Splunk Search

Splunk query for Forwarder , Indexer & SH restart

alexspunkshell
Communicator

Could someone please help me with the Splunk query to configure the alert if Forwarder, Indexer, or search head had restart?

@scelikok @soutamo @saravanan90 @thambisetty @ITWhisperer @gcusello @bowesmana   @to4kawa 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Here is one way, maybe not the best one.

(index=_internal source=*splunkd.log (host=<YOUR SPLUNK NODES>) ((component=CMServiceThread "CMNotifyThread starting eloop") OR (component=ServerConfig "My GUID") OR (component=loader ("All pipelines finished." OR "Shutdown HTTPDispatchThread")) OR (component=ShutdownHandler "Shutting down splunkd"))) 
| transaction startswith="Shutting down splunkd" endswith="CMNotifyThread starting eloop" keeporphans=true keepevicted=true maxspan=10m
| sort host 
| streamstats reset_on_change=t sum(duration) as total_duration by host
| table _time, duration, total_duration, host, _raw
| eval duration=tostring(duration, "duration"), total_duration=tostring(total_duration, "duration")
| sort - _time

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

Here is one way, maybe not the best one.

(index=_internal source=*splunkd.log (host=<YOUR SPLUNK NODES>) ((component=CMServiceThread "CMNotifyThread starting eloop") OR (component=ServerConfig "My GUID") OR (component=loader ("All pipelines finished." OR "Shutdown HTTPDispatchThread")) OR (component=ShutdownHandler "Shutting down splunkd"))) 
| transaction startswith="Shutting down splunkd" endswith="CMNotifyThread starting eloop" keeporphans=true keepevicted=true maxspan=10m
| sort host 
| streamstats reset_on_change=t sum(duration) as total_duration by host
| table _time, duration, total_duration, host, _raw
| eval duration=tostring(duration, "duration"), total_duration=tostring(total_duration, "duration")
| sort - _time

r. Ismo 

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!