https://community.splunk.com/t5/Getting-Data-In/How-can-I-collect-remote-logs-from-member-servers-using-a/m-p/180047#M36100 <P>You could either collect logs via WMI, or make use of Windows's own mechanisms for forwarding event logs to the "Forwarded events" log on the host, and have the forwarder pick up things there. The best idea in most cases though is to install a Universal Forwarder on each of the hosts that you want to collect events from, as it gives you better control, performance and fault tolerance compared to the alternatives.</P> Fri, 09 Jan 2015 14:47:33 GMT Ayn 2015-01-09T14:47:33Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-collect-remote-logs-from-member-servers-using-a/m-p/180046#M36099 <P>hi all,</P> <P>I have installed a Universal Forwarder on a Domain controller (using domain creds - service account). </P> <P>How can I collect remote logs (especially security logs) from member servers using the universal forwarder?</P> <P>help is appreciated</P> <P>--&gt; I believe this has already been asked but without any answers </P> Fri, 09 Jan 2015 13:06:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-collect-remote-logs-from-member-servers-using-a/m-p/180046#M36099 rb51 2015-01-09T13:06:19Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-collect-remote-logs-from-member-servers-using-a/m-p/180047#M36100 <P>You could either collect logs via WMI, or make use of Windows's own mechanisms for forwarding event logs to the "Forwarded events" log on the host, and have the forwarder pick up things there. The best idea in most cases though is to install a Universal Forwarder on each of the hosts that you want to collect events from, as it gives you better control, performance and fault tolerance compared to the alternatives.</P> Fri, 09 Jan 2015 14:47:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-collect-remote-logs-from-member-servers-using-a/m-p/180047#M36100 Ayn 2015-01-09T14:47:33Z