VM Down and Raised Time Query for Widget

I would just use vm.uptime:[0 TO 86400].  VM Uptime is represented in seconds, so 86400 will give you the last 24 hours.  you can build your widget using a TopN and pick the uptime as the sort field.  You can then add in additional columns as needed.

Hi mprobus,

Thanks for your advice. but, actually what I need is to make a widget that shows the down VMs (not rebooted VMs), so the it's VM that still down.

So, I chose to use query 'vm.uptime:0', but I don't know what is the best 'sort field' for widget to use to show the VMs down based on it's down-raised time. meaning the newer ones will be on top

I have tried to use vm.perfDate and vm.timestamp, but it just show the date, not detail to the time (hours:minutes:seconds). And the result sometimes not according it's raised time.

Any idea?

Regards,

Got'cha.  I misunderstood.  I thought you were wanting machines that recently rebooted.

I don't think you can use the vm.Perfdate because even though a machine may be powered off, VMware will still report it as having 0 performance data (at least for memory).  You can verify this by running the following query.

vm.powerstate:"poweredOff"  vm.perfDate:*

vm.uptime:0 will not give you the servers that are currently down.  Uptime tells you how long since the system last rebooted.  So, a 0 would mean that it just started up.

You can use vm.lastActivityDate:[* TO now-1days] which will report the servers that haven't had activity in the past day.  For VMs that are powered off, this will represent the time they were turned off.  In the widget though, it only shows the date.  If you do a view all and show them in the search results, the Hits will show the actual time.