As we are using the AD Domain Controller security logs for audit purposes, we want a query to validate there are no missing Security events.
We created the following query which works for a single DC/short time period ok:
index=dcsecurity host=********DC1 earliest="12/1/2017:06:30:00" latest="12/1/2017:14:30:00"
| sort 0 EventRecordID | delta EventRecordID as id_diff | search id_diff>1
| eval FirstMissingEvent=EventRecordID-id_diff+1 | eval LastMissingEvent=EventRecordID-1
| eval Time=strftime(_time, "%d/%m/%Y %l:%M:%S %p")
| table host,Time,EventRecordID,id_diff,FirstMissingEvent,LastMissingEvent
This was run for a period we know there were some missing events and show exactly which EventRecordID's are missing, along with DC server name, time, how many records are missing and the first/last missing EventRecordID numbers.
Can someone help to create a similar script which can be run using foreach command or similar?
We would like to run a single query instead of separately for each DC server (we have > 15 DC's to check).
Looking at running over historic events in the "dcsecurity" index and saving results to a separate "dcsecurity_delta" summary index.
This will take considerable time to run, so any suggestions on streamlining the query or scheduling would be appreciated
