Splunk Search

Splunk query for UPtime and Downtime?

Inayath_khan
Path Finder

Hi Folks,

Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime,

| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As you've discovered, the REST interface only provides the startup time. You can, however, get both startup and shutdown times from splunkd.log. Start with index=_internal source=*splunkd.log* ("shutdown complete" OR "Splunkd starting"). This assumes your _internal index retains data long enough to keep the last startup and shutdown events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

johnward4
Communicator

I've been trying to work with this same query to calculate the difference (_time of Action = "Splunkd Starting" minus _time of Action = "Splunkd Shutdown) to show downtime by host.  Then sum the total downtime by host for the past 7 days.  The end result I'm hoping for is to show percentage of UpTime by host past 7 days and also chart total percentage of uptime past 7 days for all hosts.

index=_internal source="*SplunkUniversalForwarder*\\splunkd.log" (event_message="*Splunkd starting*" OR event_message="*Shutting down splunkd*") | eval Action = case(like(event_message, "%Splunkd starting%"), "Splunkd Starting", like(event_message, "%Shutting down splunkd%"), "Splunkd Shutdown") 

 

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...