Splunk Search

Splunk query for UPtime and Downtime?

Inayath_khan
Path Finder

Hi Folks,

Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime,

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As you've discovered, the REST interface only provides the startup time. You can, however, get both startup and shutdown times from splunkd.log. Start with index=_internal source=*splunkd.log* ("shutdown complete" OR "Splunkd starting"). This assumes your _internal index retains data long enough to keep the last startup and shutdown events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

johnward4
Communicator

I've been trying to work with this same query to calculate the difference (_time of Action = "Splunkd Starting" minus _time of Action = "Splunkd Shutdown) to show downtime by host.  Then sum the total downtime by host for the past 7 days.  The end result I'm hoping for is to show percentage of UpTime by host past 7 days and also chart total percentage of uptime past 7 days for all hosts.

index=_internal source="*SplunkUniversalForwarder*\\splunkd.log" (event_message="*Splunkd starting*" OR event_message="*Shutting down splunkd*") | eval Action = case(like(event_message, "%Splunkd starting%"), "Splunkd Starting", like(event_message, "%Shutting down splunkd%"), "Splunkd Shutdown") 

 

 

 

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...