Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

[akelly4]

I created a script that will run on all of my universal Forwarders that are running Windows. It's a simple script that is going to pull IP, Host Name, and Original Install Date. Below is what the script looks like.

Script:
CD C:\
ECHO ON
ipconfig | findstr /i "IPv4 Address"
systeminfo | findstr /i /c:"Host Name" /c:"Original"

So the script runs successfully on the UF and the results are indexed, however something weird is happening. No matter how I form the script it never returns the install date of the machine. I've manually ran the batch file on the machine with the UF and everytime it's returning the Original install date. I can't figure out why no matter how I script it the install date isn't pulled back?

C:\Windows\system32>CD C:\
C:>ECHO ON
C:>ipconfig | findstr /i "IPv4 Address"
IPv4 Address. . . . . . . . . . . : 10.2.3.4
C:>systeminfo | findstr /i /c:"Host Name" /c:"Original"
Host Name: TestMachine

---

When I run the script manually I always see this additional piece of information

Original Install Date: 04/26/2015, 7:51:13 AM

[jimodonald]

Is Splunk locating that timestamp and using it as the event time?

You can check the raw data that Splunk is ingesting with

index= sourcetype= | table _raw

[akelly4]

No it's just not being indexed.

[jimodonald]

Using the example above, you do not see the event on April 26, 2015 (a future time from today) -- but whatever the relevant timestamp is from your environment?

How do you know it's not being indexed?