I was wondering if there was a way to search for the Date and Time settings on a remote server? I can't seem to find anything on my own. Thank you.
I use the Splunk_TA_windows app to collect the date and time from all of my Windows servers. Specifically, the script win_timesync_status.bat. You can download the app from Splunkbase: https://splunkbase.splunk.com/app/742/
I found I had to add a few lines into props.conf for the app, to get the events to break correctly:
[Script:timesync]
BREAK_ONLY_BEFORE = Current time:
TIME_FORMAT = %d/%m/%Y %k:%M:%S.%3N
TIME_PREFIX = time:\s[a-zA-Z]+\s