Splunk Search

EC2 instance uptime monthly basis

samindradey
New Member

The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to develop a report which will display how much hours an EC2 instance was up and down in a month. Please suggest if it is possible through Splunk or not?

0 Karma

samindradey
New Member

Thanks! I am able to search the instances but in a month how many hours the instance was up and down is not able to create as a report. Can you please help?

0 Karma

nickhills
Ultra Champion

I would start by installing the Splunk App for AWS (and the TA, as per the instructions)
http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Installon-prem
This app, among other things, will collect events and actions taken on all your AWS resources and will allow you to search and filter them by tag/name/instance/id/Az/region etc.
You will also get access to the very comprehensive billing prediction and breakdown tools - not to mention user auditing, and performance metrics.

To directly answer your question, you will be able to see exactly how many hours each machine has been running.

If my comment helps, please give it a thumbs up!
0 Karma

samindradey
New Member

Thanks! I am able to search the instances but not able to create a report which will show how long the instance was up and down in a month. Can you please help?

0 Karma

nickhills
Ultra Champion

You can run a search like this:

`aws-description-sourcetype` source="*:ec2_instances"  (aws_account_id="*")   (region="*")  state="running" | timechart count(id) minspan=1h by instance_type

which will give you a chart of instances running by type (remove the by instance_type) to get a total.

If your interested in the costs of these instances, you can modify one one the dashboard panels to restrict your search to ec2, and use something like this, to show you costs this month vs last:

`aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`|search AmazonEC2 
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "This Month"
                            | appendcols [ search earliest=-mon@mon latest=-mon `aws-cloudwatch-billing( (LinkedAccountId="*") , USD)`
                            | stats sum(Sum) as sum by _time LinkedAccountId
                            | eval day=strftime(_time, "%Y/%m/%d")
                            | dedup day LinkedAccountId sortby -_time
                            | timechart span=1d sum(sum) as "Last Month"]
                            | fields _time "Last Month" "This Month"

Take a look at the dashboard panels available in the app, as these provide a great starting point for any queries you want to refine.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...