Getting Data In

How to query a List of Domain Controllers?

itsmevic
Communicator

I'd like to pull a complete listing of all domain controllers in my environment and I'd like to do it through Splunk. Does anyone have some helpful SPL that can query the network for this?

0 Karma

Azeemering
Builder

On the other hand you can look for eventcodes that a domain controllers generates:

For example 4776: The domain controller attempted to validate the credentials for an account

index=*win* source="*WinEventLog:Security" EventCode=4776
| rename ComputerName as DomainControllerName
| table _time DomainControllerName user

 
This will give you a list of your domain controllers....as long as you have windows clients sending their eventlogs to Splunk ofcourse.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

SPL cannot query a network. SPL queries data stored in Splunk indexers. If you have indexed a list of your servers in Splunk then SPL can be used to query that data to find DCs.

There are exceptions, of course. The Splunk for Asset Discovery app (https://splunkbase.splunk.com/app/662/) uses the nmap utility to scan networks for devices and indexes the results. The Splunk Supporting Add-on for Active Directory app (https://splunkbase.splunk.com/app/1151/) can query Active Directory for information, which might include DCs.

OTOH, if your DCs are reporting events to Splunk now, you can use this query to get their names. Modify the "dc" to match the name scheme for your DCs.

| metadata type=hosts | search host="*dc*"
---
If this reply helps you, Karma would be appreciated.
0 Karma

mazharuddin
New Member

what is the spl query to check all logs of DC ?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...