https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-web-request-data-into-Splunk/m-p/552784#M91680 <P>Splunk has a manual dedicated to getting data into Splunk at&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI</A></P><P>AFAIK, URLs are not stored in the Windows event log (at least not by default).&nbsp; You'll need a tool to collect and save that data.&nbsp; Then you can use a UF to forward the data to Splunk.</P><P>When setting up the UF, disable all the inputs you don't need so you'll use less license quota.</P> Mon, 24 May 2021 13:35:12 GMT richgalloway 2021-05-24T13:35:12Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-web-request-data-into-Splunk/m-p/552506#M91655 <P>Brand new Splunk user here. As a learning experience, I want to index all URLs requested by users/computers (Mac, Linux &amp; Windows) on my network. I've found lots of good info on how to use Splunk to <EM>search</EM> that data. But thus far I've been unable to figure out how you actually get it into Splunk to begin with.</P><P>I'm using the free version, so I want to minimize the data flow so that I don't breach the max. amount you're allowed as a free user.</P><P>As far as I can tell, I'm supposed to install the universal forwarder on the various machines on my network. But won't that forward all syslog/Windows events, which is way more than I need? And in any case, are URL requests even stored by syslog/Windows event system?</P><P>As you can tell, I'm kind of stuck! Can anyone point me in the right direction?</P> Fri, 21 May 2021 06:38:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-web-request-data-into-Splunk/m-p/552506#M91655 hux2000 2021-05-21T06:38:39Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-web-request-data-into-Splunk/m-p/552784#M91680 <P>Splunk has a manual dedicated to getting data into Splunk at&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI</A></P><P>AFAIK, URLs are not stored in the Windows event log (at least not by default).&nbsp; You'll need a tool to collect and save that data.&nbsp; Then you can use a UF to forward the data to Splunk.</P><P>When setting up the UF, disable all the inputs you don't need so you'll use less license quota.</P> Mon, 24 May 2021 13:35:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-web-request-data-into-Splunk/m-p/552784#M91680 richgalloway 2021-05-24T13:35:12Z