Splunk Search

counting the latest servers

fresned
Path Finder

Hi,

My log contains entries as shown below:

5:12:08.100 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

5:01:58.055 PM | deactivateNode | tid:2552 | serverID="dev1" State="DOWN"

3:51:53.115 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

3:46:48.092 PM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

4:56:41.099 AM | deactivateNode | tid:2552 | serverID="dev2" State="DOWN"

4:51:36.056 AM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

I want to know how many servers are up at the time the query is ran. the issue is that the servers go up and down all the time. For example: now many servers are UP now.
The result should show 2

How can I get these numbers?

Appreciate any help!!

Tags (1)

sideview
SplunkTrust
SplunkTrust

If you run the search back in time enough to where you're reasonably confident that each server appears at least once, you just run this:

<your searchterms> | stats first(State) as State by serverID | where State="UP"
0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

So to get this what we'll do is use the first result back in time from the time the search is run. This means that we will get the latest status of each unique server:

source="mylog" | dedup serverID  | stats count as "Number of Servers in State" list(ServerID) as "Server List" by State
0 Karma

sdaniels
Splunk Employee
Splunk Employee

This should give you the latest event for each serverID and then filter it by UP only and then count it.

sourcetype="yoursourcetype" | stats first(State) as State by serverID | search State=UP | stats count

0 Karma

fresned
Path Finder

Thanks this pointed me down the correct path.
this is what worked
sourcetype="mysourcetype"
| stats first(State) as State by serverID
| stats count(eval(State="UP")) AS Count_UP

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...