dashboard panels to restrict your search to ec2, and use something like this, to show you costs this month vs last:

`aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`|search AmazonEC2 
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "This Month"
                            | appendcols [ search earliest=-mon@mon latest=-mon `aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "Last Month"]
                            | fields _time "Last Month" "This Month"

Take a look at the dashboard panels available in the app, as these provide a great starting point for any queries you want to refine.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...