I have 10 machines running a splunk forwarder now and I want to know the status of services on these machines.
For example, I have an Antivirus service running on ten machines. Whenever this service is stopped, I should get an alert, and when the service is started again, then I should get another alert.
Another example for the same 10 machines, if anyone connects an external USB device, I should get an alert and the details of this USB device connected, and another alert when it is disconnected.
Thanks and Regaards,
I have to setup something similar like your requirement. I got to monitor all windows services and send out an alert. If you were successful in configuring USB device, can you please let me know the steps.
This is more an OS then Splunk related question. You must first figure out how those 10 OS's report process status and USB connects. If you're using any unix/linux OS try the Splunk Unix App https://splunkbase.splunk.com/app/273/ and search your processes and USB events in index=os. Read more about the app here http://docs.splunk.com/Documentation/UnixApp/5.0.2/User/Whatdataarecollected
For Windows there is an app as well https://splunkbase.splunk.com/app/1680/ , but I'm not sure how or if your will be able to get the USB events (WMI maybe?)
Hope this helps to get you started ...