How to find out Server Uptime & Downtime

[jaibalaraman]

Hi All 

I am trying to find out Server Up time & Downtime or offline 

However i am using the below command which i am not getting what i want 

| mstats max(System.System_Up_Time) AS "Uptime" WHERE index="permon_metrics" host=system1* BY host span=1m
| dedup host | rex field=host "\w{6}(?<function_abbr>\w{4})"
| search function_abbr=ADDS
| sort Uptime asc
| eval Uptime = round((now() - _time) / (60 * 60), 1)
| search Uptime="4.0"

I would like to see the output in a single tile like HH:MM:SS

[inventsekar]

Hi @jaibalaraman 

You have a field "Uptime" and then using the eval you are calculating the same field. 
Could you pls suggest us with more details, thanks. 

| mstats max(System.System_Up_Time) AS "Uptime" WHERE index="permon_metrics" host=system1* BY host span=1m
| dedup host | rex field=host "\w{6}(?<function_abbr>\w{4})"
| search function_abbr=ADDS
| sort Uptime asc
| eval UptimeNew = round((now() - _time) / (60 * 60), 1) 
| table Uptime UptimeNew function_abbr host

[jaibalaraman]

Sorry what information are you looking for

[inventsekar]

1) >>> I am trying to find out Server Up time & Downtime or offline 
the logs got a field "Uptime", may i know if the unit is seconds? 

2) how to find out the downtime or offline?

3)  this command will give you number of hours before the logline was received

| eval Uptime = round((now() - _time) / (60 * 60), 1)

 pls suggest us how you like to use this value

4)  may i know why you use the 

| search Uptime="4.0"