Hi
I need to collect some events from Windows Security log. My task is to collect some logs from all servers which I have and some additional logs from low number of servers.
I tried to do this creating to similar apps (just copying) based on Splunk add-on for Windows, but with different whitelist in inputs.conf and deploying them using different server classes. This resulted in working of only one app.
How can I complete my task?
My recommendation is create a series of DS apps that contain the inputs, usually one for each event log branch you want to collect, something like:
DS-all_departments-Inputs-wineventlog_security
DS-all_departments-Inputs-wineventlog_system
DS-all_departments-Inputs-wineventlog_application
Then, in your serverclass.conf, you can mix and match as needed:
# get the windows security logs from all windows systems
[serverClass:WinSecurity]
whitelist.0=*
machineTypesFilter=windows-*
[serverClass:WinSecurity:app:DS-all_departments-Inputs-wineventlog_security]
[serverClass:WinApplication]
whitelist.0=prod.yourcompany.com
[serverClass:WinApplication:app:DS-all_departments-Inputs-wineventlog_application]
# note that we don't have to add the winsecurity logs,
# as they are already in another class which includes all windows systesm
[serverClass:WinTheWorks]
whitelist .0 = appservers.yourcompany.com
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_application]
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_system]
You can then distribute the Splunk_TA_windows to your indexers and search heads only, not all of your enterprise. But, you can use the inputs.conf from the TA as the base for your input apps.
We have done this by setting up the less-important input with the legacy method of doing windows events: set up the Windows logging facility on the forwarders to write that subset of events to disk on the forwarder and then monitor that log file.
Thank you!
It's a good idea as a workaround, but first of all I want to find complete and manageble solution.