Splunk Search

How do I run my search to find missing events on 80 Windows Domain Controllers running Splunk 6.1.4?

daniel_knights
New Member

We have Splunk running on all of our Windows Domain Controller servers (80 of them), but we seem to be missing events:

To try and find the missing events I run the below search:

host=server1* source="WinEventLog:Security" | sort 10000000 RecordNumber |delta RecordNumber as ID_diff |search ID_diff>1 |table _time RecordNumber ID_diff

While this search works, it must run per server and with 80 servers to run on, this can take a long time to do.

Is there a way to run this search on all of my servers at once and not have it interfere with other results?

We are running Splunk 6.1.4
Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you know you can acclerate reports? That might be an easy fix for your problem. But you should also consider the time your search covers. If it's a long span, then you might want to have a look at summary indexing.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...