Getting Data In

Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

akelly4
Path Finder

I created a script that will run on all of my universal Forwarders that are running Windows. It's a simple script that is going to pull IP, Host Name, and Original Install Date. Below is what the script looks like.

Script:
CD C:\
ECHO ON
ipconfig | findstr /i "IPv4 Address"
systeminfo | findstr /i /c:"Host Name" /c:"Original"

So the script runs successfully on the UF and the results are indexed, however something weird is happening. No matter how I form the script it never returns the install date of the machine. I've manually ran the batch file on the machine with the UF and everytime it's returning the Original install date. I can't figure out why no matter how I script it the install date isn't pulled back?

C:\Windows\system32>CD C:\
C:>ECHO ON
C:>ipconfig | findstr /i "IPv4 Address"
IPv4 Address. . . . . . . . . . . : 10.2.3.4
C:>systeminfo | findstr /i /c:"Host Name" /c:"Original"
Host Name: TestMachine


When I run the script manually I always see this additional piece of information

Original Install Date: 04/26/2015, 7:51:13 AM

0 Karma

jimodonald
Contributor

Is Splunk locating that timestamp and using it as the event time?

You can check the raw data that Splunk is ingesting with

index= sourcetype= | table _raw

0 Karma

akelly4
Path Finder

No it's just not being indexed.

0 Karma

jimodonald
Contributor

Using the example above, you do not see the event on April 26, 2015 (a future time from today) -- but whatever the relevant timestamp is from your environment?

How do you know it's not being indexed?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!