EC2 instance uptime monthly basis

[samindradey]

The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to develop a report which will display how much hours an EC2 instance was up and down in a month. Please suggest if it is possible through Splunk or not?

[samindradey]

Thanks! I am able to search the instances but in a month how many hours the instance was up and down is not able to create as a report. Can you please help?

[nickhills]

I would start by installing the Splunk App for AWS (and the TA, as per the instructions)
http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Installon-prem
This app, among other things, will collect events and actions taken on all your AWS resources and will allow you to search and filter them by tag/name/instance/id/Az/region etc.
You will also get access to the very comprehensive billing prediction and breakdown tools - not to mention user auditing, and performance metrics.

To directly answer your question, you will be able to see exactly how many hours each machine has been running.

[samindradey]

Thanks! I am able to search the instances but not able to create a report which will show how long the instance was up and down in a month. Can you please help?

[nickhills]

You can run a search like this:

`aws-description-sourcetype` source="*:ec2_instances"  (aws_account_id="*")   (region="*")  state="running" | timechart count(id) minspan=1h by instance_type

which will give you a chart of instances running by type (remove the by instance_type) to get a total.

If your interested in the costs of these instances, you can modify one one the dashboard panels to restrict your search to ec2, and use something like this, to show you costs this month vs last:

`aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`|search AmazonEC2 
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "This Month"
                            | appendcols [ search earliest=-mon@mon latest=-mon `aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "Last Month"]
                            | fields _time "Last Month" "This Month"

Take a look at the dashboard panels available in the app, as these provide a great starting point for any queries you want to refine.