Splunk Search

Splunk query for UPtime and Downtime?

Inayath_khan
Path Finder

Hi Folks,

Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime,

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As you've discovered, the REST interface only provides the startup time. You can, however, get both startup and shutdown times from splunkd.log. Start with index=_internal source=*splunkd.log* ("shutdown complete" OR "Splunkd starting"). This assumes your _internal index retains data long enough to keep the last startup and shutdown events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

johnward4
Communicator

I've been trying to work with this same query to calculate the difference (_time of Action = "Splunkd Starting" minus _time of Action = "Splunkd Shutdown) to show downtime by host.  Then sum the total downtime by host for the past 7 days.  The end result I'm hoping for is to show percentage of UpTime by host past 7 days and also chart total percentage of uptime past 7 days for all hosts.

index=_internal source="*SplunkUniversalForwarder*\\splunkd.log" (event_message="*Splunkd starting*" OR event_message="*Shutting down splunkd*") | eval Action = case(like(event_message, "%Splunkd starting%"), "Splunkd Starting", like(event_message, "%Shutting down splunkd%"), "Splunkd Shutdown") 

 

 

 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.