Sample searches and dashboards
This topic lists searches that you can perform to confirm that Windows data has arrived at the indexer.
Search Windows data
To confirm that Windows data is present on the indexer, use the Search app:
- Log into Splunk Enterprise on the indexer, if you have not already.
- Load the Search app. In the system bar, select Apps > Search & Reporting. Splunk loads the Search app.
- Try the following searches to confirm that data is present:
- This search confirms that the Splunk Add-on for Windows is sending data to the indexer:
index=wineventlog
- This search confirms that the Splunk Add-on for Windows has been installed properly on the deployment client named
<host_name>
:
index=wineventlog host=<host_name>
- If the user has used custom index in TA_windows then the user has to search with that index:
index=windows
Can't find the data?
Try the following:
- Use Forwarder Management to confirm that the Splunk Add-on for Windows has been deployed to your deployment clients.
- Confirm that you have enabled Windows inputs in the Splunk Add-on for Windows. If not, make changes and deploy the app again.
- Refer to the Troubleshooting manual for additional help.
Confirm and troubleshoot Windows data collection | Download and configure the Splunk Add-on for Windows version 6.0.0 or later |
This documentation applies to the following versions of Splunk® App for Windows Infrastructure (Legacy): 1.5.0, 1.5.1, 1.5.2, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4
Feedback submitted, thanks!