I should have included that the SPL I provided is only searching the REST API of the search head executing the search (splunk_server=localhost) which can easily be removed if desired ... View more

Just happened to be looking for this very thing today and stumbled across submission. I wouldn't have thought to query the REST API for this without checking here first, but it seemed a little obvious after reading the accepted solution -- that's what I love about strong user communities. For what it's worth, here's my own slightly more direct SPL that produces roughly the same results as the accepted answer in case it helps anyone else. | rest splunk_server=local /services/server/info | eval uptime=tostring(now() - startup_time, "duration") | convert ctime(startup_time) | table splunk_server, startup_time, uptime   ... View more