Splunk Search

counting the latest servers

Path Finder


My log contains entries as shown below:

5:12:08.100 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

5:01:58.055 PM | deactivateNode | tid:2552 | serverID="dev1" State="DOWN"

3:51:53.115 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

3:46:48.092 PM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

4:56:41.099 AM | deactivateNode | tid:2552 | serverID="dev2" State="DOWN"

4:51:36.056 AM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

I want to know how many servers are up at the time the query is ran. the issue is that the servers go up and down all the time. For example: now many servers are UP now.
The result should show 2

How can I get these numbers?

Appreciate any help!!

Tags (1)


If you run the search back in time enough to where you're reasonably confident that each server appears at least once, you just run this:

<your searchterms> | stats first(State) as State by serverID | where State="UP"
0 Karma

Splunk Employee
Splunk Employee

So to get this what we'll do is use the first result back in time from the time the search is run. This means that we will get the latest status of each unique server:

source="mylog" | dedup serverID  | stats count as "Number of Servers in State" list(ServerID) as "Server List" by State
0 Karma

Splunk Employee
Splunk Employee

This should give you the latest event for each serverID and then filter it by UP only and then count it.

sourcetype="yoursourcetype" | stats first(State) as State by serverID | search State=UP | stats count

0 Karma

Path Finder

Thanks this pointed me down the correct path.
this is what worked
| stats first(State) as State by serverID
| stats count(eval(State="UP")) AS Count_UP

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...