topic Re: splunk search server event logs from my PC without forwarders? in Getting Data In

splunk search server event logs from my PC without forwarders?

sldadmin — Mon, 25 Feb 2013 17:49:39 GMT

Hi, from my workstation PC, can I install Splunk and then search event logs on my domain controllers and windows servers, WITHOUT installing anything onto those servers? I'm just testing Splunk and don't want to install anything onto these servers, especially if install (and later uninstall) would require a reboot of the server. And risk (any) 3rd party product making my server unstable (especially the DCs).

Also, I need to search logs for many domain names and IPs. Will Splunk do this? (take these from a list or XLS) f not, any product known that will do this, hopefully without any agent on the servers?

Re: splunk search server event logs from my PC without forwarders?

yannK — Mon, 25 Feb 2013 18:30:13 GMT

To monitor WinEventLogs remotely, check the WMI inputs.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ConsiderationsfordecidinghowtomonitorWindowsdata#Use_WMI

To monitor AD, it can be done remotely, you need to check this guide :
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/AuditActiveDirectory

Re: splunk search server event logs from my PC without forwarders?

sldadmin — Mon, 28 Sep 2020 13:23:48 GMT

Thanks for the config pointers. But a couple other key questions were left unanswered, if anyone can help. They were:

emphasized text*Is restart required after agent (univ forwarder) install on a server? Or upon install?*emphasized text

*emphasized text*Also, I need to search logs for many domain names and IPs. Will Splunk do this? (take these from a list or XLS) If not, any product known that will do this?