Can i use Splunk to monitor windows scheduled jobs?

[sampathkonka]

We're having a few Batch Jobs scheduled using windows task scheduler. In certain situations the batch jobs are not triggering or failing to run. Currently every day we're manually monitoring whether the jobs are running without any issues or not. Is it possible to monitor those scheduled tasks are running or not using Splunk? if so can i send a real time alert in case of job fail using Splunk?

These Jobs are scheduled in remote server where we're having Splunk Universal forwarder.

Could you please assist with the solution for above use case.

Thanking you,

Regards,
Sampath Konka.

[somesoni2 · Accepted solution]

The windows scheduler task logs are written to Application Event logs. You can setup monitoring for those specific event logs to first get the data in Splunk. Once you've data in Splunk you can setup alerting. See this for more details.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/MonitorWindowseventlogdata#Use_the_.22Fu...

Howevers, instead of using a real-time alert, I would recommend using a regular scheduled alert with appropriate frequency/cron schedule.

[santosh_sshanbh]

Thanks for the link bwlm. This really helps.

[bwlm]

The link to the "SplunkCloud" docs apparently require a logon, for general public details here is a better link: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_the_.22Full_...

[sampathkonka]

Hi Somesoni2,

Thanking you for your inputs. I'll have a look into the above URL to get solution for above posted use case.

Sorry for the delay in response.

Sampath Konka

[sampathkonka]

Thanking you So much Somesoni2,

I'm able to read the windows scheduler task logs from remote server using Splunk forwarder 🙂

Regards,
Sampath Konka.

[santosh_sshanbh]

Can you please provide details on how did you achived this? In my case I am not seeing any events in Application windows log.