topic Re: Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured? in Getting Data In

Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured?

alessandromagri — Wed, 12 Nov 2014 22:13:21 GMT

Hi everybody,
I need to set up a system monitor that collects logon and logout data from some Windows machines (server 2003, server 2008 and Win7).
I've installed the server on an ubuntu server and the Universal Forwarder on the Win7 pc. After the installation of that client I've added the Win7 to the AddData-->forward (in both machine it's set to collect all types of logs) but I can't see any logs about the Win7 machine. Or perhaps I don't know how to see it?

Can anyone help me?

Thanks!

Re: Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured?

dxmiller — Wed, 12 Nov 2014 22:20:21 GMT

I would check your Windows Firewall or 3rd party Firewall/HIPS software to ensure that the Universal Forwarder is permitted to send the log traffic to your Splunk server via TCP 8089. If everything is in order there, I would then check your inputs.conf and outputs.conf files to make sure everything is in order.

Re: Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured?

alessandromagri — Thu, 13 Nov 2014 08:48:51 GMT

Thanks for the quick reply.
I've permitt all ports and all protocols for Universal Forwarder on my firewall, but I don't see any log.

But exactly what I've to search to find Windows log?

Re: Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured?

alessandromagri — Thu, 13 Nov 2014 21:48:13 GMT

Now I'm trying to check the inputs.conf and output.conf file but I dont know where to find the right files: in the SplunkUniversalForwarder folder there are many inputs.conf so i dont know the right one to check.
Can someone explane me how I've to do?