topic Re: Universal Forwarder has to be on every machine? in Getting Data In

Universal Forwarder has to be on every machine?

byronious — Fri, 19 Apr 2013 18:44:18 GMT

The installer makes it seem like it is possible to pull data from another machine with the universal forwarder. Is this possible? I can't seem to find any documentation on how to configure this if it is.

Thanks!

Re: Universal Forwarder has to be on every machine?

Ayn — Fri, 19 Apr 2013 18:48:12 GMT

In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

Re: Universal Forwarder has to be on every machine?

byronious — Fri, 19 Apr 2013 18:58:41 GMT

So I read through that and found this:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Configure_remote_event_log_monitoring
The only problem is the instructions do not match what I see. I don't see Remote Event Log collections.

Re: Universal Forwarder has to be on every machine?

byronious — Fri, 19 Apr 2013 19:03:08 GMT

I think I found my answer:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata

I'm currently running Splunk using Linux.

Re: Universal Forwarder has to be on every machine?

byronious — Fri, 19 Apr 2013 19:13:36 GMT

By answer I mean why I don't see that.

I've still yet to find any useful documentation that explains how to configure a forwarder either via .conf files or via CLI to collect remote event log information.

Re: Universal Forwarder has to be on every machine?

Ayn — Fri, 19 Apr 2013 19:16:28 GMT

Linux hosts will not be able to perform WMI polling, because it's done via native Windows calls.

Re: Universal Forwarder has to be on every machine?

byronious — Fri, 19 Apr 2013 19:23:04 GMT

It seems like it states a universal forwarder can be configured to perform WMI polling for remote machines though? I have a universal forwarder setup on a Windows machine and it's pulling the local data that gets configured during installation. I'm trying to figure out how to have it pull information from a remote Windows machine. Is that not possible?

Re: Universal Forwarder has to be on every machine?

Ayn — Fri, 19 Apr 2013 19:29:37 GMT

It's definitely possible! There are examples in the wmi.conf docs on how to do this. See http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wmiconf (specifically the examples section at the end).