Splunk query for UPtime and Downtime?

[Inayath_khan]

Hi Folks,

Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime,

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

[richgalloway]

As you've discovered, the REST interface only provides the startup time. You can, however, get both startup and shutdown times from splunkd.log. Start with index=_internal source=*splunkd.log* ("shutdown complete" OR "Splunkd starting"). This assumes your _internal index retains data long enough to keep the last startup and shutdown events.

[johnward4]

I've been trying to work with this same query to calculate the difference (_time of Action = "Splunkd Starting" minus _time of Action = "Splunkd Shutdown) to show downtime by host.  Then sum the total downtime by host for the past 7 days.  The end result I'm hoping for is to show percentage of UpTime by host past 7 days and also chart total percentage of uptime past 7 days for all hosts.

index=_internal source="*SplunkUniversalForwarder*\\splunkd.log" (event_message="*Splunkd starting*" OR event_message="*Shutting down splunkd*") | eval Action = case(like(event_message, "%Splunkd starting%"), "Splunkd Starting", like(event_message, "%Shutting down splunkd%"), "Splunkd Shutdown")