topic Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4? in Getting Data In

Is there a version of Splunk Universal Forwarder that is compatible with NT4?

sentiaglobal — Sat, 24 Sep 2016 17:01:57 GMT

Hi folks,

You'll have to excuse my memory lapse here - Splunk forwarder on NT4, installation of - I recall getting an old version of the forwarder to install on NT4 some time back, but the version is no longer available & I don't have the installer - needless to say this is going to be needed in a critical environment where they still run NT4!

Guessing support for NT4 has never been official, so I'm wondering if any of you are using other methods which ARE supported like WMI to retrieve the data?

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

JDukeSplunk — Tue, 27 Sep 2016 13:52:25 GMT

So I'm guessing the 4.3 universal forwader on the site is not old enough?

https://www.splunk.com/page/download_track?file=4.3/windows/splunkforwarder-4.3-115073-x86-release.msi&platform=Windows&architecture=x86&version=4.3&product=universalforwarder&typed=release&name=windows_installer

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

sentiaglobal — Tue, 27 Sep 2016 14:35:38 GMT

Correct 🙂

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

JDukeSplunk — Tue, 27 Sep 2016 18:48:26 GMT

Bummer. I dug through as many search engines as i could find looking for maybe a hidden FTP mirror for Splunk downloads. Nothing.

Maybe you could use SNMP to offload the NT4 traffic elsewhere and then Splunk that? I don't know what you would be able to capture for it. Personally, I'd keep searching or maybe post a new question here "Looking for universal forwarder install older than 4.3".

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

lakromani — Wed, 28 Sep 2016 06:56:48 GMT

They should use resource on upgrade the NT4 to some later, not time to find forwarder working with it.
It's out of support on every way and a security risk to use.

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

jcrabb_splunk — Thu, 29 Sep 2016 17:09:54 GMT

NT4 EOL was on Dec 31st 2004 which is before "Splunk" was founded. Going back through our available documentation, I am unable to find a UF version which supported that platform, but its possible that a very early version could have. Most definitely, none of our currently available products support it.

Re: Is there a version of Splunk Universal Forwarder that is compatible with NT4?

kungfu71186 — Fri, 30 Sep 2016 16:07:37 GMT

You should be able to use WMI. Haven't tried it yet, but as long as you can query from WMI, I don't see why it shouldn't work.