topic Re: How to send data to Splunk clsuters from Windows without UF in Security

How to send data to Splunk clsuters from Windows without UF

payl_chdhry — Thu, 27 May 2021 09:57:33 GMT

Hi,

I am new to working without splunk agents/universal forwards for ingesting data into Splunk. I need to know how application can send data to Splunk indexer/HF, is there exact step provided.

Would it via HEC or by TCP port. And how could users set this up in this way to continuously send data.

Thanks!

Re: How to send data to Splunk clsuters from Windows without UF

gcusello — Thu, 27 May 2021 10:28:14 GMT

Hi @payl_chdhry,

you could use WMI to query Windows hosts and take logs, but I don't like this solution because you have to use an account with administrative privileges.

For more infos see at https://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata and https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/MonitorWMIdata .

I hint to use everytime Universal Forwarders because this permits to you to:

filter unwanted logs on UF,
compress transmitted logs,
condifure max bandwidth occupation,
cash logs if there are problems on Indexers or Network.

If you want to use WMI put this input in a dedicated Heavy Forwarder.

In addition you don't have HA because you have to configure only one HF at a time to vaoid to take logs twice.

Ciao.

Giuseppe

Re: How to send data to Splunk clsuters from Windows without UF

payl_chdhry — Mon, 31 May 2021 05:25:11 GMT

Thanks gcusello! We do not want to pull the logs, windows team would send the logs to us and they will take care of filtering out data if required. I am looking at enabling HEC on our Heavy forwards. I will create another question for this as I am a bit confused how it will work for clustered environment.

Thanks,

Payal

Re: How to send data to Splunk clsuters from Windows without UF

gcusello — Mon, 31 May 2021 06:15:04 GMT

HI @payl_chdhry,

If you use HEC, you could put a Load Balancer in front of two Heavy Forwarders, so it distribute logs betweeen the HFs and manage fail over and in this way you have an HA system to take logs from that UFs.

You could also use Indexers to take HEC logs but you need anyway a Load Balancer.

If you haven't a Load balancer, you can use a DNS configuration but it's less performant and in case of fail over, you lose the first logs.

At the end I hint to think again to your solution and take in consideration Universal Forwarders.

Ciao.

Giuseppe

Re: How to send data to Splunk clsuters from Windows without UF

gcusello — Mon, 27 May 2024 06:27:00 GMT

Hi @payl_chdhry ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉