To monitor which Windows server are not sending logs to Splunk

[karambaz]

I want to check which server are not sending logs to Splunk as our monthly maintenance. Can you guys help me what is the correct query for this? Thanks

[gpchnd007]

I'm using below query for check the which server/devices are not reporting to Splunk.

| metadata index=windows OR index=wineventlog type=hosts | eval age = now()-lastTime | where age > (2*86400) | convert ctime(lastTime) | fields age,host,lastTime

[MHibbin]

If you are using forwarders to send logs to the Indexer, I would say just to use the Deployment Monitor app, to check up this. It will tell you the last update received from the forwarders, so you would be able to gauge from their which need to be check up on.

Hope this helps.

[karambaz]

Thanks for the info sir..but what about the query? Do you have any idea on what is a good query to run this?