Does Splunk have the ability to use different sets of credentials for different monitoring on Windows?
It appears only one credential can be used for WMI to pull Windows events from across the environment and no local credentials can be used.
For instance, if I have Windows machines on several different domains as well as local DMZ workgroups, I will probably have one than one user account (they won't all be the same).
Also, we may not have the ability to deploy agents out as LWFs, just so you know.
Splunk uses the account it runs under to pull remote WMI.
You have the following options available for remote WMI at this point:
If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.
Splunk uses the account it runs under to pull remote WMI.
You have the following options available for remote WMI at this point:
If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.