Splunk Search

How to create a weekly report comparing changes in Domain Controllers' Operating System Type and Version?

DanAlexander
Path Finder

Hello All,

I would like to be able to track down any and every configuration change on our monitored DC, AD etc.

I need to be able to see those changes in comparison fashion - week to week.

I aim to create an auto report that would run every Monday for instance and let us know of any changes being introduced on the monitored assets (focusing on OS type; Linux, Windows and their previous and current versions).

Thank you All in advance!

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @DanAlexander,

usually this add-on is always present in ES installations, so you shouldn't have problems and should already have it.

At the same time, usually, on ES machines aren't installed other apps than ES and its add-ons (between them also TA-Windows), but if your custom app isn't so heavy, it shouldn't bring too much load

Without the data ingested with this add-on isn't possible to have the data to use for this check.

Answering to your last question: these informations aren't extracted from WinEventLog but using some script in the TA, so it's very difficoult to have them without the TA.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @DanAlexander,

you can installa a Universal Forwarder on your DCs and deploy the Splunk-TA_Windows (https://splunkbase.splunk.com/app/742/)

in this TA you can enable the acquisition of all configuration informations and then check if there's some change.

Ciao.

Giuseppe

0 Karma

DanAlexander
Path Finder

Morning @gcusello 

I should have mentioned that we do have UFs installed on the assets and we have logs coming into Splink. 

I need a search query, please

Thank you!

0 Karma

gcusello
Esteemed Legend

Hi @DanAlexander,

if you enabled the input stanzas in TA-Windows, you should be able to see all panels of this dashboard that displays all the server information:

<form>
  <label>Hardware and Software Details: Windows Servers</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host">
      <label>Server</label>
      <prefix>host="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=windows sourcetype=WinHostMon Type=Computer | eval host=upper(host) | dedup host | sort host | table host</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>HostName</title>
      <html>
      <h3 align="center">
        <strong> <font size="10">Server<img src="/static/app/infrastructure_monitoring/Windows_logo.png" style="height:100px;border:0;"/>
            </font>
          </strong>
        </h3>
    </html>
      <single>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Computer $host$
            | eval host=upper(host)
            | dedup host 
            | sort host
            | table host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Model</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Computer $host$ 
            | eval host=upper(host)
            | dedup host 
            | lookup Server host OUTPUT IP Tipologia
            | table Manufacturer Model IP Tipologia</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
    <panel>
      <title>Operative System</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
            | eval host=upper(host)
            | dedup host 
            | sort host 
            | table OS Version ServicePack BuildNumber SerialNumber InstallDate LastBootUpTime
            | eval 
               InstallDate=strftime(strptime(InstallDate,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S"),
               LastBootUpTime=strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Hardware</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>CPU</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Processor $host$ 
            | eval host=upper(host)
            | dedup host 
            | sort host
            | table Name NumberOfCores Architecture ClockSpeedMHz Manufacturer
            | rename name AS CPU  Manufacturer AS "CPU Manufacturer"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
    <panel>
      <title>RAM</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
            | eval host=upper(host)
            | dedup host 
            | sort host 
            | eval 
              FreePhysicalMemoryGB=FreePhysicalMemoryKB/1024/1024,
              FreeVirtualMemoryGB=FreeVirtualMemoryKB/1024/1024,
              TotalPhysicalMemoryGB=TotalPhysicalMemoryKB/1024/1024,
              TotalVirtualMemoryGB=TotalVirtualMemoryKB/1024/1024,
              Virtual_mem_free_percent=FreeVirtualMemoryKB/TotalVirtualMemoryKB*100
            | table FreePhysicalMemoryGB TotalPhysicalMemoryGB mem_free_percent FreeVirtualMemoryGB TotalVirtualMemoryGB Virtual_mem_free_percent  
            | rename FreePhysicalMemoryGB AS "Free Physical Memory" TotalPhysicalMemoryGB AS "Total Physical Memory" mem_free_percent AS "Free Physical Memory%" FreeVirtualMemoryGB AS "Free Virtual Memory" TotalVirtualMemoryGB AS "Total Virtual Memory" Virtual_mem_free_percent AS "Free Virtual Memory%"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <format type="number" field="FreeVirtualMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="FreePhysicalMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="TotalVirtualMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="TotalPhysicalMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="FreePhysicalMemory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="FreeVirtualMemory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="Free Physical Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Total Physical Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Physical Memory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="Free Virtual Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Total Virtual Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Virtual Memory%">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Disks</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Disk $host$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | eval 
              storage=storage/1024,
              storage_free=storage_free/1024,
              storage_used=storage_used/1024,
              storage_free_perc=storage_free/storage*100
            | table Name DriveType FileSystem storage storage_free storage_used storage_free_perc
            | rename storage AS "Disk Space" storage_free AS "Free Disk Space" storage_used AS "Used Disk Space" storage_free_perc AS "Free Disk Space %"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Network Adapters</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=NetworkAdapter $host$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | table Name Manufacturer ProductName</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Software</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Applications</title>
      <input type="text" token="appname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Application $host$ $appname$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | eval InstallDate=strftime(strptime(InstallDate,"%Y%m%d"),"%d/%m/%Y")
            | table Name Vendor Version SerialNumber InstallDate InstallLocation</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Drivers</title>
      <input type="text" token="drivname">
        <label>Name</label>
        <default>*</default>
        <prefix>DeviceID="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Driver $host$ $drivname$
            | eval host=upper(host)
            | dedup DeviceID 
            | sort DeviceID 
            | table DeviceID DriverVersion</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Run</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Processes</title>
      <input type="text" token="procname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Process $host$ $procname$
            | eval host=upper(host)
            | dedup Name
            | sort Name
            | eval StartTime=strftime(strptime(StartTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S")
            | table Name Path ProcessId StartTime</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Services</title>
      <input type="text" token="servname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Service $host$ $servname$
            | eval host=upper(host)
            | dedup Name 
            | sort Name
            | table Name DisplayName Description Path Started StartMode State</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 Then to map differences, you should make a stats dc for each information, e.g.

index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
| stats 
   dc(TotalPhysicalMemoryKB) AS TotalPhysicalMemoryKB_count 
   dc(TotalVirtualMemoryKB) AS TotalVirtualMemoryKB_count
   BY host
| where TotalPhysicalMemoryKB_count>1 OR TotalVirtualMemoryKB_count>1

Ciao.

Giuseppe

0 Karma

DanAlexander
Path Finder

Hi @gcusello 

Thank you for the feedback. All that makes lots of sense.

However, I wanted to know if we can do simple stats without the Add-on? We have a restricted ability to install add-ons to our ES instance. Are they any Win Event Logs that can generate those figures by a chance, please?

D

0 Karma

gcusello
Esteemed Legend

Hi @DanAlexander,

usually this add-on is always present in ES installations, so you shouldn't have problems and should already have it.

At the same time, usually, on ES machines aren't installed other apps than ES and its add-ons (between them also TA-Windows), but if your custom app isn't so heavy, it shouldn't bring too much load

Without the data ingested with this add-on isn't possible to have the data to use for this check.

Answering to your last question: these informations aren't extracted from WinEventLog but using some script in the TA, so it's very difficoult to have them without the TA.

Ciao.

Giuseppe

DanAlexander
Path Finder

Hi,

Thanks for the advice, @gcusello. Much appreciated!

Ciao

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...