Splunk Search

How do I run my search to find missing events on 80 Windows Domain Controllers running Splunk 6.1.4?

daniel_knights
New Member

We have Splunk running on all of our Windows Domain Controller servers (80 of them), but we seem to be missing events:

To try and find the missing events I run the below search:

host=server1* source="WinEventLog:Security" | sort 10000000 RecordNumber |delta RecordNumber as ID_diff |search ID_diff>1 |table _time RecordNumber ID_diff

While this search works, it must run per server and with 80 servers to run on, this can take a long time to do.

Is there a way to run this search on all of my servers at once and not have it interfere with other results?

We are running Splunk 6.1.4
Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you know you can acclerate reports? That might be an easy fix for your problem. But you should also consider the time your search covers. If it's a long span, then you might want to have a look at summary indexing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...