@tmarlette If you're using Splunk Add-on for Unix and Linux and Splunk Add-on for Windows, you can use the uptime tag: tag=uptime Both add-ons have uptime inputs with default intervals of 84600 seconds. Both source types have a field named uptime with a value in seconds. With that understanding in hand, we can assume any value greater than or equal to 86400 represents 86400 seconds of uptime, and any value less than 86400 seconds is that value: tag=uptime earliest=-30d@d latest=@d | stats sum(eval(min(uptime, 86400))) as uptime by host | eval uptime_percent=uptime/2592000 ```86400 seconds * 30 days``` You may want to include an error measurement to allow for variation in uptime polling schedules, downtime following the last available uptime measurement, etc.
... View more