Skip to content

Instantly share code, notes, and snippets.

@yorokobi
Last active February 19, 2016 19:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yorokobi/40ca9f11cf0f56764df9 to your computer and use it in GitHub Desktop.
Save yorokobi/40ca9f11cf0f56764df9 to your computer and use it in GitHub Desktop.
Splunk SHC Status from REST
| rest /services/shcluster/member/members splunk_server=local
| table label status title artifact_count status_counter.Complete advertise_restart_required last_heartbeat
| eval is_captain = "No"
| eval is_current = "No"
| eval artifacts_not_reaped = artifact_count - 'status_counter.Complete'
| eval heartbeat_diff = now() - last_heartbeat
| join type=outer label
[
| rest /services/shcluster/status splunk_server=local
| fields captain.label
| rename captain.label AS label
| eval is_captain = "Yes"
| eval is_current = "No"
]
| join type=outer label
[
| rest /services/server/info splunk_server=local
| fields host
| rename host AS label
| eval is_current = "Yes"
]
| sort label
| convert timeformat="%F %T" ctime(last_heartbeat) AS last_heartbeat
| table label status is_captain is_current title last_heartbeat heartbeat_diff artifact_count status_counter.Complete artifacts_not_reaped advertise_restart_required | rename label AS "SHC Member" status AS Status is_captain AS "Captain" title AS GUID is_current AS "Current Node" last_heartbeat AS "Last Heartbeat" heartbeat_diff AS "Heartbeat Offset" artifact_count AS "Artifact Count" status_counter.Complete AS "Reaped Artifacts" artifacts_not_reaped AS "Unreaped Artifact Count" advertise_restart_required AS "Restart Flag"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment