topic Re: Can Splunk search client machines System log that has Event ID 7? in Splunk Search

Can Splunk search client machines System log that has Event ID 7?

tomwahab — Fri, 07 Jun 2013 23:26:00 GMT

Hello,
Can Splunk search client machines System log that has Event ID 7? We need to scan and retrieve hostnames that have this event ID which is a disk error

Thanks,

Re: Can Splunk search client machines System log that has Event ID 7?

kristian_kolb — Sat, 08 Jun 2013 06:51:01 GMT

Splunk will not scan your network. If you install a forwarder on each machine (or some other agent capable of retrieving logs), you can send them to a Splunk indexer. There you can search through the logs, looking for your events.

Re: Can Splunk search client machines System log that has Event ID 7?

tomwahab — Mon, 10 Jun 2013 15:27:03 GMT

Thanks, do you know of a tool that can help us?

Re: Can Splunk search client machines System log that has Event ID 7?

MHibbin — Mon, 10 Jun 2013 15:41:05 GMT

install a universal forwarder?

Re: Can Splunk search client machines System log that has Event ID 7?

tomwahab — Mon, 10 Jun 2013 16:06:46 GMT

thanks, so we would have to install splunk universal forwarder on all our client machines. How big is the software package for the forwarder and is it an easy deployment?

Re: Can Splunk search client machines System log that has Event ID 7?

starcher — Sat, 15 Jun 2013 02:29:33 GMT

You can script the forwarder install with any normal config management tools you have already that can deploy msi installer packages. Then just use a splunk deployment server to control the log collection configuration. Typically done by using the Splunk for Windows TA. However if you have a lot of hosts you may have to consider how big your license is. An alternative would be use a free windows eventlog to syslog tool like Snare for Windows. It can be set to filter what events it sends. Then pickup, index and search those received syslogs.