I am looking for Splunk query to find out Windows remote desktop service status and also to find to port 3389 is listening on server..
Question is what kind of data you have in your Splunk.
Remember that Splunk is a data analytics solution, not an EDR, A/V, web-gateway or anything else.
So in order to find some information in it you first have to ingest the data. In other words - if you're not monitoring the system you want to query Splunk about, you won't get any information because Splunk doesn't know anything about.
Any advice pls.