topic Re: Agent vs Agentless event gathering on Windows in Getting Data In

Agent vs Agentless event gathering on Windows

maverick — Thu, 29 Apr 2010 00:44:55 GMT

Regarding agent vs agentless data / event gatering, WMI (agentless) seems easier to setup from within Splunk to pull in the data from remote Windows servers. So why would someone deploy Splunk as a Forwarder (agent) on their Windows servers to push the data in?

Re: Agent vs Agentless event gathering on Windows

maverick — Thu, 29 Apr 2010 00:51:56 GMT

Please review this topic in our community wiki for more detail regarding this question.

http://www.splunk.com/wiki/Deploy:SnareVwmiVforwarding

Also,

WMI does not pull data via SSL, but Splunk Forward can push data over SSL
pulling data with WMI may produce gaps in the data, if/when service is restarted
Splunk Forwarder can monitor and push up non-Windows data as well (i.e. IIS events, MSSQL, DIR listings every hour, etc.)

Re: Agent vs Agentless event gathering on Windows

piebob — Thu, 29 Apr 2010 00:55:08 GMT

there's also some good info in the official docs here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/ConsiderationsfordecidinghowtomonitorWindowsdata