topic Re: Windows 2008 R2 event subscriptions in Getting Data In

Windows 2008 R2 event subscriptions

ysouchon — Fri, 09 Dec 2011 15:34:11 GMT

Do you know if Splunk supports event subscriptions ? It's a new feature on Windows 7 and Windows 2008 R2. It helps to centralize event logs from different Windows servers on one server.

http://technet.microsoft.com/en-us/library/cc749183.aspx

Re: Windows 2008 R2 event subscriptions

rtadams89 — Fri, 09 Dec 2011 16:05:32 GMT

I would think so (to some degree), but I'm not sure. However, I'm not sure why you would do that. Normally Splunk would be instaleld on a computer and forward directly to the indexer. If you used event subscriptions, you would essentially be forwarding from one computer to another (using event subscriptions) and then forwarding again to the indexer (using Splunk client). If you did use subscriptions you would probably also have to be careful in how you set Splunk to tag the events with hostnames, as all the events would appear to be coming from one computer.

Hopefully someone else who has actually tried this will chime in.

Re: Windows 2008 R2 event subscriptions

Douggg — Thu, 12 Dec 2013 19:43:15 GMT

Yes it does, but I'm finding the folks at Splunk either dont' ore won't tell you so they can sell you additional licesnes and/or technical services.

Im my opinion you are much better off using the Windows subscription model for many reasons. (But you milage may vary.)

Re: Windows 2008 R2 event subscriptions

rtadams89 — Thu, 12 Dec 2013 23:21:24 GMT

I can't see how this would play into the license size you would need. Whether you are sending the event log data from 10 hosts directly to Splunk, or aggregating it at an 11th host before sending it on to Splunk, the total log volume would be the same...

Re: Windows 2008 R2 event subscriptions

lukejadamec — Fri, 13 Dec 2013 00:57:53 GMT

Splunk was doing 'event subscriptions' long before Microsoft was. It is probably where Microsoft got the idea.

Why do you want to go backwards?

Re: Windows 2008 R2 event subscriptions

Douggg — Fri, 13 Dec 2013 06:21:36 GMT

Why? Because you don't have to load Splunk's software.

Re: Windows 2008 R2 event subscriptions

lukejadamec — Fri, 13 Dec 2013 13:14:14 GMT

The Splunk forwarders are free, and Windows subscriptions cannot consolidate network, unix, and any other non-Windows system.