topic Re: Is there a way to detect in Splunk if a server was removed or deleted? in Deployment Architecture https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256088#M9706 <P>One option could be to ping the servers using a scripted input and index the output to Splunk. Then based on the output of the ping, you can detect if the servers is in network or not. </P> Tue, 17 May 2016 15:52:39 GMT somesoni2 2016-05-17T15:52:39Z Is there a way to detect in Splunk if a server was removed or deleted? https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256087#M9705 <P>Is there a way to detect in Splunk if a server was removed or deleted from the network? </P> Tue, 17 May 2016 13:44:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256087#M9705 cds2016 2016-05-17T13:44:18Z Re: Is there a way to detect in Splunk if a server was removed or deleted? https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256088#M9706 <P>One option could be to ping the servers using a scripted input and index the output to Splunk. Then based on the output of the ping, you can detect if the servers is in network or not. </P> Tue, 17 May 2016 15:52:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256088#M9706 somesoni2 2016-05-17T15:52:39Z Re: Is there a way to detect in Splunk if a server was removed or deleted? https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256089#M9707 <P>@Somesoni2,<BR /> Hi. The server is unreachable via ping. I am looking more towards who and when may have shut down the server. Any thoughts? </P> Tue, 17 May 2016 16:52:32 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256089#M9707 cds2016 2016-05-17T16:52:32Z Re: Is there a way to detect in Splunk if a server was removed or deleted? https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256090#M9708 <P>You can set up a <CODE>scripted input</CODE> to ping the forwarder (there are apps on Splunkbase for this) and setup an alert to let you know when any server is unreachable for a period of time. Also setup <CODE>splunk WinEventLog://Security</CODE> from the servers to be forwarded into Splunk. Then you should be able to see the last person to login to that server, who should be the one who shut it down.</P> Sun, 29 May 2016 13:09:22 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-detect-in-Splunk-if-a-server-was-removed-or/m-p/256090#M9708 woodcock 2016-05-29T13:09:22Z