topic Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name? in Getting Data In

Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

akelly4 — Tue, 31 Mar 2015 18:14:20 GMT

I created a script that will run on all of my universal Forwarders that are running Windows. It's a simple script that is going to pull IP, Host Name, and Original Install Date. Below is what the script looks like.

Script:
CD C:\
ECHO ON
ipconfig | findstr /i "IPv4 Address"
systeminfo | findstr /i /c:"Host Name" /c:"Original"

So the script runs successfully on the UF and the results are indexed, however something weird is happening. No matter how I form the script it never returns the install date of the machine. I've manually ran the batch file on the machine with the UF and everytime it's returning the Original install date. I can't figure out why no matter how I script it the install date isn't pulled back?

C:\Windows\system32>CD C:\
C:>ECHO ON
C:>ipconfig | findstr /i "IPv4 Address"
IPv4 Address. . . . . . . . . . . : 10.2.3.4
C:>systeminfo | findstr /i /c:"Host Name" /c:"Original"
Host Name: TestMachine

When I run the script manually I always see this additional piece of information

Original Install Date: 04/26/2015, 7:51:13 AM

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

jimodonald — Tue, 31 Mar 2015 18:22:04 GMT

Is Splunk locating that timestamp and using it as the event time?

You can check the raw data that Splunk is ingesting with

index= sourcetype= | table _raw

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

akelly4 — Tue, 31 Mar 2015 18:53:20 GMT

No it's just not being indexed.

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

jimodonald — Tue, 31 Mar 2015 20:09:35 GMT

Using the example above, you do not see the event on April 26, 2015 (a future time from today) -- but whatever the relevant timestamp is from your environment?

How do you know it's not being indexed?