Splunk query to identify the list of printers from a host=print server, which are not printed for years

sanketa sosatti 41 Reputation points
2021-04-06T05:30:31.023+00:00

Team,
i have been using splunk as a monitoring tool for all our infra printers, i am unable to identify the unused\neverprinted printers to clean up.

this query is just giving me the list of printers printed events, but not the unused printers from long years.

host=USSLCPRTHPENG0* SourceName=Print | rex "printed on (?<Printer_queue>\w+)" |rex "port (?<Port>\w+)" |rex "Size in bytes: (?<Size>\w+)" | search Printer_queue = * | timechart count(_raw) by Printer_queue limit=150

host="usslcp1prapac01" SourceName=Print | rex "printed on (?<Printer_queue>\w+)" |rex "port (?<Port>\w+)" |rex "Size in bytes: (?<Size>\w+)" | search Printer_queue = * | timechart count(_raw) by Printer_queue

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,355 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ian Xue (Shanghai Wicresoft Co., Ltd.) 29,486 Reputation points Microsoft Vendor
    2021-04-06T07:05:42.887+00:00

    Hi @sanketa sosatti ，

    As your issue is related to the Splunk Search Processing Language rather than PowerShell, you'd better ask the question in the splunk community

    https://community.splunk.com/t5/Community/ct-p/en-us

    Best Regards,
    Ian Xue

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments