Getting Data In

Monitor missing WMI events pull Windows Server

rossikwan
Path Finder

Hi all,

I have below Splunk setup for the various kind of servers events,

  1. Main indexer: Linux Redhat installed with Splunk indexer, search head, (for UNIX UF, Linux UF, syslog, etc)
  2. Domain joined Windows server with Splunk UF installed (for WMI pull events, shared files, etc)

Since I would like to monitor the missing status of the UNIX & Linux UF, the "missing forwarders search" in Splunk Deployment Monitor app is working fine for those hosts received from UF. It does a really great job at all.

But, since most of the Windows WMI events is pulled from the Windows Server (with UF), and that's mean the "missing forwarder search" isn't represent for the WMI host missing status.

Could anyone help that any hints to check the missing Windows host in this WMI inputs?

P.S. I am thinking that use "diff" to compare the list of hosts for WMI events in 2 period of time, and I think there should have a faster & elegant way for this. Thanks in advance.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes, you can alert on any host that hasn't sent data in a certain period of time. The example in the link below is checking every 60 seconds but it's easy to modify.

http://splunk-base.splunk.com/answers/7466/alert-if-no-log-messages

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...