Last active
February 19, 2016 19:59
-
-
Save yorokobi/40ca9f11cf0f56764df9 to your computer and use it in GitHub Desktop.
Splunk SHC Status from REST
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rest /services/shcluster/member/members splunk_server=local | |
| table label status title artifact_count status_counter.Complete advertise_restart_required last_heartbeat | |
| eval is_captain = "No" | |
| eval is_current = "No" | |
| eval artifacts_not_reaped = artifact_count - 'status_counter.Complete' | |
| eval heartbeat_diff = now() - last_heartbeat | |
| join type=outer label | |
[ | |
| rest /services/shcluster/status splunk_server=local | |
| fields captain.label | |
| rename captain.label AS label | |
| eval is_captain = "Yes" | |
| eval is_current = "No" | |
] | |
| join type=outer label | |
[ | |
| rest /services/server/info splunk_server=local | |
| fields host | |
| rename host AS label | |
| eval is_current = "Yes" | |
] | |
| sort label | |
| convert timeformat="%F %T" ctime(last_heartbeat) AS last_heartbeat | |
| table label status is_captain is_current title last_heartbeat heartbeat_diff artifact_count status_counter.Complete artifacts_not_reaped advertise_restart_required | rename label AS "SHC Member" status AS Status is_captain AS "Captain" title AS GUID is_current AS "Current Node" last_heartbeat AS "Last Heartbeat" heartbeat_diff AS "Heartbeat Offset" artifact_count AS "Artifact Count" status_counter.Complete AS "Reaped Artifacts" artifacts_not_reaped AS "Unreaped Artifact Count" advertise_restart_required AS "Restart Flag" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment