topic Re: Forwarder and More in Getting Data In

Forwarder and More

paul_1994 — Fri, 25 May 2012 03:55:58 GMT

I am new to splunk and I an trying to get the solution right for my company that being said . My delima is that the Universal forward is memory intensive, so I wanted a back up plan in case i need to pull files.

my current setup would be

Servers /w Uni FWD ---> consolidator/Forwarder?? ----> indexer

If i deem certain system can't handle the additional Memory overhead is it possible to have the Consolidator/ Forwarder pull items via wmi from the servers and then forward the info to the indexer

Servers/WMI pull ----> to Consolidator/forwarder/Indexer??(THIS WOULD PULL DATA AND THE FWD) ----> indexer

If i have some of the terminology wrong please feel free to correct me.

Thanks in advanced

Re: Forwarder and More

Ayn — Fri, 25 May 2012 06:05:08 GMT

So is the question if Splunk in general, and Universal Forwarders in particular, can grab logs via WMI? If so the answer is yes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

Re: Forwarder and More

paul_1994 — Fri, 25 May 2012 07:43:25 GMT

no.. I understand that it can grab data via WMI.. I am curious if i have a segmented environment, can I have a forwarder in a DMZ that can pull my logs via WMI and then Forward them to my indexer outside the DMZ.. So can the forwarder or any component grab the files/logs via WMI and then send them to my Indexer..

Re: Forwarder and More

Ayn — Fri, 25 May 2012 07:54:17 GMT

Yes, since the forwarder can pull logs via WMI, and since its task is to forward logs, it will be able to do what you want to accomplish.