All Apps and Add-ons

Splunk OS Host Module Server uptime

lloydknight
Builder

Is the (top) uptime of the Linux server included in the "Splunk Add-on for Unix and Linux" ?

alt text

If not, is there a workaround to show the uptime of the Linux server using "Splunk Add-on for Unix and Linux"?

Thanks!

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi lloydknight,

Yes, the Add-on for Unix and Linux does include the top sourcetype that captures output from the *nix top command.

Please refer to the following page for a full list of source types included in this add-on:
http://docs.splunk.com/Documentation/UnixAddOn/5.2.3/User/SourcetypesandCIMdatamodelinfo

Hope it helps. Thanks!
Hunter Shen

View solution in original post

hunters_splunk
Splunk Employee
Splunk Employee

Hi lloydknight,

Yes, the Add-on for Unix and Linux does include the top sourcetype that captures output from the *nix top command.

Please refer to the following page for a full list of source types included in this add-on:
http://docs.splunk.com/Documentation/UnixAddOn/5.2.3/User/SourcetypesandCIMdatamodelinfo

Hope it helps. Thanks!
Hunter Shen

lloydknight
Builder

Thank you for the link, but I can't seem to find the event/field where the server is up. For example, Server-A's top command is up 132 days, 17:24. Tried searching the 132 days and failed. Is it converted to seconds or something equivalent to 132 days that I am missing? Thanks.

0 Karma

lloydknight
Builder

Hello, already figured this out. I used the process systemd to determine the server's uptime since systemd's process ID is 1. So I am just assuming that systemd daemon is parallel to server's uptime.

Here's my search:

index=os host=* source=ps PID=1 |
stats latest(ELAPSED) AS "DD -
HH:MM:SS" by host | sort - "DD -
HH:MM:SS"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...