Splunk Search

counting the latest servers

fresned
Path Finder

Hi,

My log contains entries as shown below:

5:12:08.100 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

5:01:58.055 PM | deactivateNode | tid:2552 | serverID="dev1" State="DOWN"

3:51:53.115 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

3:46:48.092 PM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

4:56:41.099 AM | deactivateNode | tid:2552 | serverID="dev2" State="DOWN"

4:51:36.056 AM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

I want to know how many servers are up at the time the query is ran. the issue is that the servers go up and down all the time. For example: now many servers are UP now.
The result should show 2

How can I get these numbers?

Appreciate any help!!

Tags (1)

sideview
SplunkTrust
SplunkTrust

If you run the search back in time enough to where you're reasonably confident that each server appears at least once, you just run this:

<your searchterms> | stats first(State) as State by serverID | where State="UP"
0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

So to get this what we'll do is use the first result back in time from the time the search is run. This means that we will get the latest status of each unique server:

source="mylog" | dedup serverID  | stats count as "Number of Servers in State" list(ServerID) as "Server List" by State
0 Karma

sdaniels
Splunk Employee
Splunk Employee

This should give you the latest event for each serverID and then filter it by UP only and then count it.

sourcetype="yoursourcetype" | stats first(State) as State by serverID | search State=UP | stats count

0 Karma

fresned
Path Finder

Thanks this pointed me down the correct path.
this is what worked
sourcetype="mysourcetype"
| stats first(State) as State by serverID
| stats count(eval(State="UP")) AS Count_UP

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.