topic Re: Processing Windows Event Logs in Getting Data In

Processing Windows Event Logs

vragosta — Fri, 15 Feb 2013 18:04:07 GMT

Per the documentation available at the following URL...

http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutWindowsdataandSplunk

...the following statement is made regarding Windows Event Log data:

These specialized inputs are available only on Windows installations of Splunk.

Does this mean that Splunk cannot process Windows Event Log data unless the indexer is running under a Windows OS? If so, why is there this restriction in place?

Thanks,

Vincent

Re: Processing Windows Event Logs

Ron_Naken — Fri, 15 Feb 2013 19:27:20 GMT

An indexer can parse and index Windows data, regardless of the platform it's installed on. The reference to specialized inputs refers to the fact that WMI/Perfmon/Registry/AD APIs are only available on Windows platforms. A forwarder installed on a Windows platform can remotely gather data using WMI, and an agent/forwarder installed on a server can provide Perfmon/Registry/AD access. They can then forward the data to an indexer running on any supported OS.