Reporting

Create report showing total servers and what sourcetypes they are collecting, including operating system and version

shandman
Path Finder

I'm working on a query that will tell me all the servers reporting in my environment, but broken down by operating system and version. I also need to see what exactly each host is logging. So I was thinking of two separate queries:
1. index=_internal |dedup os,hostname| stats count(hostname) by os
this one doesn't show me the variations of OS. I need help with that.
2. This search would show all Windows servers and what sourcetypes they are collecting. I need to ensure they are logging security data.

I hope this makes sense. Thanks for the help guys.

0 Karma

adonio
Ultra Champion
  1. you have this report in the DMC (MC) under forwarders
  2. look for ways to verify your windows hosts send the correct data, many answers here about this subject hope it helps
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...