Deployment Architecture

Is there a way to detect in Splunk if a server was removed or deleted?

cds2016
New Member

Is there a way to detect in Splunk if a server was removed or deleted from the network?

0 Karma

woodcock
Esteemed Legend

You can set up a scripted input to ping the forwarder (there are apps on Splunkbase for this) and setup an alert to let you know when any server is unreachable for a period of time. Also setup splunk WinEventLog://Security from the servers to be forwarded into Splunk. Then you should be able to see the last person to login to that server, who should be the one who shut it down.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

One option could be to ping the servers using a scripted input and index the output to Splunk. Then based on the output of the ping, you can detect if the servers is in network or not.

0 Karma

cds2016
New Member

@Somesoni2,
Hi. The server is unreachable via ping. I am looking more towards who and when may have shut down the server. Any thoughts?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...