Getting Data In

How to monitor and alert on the status of services on a forwarder and when an External USB device is connected?

Path Finder


I have 10 machines running a splunk forwarder now and I want to know the status of services on these machines.

For example, I have an Antivirus service running on ten machines. Whenever this service is stopped, I should get an alert, and when the service is started again, then I should get another alert.

Another example for the same 10 machines, if anyone connects an external USB device, I should get an alert and the details of this USB device connected, and another alert when it is disconnected.

Thanks and Regaards,

0 Karma

New Member

Hi Deepthi,

I have to setup something similar like your requirement. I got to monitor all windows services and send out an alert. If you were successful in configuring USB device, can you please let me know the steps.


0 Karma


Hi deepthi5,

This is more an OS then Splunk related question. You must first figure out how those 10 OS's report process status and USB connects. If you're using any unix/linux OS try the Splunk Unix App and search your processes and USB events in index=os. Read more about the app here

For Windows there is an app as well , but I'm not sure how or if your will be able to get the USB events (WMI maybe?)

Hope this helps to get you started ...

cheers, MuS

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!