Getting Data In

How to collect Windows event logs without installing a universal forwarder?

kpavan
Path Finder

Hi All,

I need to collect the logs from a Windows machine into Splunk without installing any agent (universal forwarder). I just wanted to know how to achieve this in Splunk 6.3 running on RedHat 6.

With ref: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWMIdata?r=searchtip

It says need to install Splunk Enterprise on Windows, but I don't want to install the any software on the servers since my client doesn't want to. So please let me know steps to achieve this.

Thanks!

0 Karma

alemarzu
Motivator

Hi kpavan,

You could try doing this
https://code.google.com/archive/p/eventlog-to-syslog/

Hope it helps.

0 Karma

gmerhej_splunk
Splunk Employee
Splunk Employee

You can install Splunk Heavy Forwarder on a windows machine, collect WMI data and forward them to your Splunk Indexers running on RedHat 6.

kpavan
Path Finder

can't we get without installing HF as well?

0 Karma

gmerhej_splunk
Splunk Employee
Splunk Employee

You will need a Windows machine to collect WMI data.

If your Splunk setup is non-Windows, you'll need a separate Windows instance running HF or UF.

See the paragraph "Search Windows Data on a non-Windows Instance of Splunk Enterprise": http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/ConsiderationsfordecidinghowtomonitorWindowsd...

If you opt for a UF, you cannot configure the WMI from the web interface but you can do the same through the wmi.conf:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWMIdata

kpavan
Path Finder

Thanks for your information!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...