Hi Folks,
Can anyone please help in forming the query for internal splunk components up and downtime reporting, i found a similar but this gives only uptime,
| rest /services/server/info | eval LastStartupTime=strftime(startup_time, "%Y/%m/%d %H:%M:%S")
| eval timenow=now()
| eval daysup = round((timenow - startup_time) / 86400,0)
| eval Uptime = tostring(daysup) + " Days"
| table splunk_server LastStartupTime Uptime
↧