Splunk Search

get AD Computer with PowerShell

TheOnlyOne
Observer

Hello,

i have a powershell script that give me ad computer objects back.
it works perfect.
The Script run every 24h. Cron Schedule 0 */1440 * ? * *

Im not sure about the time settings. I will get every time the summary of AD Computer Objects

My search is:
sourcetype=AD DNSHostName="W10_1*" | stats count as Total

The Problem is i get every time differnt values back. At the moment i have set Date & TIme Range last 24h.
At 2 o clock i get 200 Objects back, at 3 o clock i get 130 Objects back 😞

I get from the script every 24h new data. in this Time i will see the right values.

Can anybody help me?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...