Splunk Search

How do I run my search to find missing events on 80 Windows Domain Controllers running Splunk 6.1.4?

daniel_knights
New Member

We have Splunk running on all of our Windows Domain Controller servers (80 of them), but we seem to be missing events:

To try and find the missing events I run the below search:

host=server1* source="WinEventLog:Security" | sort 10000000 RecordNumber |delta RecordNumber as ID_diff |search ID_diff>1 |table _time RecordNumber ID_diff

While this search works, it must run per server and with 80 servers to run on, this can take a long time to do.

Is there a way to run this search on all of my servers at once and not have it interfere with other results?

We are running Splunk 6.1.4
Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you know you can acclerate reports? That might be an easy fix for your problem. But you should also consider the time your search covers. If it's a long span, then you might want to have a look at summary indexing.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...