https://community.splunk.com/t5/Getting-Data-In/How-to-get-logs-from-a-Windows-machine-without-installing-a/m-p/255109#M48990 <P>You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.</P> <P><STRONG>Event Forwarding info:</STRONG></P> <P>Splunk blog post<BR /> <A href="http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/">http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/</A></P> <P>Microsoft blog post and presentation<BR /> <A href="https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/">https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/</A></P> <P>The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding. </P> Mon, 16 May 2016 18:48:29 GMT spayneort 2016-05-16T18:48:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-logs-from-a-Windows-machine-without-installing-a/m-p/255108#M48989 <P>Hi, </P> <P>I understand that best practice is to install a universal forwarder on a server and send the logs directly to an indexer. However, if I have a circumstance that I cannot install the forwarder on a Windows machine, what would be my options on how to get logs into Splunk?</P> <P>I've heard of something built into Windows such as WinEventLog forwarding, but I can't seem to find much documentation on it.</P> <P>Thanks.</P> Mon, 16 May 2016 17:38:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-logs-from-a-Windows-machine-without-installing-a/m-p/255108#M48989 mmensch 2016-05-16T17:38:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-logs-from-a-Windows-machine-without-installing-a/m-p/255109#M48990 <P>You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.</P> <P><STRONG>Event Forwarding info:</STRONG></P> <P>Splunk blog post<BR /> <A href="http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/">http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/</A></P> <P>Microsoft blog post and presentation<BR /> <A href="https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/">https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/</A></P> <P>The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding. </P> Mon, 16 May 2016 18:48:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-logs-from-a-Windows-machine-without-installing-a/m-p/255109#M48990 spayneort 2016-05-16T18:48:29Z