All Apps and Add-ons

Running two TAs simultaneously

ArsenyKapralov
Path Finder

Hi

I need to collect some events from Windows Security log. My task is to collect some logs from all servers which I have and some additional logs from low number of servers.
I tried to do this creating to similar apps (just copying) based on Splunk add-on for Windows, but with different whitelist in inputs.conf and deploying them using different server classes. This resulted in working of only one app.

How can I complete my task?

0 Karma

dshpritz
SplunkTrust
SplunkTrust

My recommendation is create a series of DS apps that contain the inputs, usually one for each event log branch you want to collect, something like:

DS-all_departments-Inputs-wineventlog_security
DS-all_departments-Inputs-wineventlog_system
DS-all_departments-Inputs-wineventlog_application

Then, in your serverclass.conf, you can mix and match as needed:

# get the windows security logs from all windows systems
[serverClass:WinSecurity]
whitelist.0=*
machineTypesFilter=windows-*
[serverClass:WinSecurity:app:DS-all_departments-Inputs-wineventlog_security]

[serverClass:WinApplication]
whitelist.0=prod.yourcompany.com
[serverClass:WinApplication:app:DS-all_departments-Inputs-wineventlog_application]

# note that we don't have to add the winsecurity logs, 
# as they are already in another class which includes all windows systesm
[serverClass:WinTheWorks]
whitelist .0 = appservers.yourcompany.com
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_application]
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_system]

You can then distribute the Splunk_TA_windows to your indexers and search heads only, not all of your enterprise. But, you can use the inputs.conf from the TA as the base for your input apps.

0 Karma

woodcock
Esteemed Legend

We have done this by setting up the less-important input with the legacy method of doing windows events: set up the Windows logging facility on the forwarders to write that subset of events to disk on the forwarder and then monitor that log file.

0 Karma

ArsenyKapralov
Path Finder

Thank you!
It's a good idea as a workaround, but first of all I want to find complete and manageble solution.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...