https://community.splunk.com/t5/Getting-Data-In/Configure-SYSLog-on-a-Windows-Server/m-p/350394#M64316 <P>Hello,</P> <P>my question might be dumb but it is worth to ask, <BR /> On a Windows Servers, how do i configure to send the authentication.log to a Splunk heavy forwarder?<BR /> is this the same to say "I need to configure the syslog to be sent to the heavy forwarder?"</P> <P>Thank you!</P> Wed, 31 Jan 2018 01:23:45 GMT jesusgalloEMC 2018-01-31T01:23:45Z https://community.splunk.com/t5/Getting-Data-In/Configure-SYSLog-on-a-Windows-Server/m-p/350394#M64316 <P>Hello,</P> <P>my question might be dumb but it is worth to ask, <BR /> On a Windows Servers, how do i configure to send the authentication.log to a Splunk heavy forwarder?<BR /> is this the same to say "I need to configure the syslog to be sent to the heavy forwarder?"</P> <P>Thank you!</P> Wed, 31 Jan 2018 01:23:45 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-SYSLog-on-a-Windows-Server/m-p/350394#M64316 jesusgalloEMC 2018-01-31T01:23:45Z https://community.splunk.com/t5/Getting-Data-In/Configure-SYSLog-on-a-Windows-Server/m-p/350395#M64317 <OL> <LI>Install a universal forwarder on your windows server</LI> <LI>During the installation, put Heavy Forwarder's IP in the Receiving Indexer field (and deployment server IP if you have one)</LI> <LI>Configure monitor input stanza in inputs.conf to point to the authentication.log</LI> <LI>restart the universal forwarder.</LI> </OL> Wed, 31 Jan 2018 04:00:18 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-SYSLog-on-a-Windows-Server/m-p/350395#M64317 damode 2018-01-31T04:00:18Z