https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/56999#M11127 <P>Hi Splunkers,</P> <P>I am very new to Splunk and would like to monitor Windows servers, how do I configure the Windows boxes to send their event data over to Splunk indexer? The indexer is installed in a Linux environment. Installing a Splunk forwarder on each Windows box does not seam to be a good option at my place.</P> <P>Thank you for your advice.</P> Tue, 24 Jan 2012 20:56:00 GMT tomero2011 2012-01-24T20:56:00Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/56999#M11127 <P>Hi Splunkers,</P> <P>I am very new to Splunk and would like to monitor Windows servers, how do I configure the Windows boxes to send their event data over to Splunk indexer? The indexer is installed in a Linux environment. Installing a Splunk forwarder on each Windows box does not seam to be a good option at my place.</P> <P>Thank you for your advice.</P> Tue, 24 Jan 2012 20:56:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/56999#M11127 tomero2011 2012-01-24T20:56:00Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/57000#M11128 <P>Do you have a specific reason for thinking that it's not a good option to install a forwarder on each Windows server? This is exactly what I would do. The docs have good information on this subject, this is a good start: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutWindowsdataandSplunk">http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutWindowsdataandSplunk</A></P> <P>EDIT: Oh, and this is even more excellent, covers exactly what you're asking about! <A href="http://docs.splunk.com/Documentation/Splunk/4.3/Data/ConsiderationsfordecidinghowtomonitorWindowsdata">http://docs.splunk.com/Documentation/Splunk/4.3/Data/ConsiderationsfordecidinghowtomonitorWindowsdata</A></P> Tue, 24 Jan 2012 20:59:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/57000#M11128 Ayn 2012-01-24T20:59:37Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/57001#M11129 <P>An updated link that furthers @ayn's point:<BR /> <A href="https://answers.splunk.com/answers/744435/what-are-the-best-practices-for-installing-splunk.html">What are the best practices for installing Splunk on Windows endpoints?</A></P> Thu, 02 May 2019 12:46:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-configure-Windows-server-to-send-event-log-my-splunk/m-p/57001#M11129 sloshburch 2019-05-02T12:46:57Z