Hi everyone,
My goal is to create a drop-down that shows the uptime and downtime of a server.
The SPL I have isn't coming out well as planned. I want it to be possible to show the time the server went down and the time it came back up on the chart. Can someone help me?
This is all I have so far.
index=perfmon collection=System counter="System up Time" sourcetype="Perfmon:System" state_to=* | transaction Uptime startswith=(state_to=Up) endswith=(state_to=Down)
Try this:
index=perfmon collection=System counter="System up Time" sourcetype="Perfmon:System" state_to=* | streamstats current=f last(_time) AS nextTime by host | eval nextTime=coalesce(nextTime, now()) | eval secondsInThisState = nextTime - _time
This is your base search and I believe that you are looking to do something further like appending this:
... | eval upSeconds=if(like(_raw, "%state_to=Up%"), secondsInThisState, null()) | eval downSeconds=if(isnull(upSeconds), secondsInThisState, null()) | stats list(upSeconds) list(downSeconds) by host
Does the first half look correct when run by itself?
So, the first half gave no result found. But, when I took out the state_to=* it gave some event data., with no timechart .
I got the state_to=*
part from you in your question! My solution does not have timechart
so you are not making sense. Does the first half generate events where each has a field called secondsInThisState
whose values are sensible?
So, I used the SPL this way appending the second row - using a server host that we just restarted as a test.But, there were no values displayed for the list(upseconds) .Couldn't see any chart either.I was thinking the search would display the uptime and downtime period for a host machine.
Need help!
index=perfmon host="hostName" collection=System counter="System up Time" sourcetype="Perfmon:System" | streamstats current=f last(_time) AS nextTime by host | eval nextTime=coalesce(nextTime, now()) | eval secondsInThisState = nextTime - _time | eval upSeconds=if(like(_raw, "%state_to=Up%"), secondsInThisState, null()) | eval downSeconds=if(isnull(upSeconds), secondsInThisState, null()) | stats list(upSeconds) list(downSeconds) by host