topic Re: How to collect Windows event logs without installing a universal forwarder? in Getting Data In

How to collect Windows event logs without installing a universal forwarder?

kpavan — Mon, 11 Apr 2016 08:54:38 GMT

Hi All,

I need to collect the logs from a Windows machine into Splunk without installing any agent (universal forwarder). I just wanted to know how to achieve this in Splunk 6.3 running on RedHat 6.

With ref: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWMIdata?r=searchtip

It says need to install Splunk Enterprise on Windows, but I don't want to install the any software on the servers since my client doesn't want to. So please let me know steps to achieve this.

Thanks!

Re: How to collect Windows event logs without installing a universal forwarder?

gmerhej_splunk — Mon, 11 Apr 2016 08:58:51 GMT

You can install Splunk Heavy Forwarder on a windows machine, collect WMI data and forward them to your Splunk Indexers running on RedHat 6.

Re: How to collect Windows event logs without installing a universal forwarder?

kpavan — Mon, 11 Apr 2016 10:01:22 GMT

can't we get without installing HF as well?

Re: How to collect Windows event logs without installing a universal forwarder?

gmerhej_splunk — Mon, 11 Apr 2016 10:14:34 GMT

You will need a Windows machine to collect WMI data.

If your Splunk setup is non-Windows, you'll need a separate Windows instance running HF or UF.

See the paragraph "Search Windows Data on a non-Windows Instance of Splunk Enterprise": http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/ConsiderationsfordecidinghowtomonitorWindowsdata#Polling_data_remotely_over_WMI.3F_Be_sure_to_read_this

If you opt for a UF, you cannot configure the WMI from the web interface but you can do the same through the wmi.conf:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorWMIdata

Re: How to collect Windows event logs without installing a universal forwarder?

kpavan — Mon, 11 Apr 2016 10:21:45 GMT

Thanks for your information!

Re: How to collect Windows event logs without installing a universal forwarder?

alemarzu — Mon, 11 Apr 2016 13:16:30 GMT

Hi kpavan,

You could try doing this
https://code.google.com/archive/p/eventlog-to-syslog/

Hope it helps.