Getting Data In

To monitor which Windows server are not sending logs to Splunk

karambaz
New Member

I want to check which server are not sending logs to Splunk as our monthly maintenance. Can you guys help me what is the correct query for this? Thanks

0 Karma

gpchnd007
New Member

I'm using below query for check the which server/devices are not reporting to Splunk.

| metadata index=windows OR index=wineventlog type=hosts | eval age = now()-lastTime | where age > (2*86400) | convert ctime(lastTime) | fields age,host,lastTime

0 Karma

MHibbin
Influencer

If you are using forwarders to send logs to the Indexer, I would say just to use the Deployment Monitor app, to check up this. It will tell you the last update received from the forwarders, so you would be able to gauge from their which need to be check up on.

Hope this helps.

0 Karma

karambaz
New Member

Thanks for the info sir..but what about the query? Do you have any idea on what is a good query to run this?

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...