Getting Data In

How can I get data in to splunk enterprise?

upload
New Member

Dear all,
I'm a beginer. I just built up splunk enterprise. could you please help me to get data from windows servers? because I dont know how to deal with them. one more thing, I also tried to read with documents from splunk but still cannot understand to handle. kindly please help me.
thank you so much~~

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, it sounds like you need to work through the free training (Fundamentals 1). That can help you get a little bit of experience.

For THAT, start here - https://www.splunk.com/en_us/training.html About halfway down the page there is a big button for the free fundamentals class. Follow the instructions, do the class. It may take five, or ten, or even fifteen hours, but it will save you hundreds of hours of flailing.

After you've done that, get onto the splunk slack channel so you can get quick and simple feedback on your next steps.

The standard way to get data from a windows machine is to load onto the windows machine a very light version of Splunk called a UF (Universal forwarder). The UF will monitor the place that WIndows is putting its log files, and will send copies to Splunk.

When you are ready to do that, search splunk.com for how to load the UF onto the windows machine. There are lots of good resources. Read them, try to figure them out and execute them. If you run into any trouble, then write a very specific question explaining what you did, what happened, and what you need to happen.

Write that description in notepad or a text file. Before submitting it here, take the words you just wrote that describe the situation and then google for the answer. Most of the time, you will find exactly what you need. If not, then post your question here, and then ask down in Slack for people to look at it and give you some help.

If you do your own homework first, and ask very specific, very targeted questions, then you will build your confidence, and also build a reputation of being really good at what you do.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...