topic Re: Use a heavy forwader to pull through WMI and send to Splunk cloud in Getting Data In

Use a heavy forwader to pull through WMI and send to Splunk cloud

heskez — Wed, 04 Mar 2020 15:49:51 GMT

Hi all,

In this particular situation we'd like to use a heavy forwader to be able to pull Windows event logs from windows devices in datacenter though WMI on prem and send to Splunk cloud. Is that possible?

Thanks in advance,
Erik

Re: Use a heavy forwader to pull through WMI and send to Splunk cloud

richgalloway — Wed, 04 Mar 2020 18:31:51 GMT

Yes, it is possible, but you don't need a heavy forwarder to do that. A universal forwarder will work just fine.

Once you install the forwarder of choice, configure an inputs.conf file to pull the desired events. Then download the "Universal Forwarder" app from your Splunk Cloud account and install it on the forwarder.

Re: Use a heavy forwader to pull through WMI and send to Splunk cloud

heskez — Wed, 04 Mar 2020 19:52:58 GMT

Thank you for your answer. So in order to pull the logs from all these Windows devices through WMI, one needs only a Universal Forwarder on one Windows device and send it to the Splunk cloud right?

Re: Use a heavy forwader to pull through WMI and send to Splunk cloud

anmolpatel — Wed, 30 Sep 2020 04:29:27 GMT

If you need to go via the WMI route, use this docs to help you get started
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata

You can do this with just the UF.
So, if you've the capability to install UF's (preferred method) then get the Splunk_TA_Windows
https://splunkbase.splunk.com/app/742/

Docs for setting it up the app
https://docs.splunk.com/Documentation/MSApp/2.0.0/MSInfra/DownloadandconfiguretheSplunkAdd-onforWindowsversion6.0.0orlater

On your cloud instance you'll have the Universal Forwarder app, which will provide you the config to send data to the cloud.

You might need to raise a Splunk support ticket to have the app deployed on Splunk Cloud, so the data can be parsed correctly.

Now, if you're planning to collect windows data at scale, it would also be ideal to look at setting up a deployment server and pushing out the configurations via that. This will help with centralised management.

Re: Use a heavy forwader to pull through WMI and send to Splunk cloud

richgalloway — Thu, 05 Mar 2020 13:58:35 GMT

Yes. However, WMI uses more resources than running a local UF on each Windows device.