Skip to main content
Splunk Lantern

All Windows events on a host

You might want to see all Windows events on a host when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

Windows event logs provide valuable information that can be used during an investigation to facilitate answering questions about the hosts behavior, state, health, or performance. You want visibility into all Windows event logs on a host.

To optimize the search shown below, you should specify an index and a time range.

  1. Verify that you deployed the add-on to the search heads and Splunk Universal Forwarders on the monitored systems. For more information, see About installing Splunk add-ons.
  2. Run the following search: 
host="<name of host to check>" source=WinEventLog:* <optional keywords>

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
host="<name of host to check>" source=WinEventLog:* <optional keywords>

Search index(es) where Windows event log data is being collected and filter down to the desired host(s) to check. 

Add optional keywords that are relevant to the investigation. For instance, adding "service stopped" to the search might help uncover instances where a service was stopped on the host. Otherwise, delete this part of the search.

Result

This information provided by this search can help in other investigations.

  • Was this article helpful?