Getting Data In
Highlighted

Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

Path Finder

I created a script that will run on all of my universal Forwarders that are running Windows. It's a simple script that is going to pull IP, Host Name, and Original Install Date. Below is what the script looks like.

Script:
CD C:\
ECHO ON
ipconfig | findstr /i "IPv4 Address"
systeminfo | findstr /i /c:"Host Name" /c:"Original"

So the script runs successfully on the UF and the results are indexed, however something weird is happening. No matter how I form the script it never returns the install date of the machine. I've manually ran the batch file on the machine with the UF and everytime it's returning the Original install date. I can't figure out why no matter how I script it the install date isn't pulled back?

C:\Windows\system32>CD C:\
C:>ECHO ON
C:>ipconfig | findstr /i "IPv4 Address"
IPv4 Address. . . . . . . . . . . : 10.2.3.4
C:>systeminfo | findstr /i /c:"Host Name" /c:"Original"
Host Name: TestMachine


When I run the script manually I always see this additional piece of information

Original Install Date: 04/26/2015, 7:51:13 AM

0 Karma
Highlighted

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

Contributor

Is Splunk locating that timestamp and using it as the event time?

You can check the raw data that Splunk is ingesting with

index= sourcetype= | table _raw

0 Karma
Highlighted

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

Path Finder

No it's just not being indexed.

0 Karma
Highlighted

Re: Why is my script running on Windows universal forwarders not pulling "Original Install Date", only IP and Host Name?

Contributor

Using the example above, you do not see the event on April 26, 2015 (a future time from today) -- but whatever the relevant timestamp is from your environment?

How do you know it's not being indexed?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.