Getting Data In

List of Domain Controllers


I'd like to pull a complete listing of all domain controllers in my environment and I'd like to do it through Splunk. Does anyone have some helpful SPL that can query the network for this?

0 Karma


SPL cannot query a network. SPL queries data stored in Splunk indexers. If you have indexed a list of your servers in Splunk then SPL can be used to query that data to find DCs.

There are exceptions, of course. The Splunk for Asset Discovery app ( uses the nmap utility to scan networks for devices and indexes the results. The Splunk Supporting Add-on for Active Directory app ( can query Active Directory for information, which might include DCs.

OTOH, if your DCs are reporting events to Splunk now, you can use this query to get their names. Modify the "dc" to match the name scheme for your DCs.

| metadata type=hosts | search host="*dc*"
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!