topic Re: Collecting data from Windows host without forwarder or domain group in Getting Data In

Collecting data from Windows host without forwarder or domain group

MHibbin — Tue, 19 Jun 2012 16:26:53 GMT

Hi all,

I was wondering if anyone has had experience of collecting remote data for Splunk from a Windows device, where a forwarder can not be installed on the machine (due to support issues), and the device uses local authentication (i.e. is not in an AD domain group). Preferably not installing a third party file either.

Any thoughts on how this could be achieved? - obviously linux has native tools available to make this easy, apparently not with Windows.

Thanks in advance,

MHibbin

Re: Collecting data from Windows host without forwarder or domain group

Kate_Lawrence-G — Tue, 19 Jun 2012 17:51:20 GMT

Hi,

I can only think of 2 possible options:

Remotely monitor the box over WMI - http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/MonitorWindowsdata#Configure_remote_event_log_monitoring
Or write a VB/Powershell script to get everything into a remote share that splunk can read it from there - http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories

Thanks!

Kate

Re: Collecting data from Windows host without forwarder or domain group

MHibbin — Fri, 22 Jun 2012 10:40:50 GMT

Thanks for the answer @Kate_Lawrence. However, as mentioned the windows machine does not use AD for authentication, WMI is out of the question (option #1).

We are going to look into sending the data using something like psftp/pscp to a windows forwarder and then have the EVTs/logs read/forwarded from there.