How to view host disk encryption status

[dfiore42]

I need a query to view disk encryption (DAR) of all my hosts, be it Bit Locker, LUKS, etc.

index=* host=* | ???

Thank you in advance.

[ragedsparrow]

Do you have data in splunk that denotes that the disk in encrypted?  There are a few things to know here:

• Where your data is stored (index)
• What differentiates your data  (sourcetype, source, etc)
• Is your data that you need being monitored? 

Specifically for BitLocker, those are included in Windows Events.  This answer may be helpful in finding where they are: https://community.splunk.com/t5/Getting-Data-In/Retrieving-Windows-Event-logs-with-hyphens-in-the-na...