The installer makes it seem like it is possible to pull data from another machine with the universal forwarder. Is this possible? I can't seem to find any documentation on how to configure this if it is.
Thanks!
In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata
In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata
It's definitely possible! There are examples in the wmi.conf docs on how to do this. See http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wmiconf (specifically the examples section at the end).
It seems like it states a universal forwarder can be configured to perform WMI polling for remote machines though? I have a universal forwarder setup on a Windows machine and it's pulling the local data that gets configured during installation. I'm trying to figure out how to have it pull information from a remote Windows machine. Is that not possible?
Linux hosts will not be able to perform WMI polling, because it's done via native Windows calls.
By answer I mean why I don't see that.
I've still yet to find any useful documentation that explains how to configure a forwarder either via .conf files or via CLI to collect remote event log information.
I think I found my answer:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata
I'm currently running Splunk using Linux.
So I read through that and found this:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Configure_remote_event_log...
The only problem is the instructions do not match what I see. I don't see Remote Event Log collections.