Getting Data In

Use a heavy forwader to pull through WMI and send to Splunk cloud

heskez
New Member

Hi all,

In this particular situation we'd like to use a heavy forwader to be able to pull Windows event logs from windows devices in datacenter though WMI on prem and send to Splunk cloud. Is that possible?

Thanks in advance,
Erik

0 Karma

anmolpatel
Builder

If you need to go via the WMI route, use this docs to help you get started
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata

You can do this with just the UF.
So, if you've the capability to install UF's (preferred method) then get the Splunk_TA_Windows
https://splunkbase.splunk.com/app/742/

Docs for setting it up the app
https://docs.splunk.com/Documentation/MSApp/2.0.0/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

On your cloud instance you'll have the Universal Forwarder app, which will provide you the config to send data to the cloud.

You might need to raise a Splunk support ticket to have the app deployed on Splunk Cloud, so the data can be parsed correctly.

Now, if you're planning to collect windows data at scale, it would also be ideal to look at setting up a deployment server and pushing out the configurations via that. This will help with centralised management.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it is possible, but you don't need a heavy forwarder to do that. A universal forwarder will work just fine.

Once you install the forwarder of choice, configure an inputs.conf file to pull the desired events. Then download the "Universal Forwarder" app from your Splunk Cloud account and install it on the forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

heskez
New Member

Thank you for your answer. So in order to pull the logs from all these Windows devices through WMI, one needs only a Universal Forwarder on one Windows device and send it to the Splunk cloud right?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. However, WMI uses more resources than running a local UF on each Windows device.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...