Printer information in a Windows environment

You might want basic information about the printers in your Windows environment when doing the following:

• Managing peripherals in a Windows environment

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

Your boss has asked you to start gathering basic statistics on printer activity in your organization. He would like to know how many print servers and printers there are, as well as what the spooling load is at various times of the day. This information will help with resource planning.

1. Verify that you deployed the add-on to the search heads and Splunk Universal Forwarders on the monitored systems. For more information, see About installing Splunk add-ons.
2. Enable the following inputs:
   • *WinPrintMon://printer
   • *WinPrintMon://job
   • *WinPrintMon://driver
   • *WinPrintMon://port
3. To see only the number of printers on your network, run the following search: 

   eventtype=printmon_windows 
   |stats dc(ComputerName) AS "Print Servers"  dc(printer) AS Printers

4. For detailed information about the jobs running on the servers, run the following search: 

   eventtype=printmon_windows 
   |dedup JobId, ComputerName 
   |rename ComputerName AS "Print Server" 
   |stats count(JobId) AS "No. of Print Jobs" BY "Print Server" 
   |appendpipe 
       [ stats sum("No. of Print Jobs") AS "Total No. of Print Jobs" 

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The table below shows sample output from the first search. It shows the number of print servers and printers. If you were to look at all the interesting fields, you could find other items that could be reported on in support of your needs, for example, the name of the document being printed, printer name, printer driver, user, submitted time, and total pages. A simple search of only the source type gives the list of available fields. 

The next table shows sample output from the second search. These results show the number of unique printer jobs run on each print server and the total. This is just one example of the many metrics one could derive from the data set captured by the add-on for Windows.