topic Re: Need help with AD in Getting Data In

Need help with AD

Splunk-tester — Fri, 31 Mar 2023 20:29:51 GMT

Hi.

I want to try Splunk on windows server 2019, i have windows server and a client, what to do to make splunk read what is happening in the client pc?
is there are step by step tutorial?

thanks

Re: Need help with AD

richgalloway — Sat, 01 Apr 2023 00:21:34 GMT

While it's possible to read some data from a remote PC, it's far easier to install Splunk on the computer where the data resides. That can be a full instance of Splunk Enterprise or a Splunk Universal Forwarder (agent).

Instructions for installing Splunk on Windows are at https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindows

To learn about monitoring remote PCs, see https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata

Re: Need help with AD

gcusello — Sat, 01 Apr 2023 06:04:45 GMT

Hi @Splunk-tester,

let me understand:

you want to test Splunk in a lab, composed by a Windows server where to install Splunk,
and then install a Universal Forwarder (agent) on the client to monitor it,

is it correct?

if this is your need, you have to:

install Splunk Enterprise on the server,
install Spluk Universal Forwarder on the client,
enable receiving on the server [Settings > Forwardering and Receivig > Receiving],
configure UF to send logs to the Splunk Server (https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwioyaDSgIj-AhWlGQYAHW5xBqEYABAAGgJ3cw&ohost=www.google.com&cid=CAESauD2ipY2nVfbWn8GN-q2hEXWECz-PjurUPpLDDu-4F5gVYpuD-X6j80kiEksRmvcLoTFlmSMgK1PpN_th-un6WBis7b6EmFsxQr7CqJgS_Qx9dN3ukcedXTQmyj7HlPVqERaIU0rRVm90cE&sig=AOD64_0NNggDQqqRj0d2RGcCy432d_yVxw&q&adurl&ved=2ahUKEwjVnJrSgIj-AhUjQ_EDHdaoBcMQ0Qx6BAgHEAE)
search on Splunk server logs from that host.

To be guided, you can use the links from @richgalloway or search on the above link, or search in the YouTube Splunk Channel https://www.youtube.com/@Splunkofficial some video to learn about Splunk.

Only one last hint: I understand that maybe you know very well windows and not very well Linux, and that Splunk is installable also on Windows, but I usually use windows server for Splunk Enterprise server only in labs or very little infrastructures, never in large production infrastructures.

Ciao.

Giuseppe