The following query shows uptime of all systems over a certain period of time (days_uptime). Replace my indexes w/ yours. index=os OR index=idx_appdev sourcetype=Unix:Uptime OR sourcetype=”WMI:Uptime” |dedup host |eval DaysUp=round(SystemUpTime/86400,2) |eval Years=round(DaysUp/365,2) |eval Months=round(DaysUp/30,2)|search DaysUp > $days_uptime$ | table host DaysUp Years Months SystemUpTime |sort – SystemUpTime | Looks like: hostname | DaysUP | […]
