Splunk Dashboard Query to List when CD Drive is access and Written to

[Rosie2287]

Is there a Splunk query I can use to list when CD drive is access and written to and the users associated with those actions made

[Rosie2287]

New splunk user here - 

No, I was looking for a query I could add to my dashboard that would look in system logs that would check for when the CD drive is accessed or burned to.  

[ITWhisperer]

If the system logs have been ingested into Splunk, you need to identify which events in those logs include the information you are looking for. You can then tell Splunk how to pull out those events so you can report on them in your dashboard. We do not have access to your data, it is only something that you can determine

[Rosie2287]

Ok thank you.  I am not sure about which events report CD Drive actions.  I was just wondering if there was a general dashboard query that could be used to identify cd drive usage.

[ITWhisperer]

Probably not - Splunk is a generalised tool for analysing logs not a windows-specific tool

[ITWhisperer]

Is this information in a log somewhere that you have ingested into Splunk?