Getting Data In

How to deploy Splunk and collect 10,000+ Windows logs? Does anyone have any good documentation or advice to provide me?

bobbieluturner
New Member

I am a newbie - I've been tasked with deploying Splunk and collecting 10,000+ Windows logs... Anyone got any good whitepaper or advice to provide me?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Hi bobbieluturner,
to add to woodcock's comments...
What exactly does that mean: 10,000+ Windows logs? Are you referring to logs from 10k+ Windows hosts?
What kinds of logs, what log volume are you expecting per day?

But simply the fact that you mentioned 10,000+ anything, I would answer by saying that you need more than just a white paper. Are you already a customer? If so, you should have access to a pre-sales technical resource to help you with this.

If not, starting at our documentation here is not a bad idea. You'll probably need to read up on
- proper sizing given your expected daily log data volume, data retention, search volume and concurrent users
- recommended hardware specs
- general Splunk architecture (forwarding, indexing, search)
- managing your deployment (configuration management with Deployment Server)
- how to get data in properly (timestamping, source typing, line breaking, etc.)

If you update your question with a bit more detail of what your target deployment is supposed to provide, the community may be able to give you a more targeted answer.

Good luck, and welcome to the world of Splunk! 🙂
Stefan

0 Karma

tom_frotscher
Builder

Hi,

as a first look, use the offical splunk docs.

For example how to install: here
or about getting windows data into splunk: here

Greetings

Tom

woodcock
Esteemed Legend

How many servers? What is the post-backlog daily bandwidth (GB/day of raw data) overall? Are these actually "logs" or is it WMI? Do you have any aggregation agents currently deployed (e.g. Snare)? If you would like to get any kind of useful responses you will need to give much more detail.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...