https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86711#M18013 <P>I want to check which server are not sending logs to Splunk as our monthly maintenance. Can you guys help me what is the correct query for this? Thanks</P> Mon, 08 Jul 2013 05:45:51 GMT karambaz 2013-07-08T05:45:51Z https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86711#M18013 <P>I want to check which server are not sending logs to Splunk as our monthly maintenance. Can you guys help me what is the correct query for this? Thanks</P> Mon, 08 Jul 2013 05:45:51 GMT https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86711#M18013 karambaz 2013-07-08T05:45:51Z https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86712#M18014 <P>If you are using forwarders to send logs to the Indexer, I would say just to use the Deployment Monitor app, to check up this. It will tell you the last update received from the forwarders, so you would be able to gauge from their which need to be check up on.</P> <P>Hope this helps.</P> Mon, 08 Jul 2013 08:46:33 GMT https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86712#M18014 MHibbin 2013-07-08T08:46:33Z https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86713#M18015 <P>Thanks for the info sir..but what about the query? Do you have any idea on what is a good query to run this?</P> Mon, 08 Jul 2013 09:10:03 GMT https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86713#M18015 karambaz 2013-07-08T09:10:03Z https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86714#M18016 <P>I'm using below query for check the which server/devices are not reporting to Splunk.</P> <P>| metadata index=windows OR index=wineventlog type=hosts | eval age = now()-lastTime | where age &gt; (2*86400) | convert ctime(lastTime) | fields age,host,lastTime</P> Thu, 26 Jul 2018 10:35:36 GMT https://community.splunk.com/t5/Getting-Data-In/To-monitor-which-Windows-server-are-not-sending-logs-to-Splunk/m-p/86714#M18016 gpchnd007 2018-07-26T10:35:36Z