How to check the indexer status details for last one month from the Search head by using SPL query

[thahir]

Hi Team

How to check the indexer status details  for last one month from the Search head by using SPL query

[VatsalJagani]

@thahir - If you mean status is Indexer server is running or not. You can use this search with a timechart.

index=_internal host=<your-indexer's-hostname>
| timechart span=1h count

You can update span value as you require.

If you see a gap in the line chart, that means the indexer was down during that time.

I hope this helps!!!

[isoutamo]

Hi
can you describe what you are meaning with "status"?
r. Ismo