All Apps and Add-ons

Forwarding logs from Windows Event Collector

paxos
New Member

Is it possible to forward collected logs from a Windows Event Collector (WEC) server, i.e. from the Windows service that remotely collects logs from other windows servers, such that the logs are compatible with "Splunk App for Windows Infrastructure" ?

I imagaine that at a minimum this would require "transforming" the default fields of host, source, sourcetype to meaningful values rather than the values that WEC uses. Would this then allow the events to be processed by the "Splunk Add-On for Windows" ?

I know that the recommended method is to use a Universal Forwarder on all servers, or alternatively WMI, but as WEC has been around for a long time I am surprised there is no mention of it here ...
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/AboutWindowsdataandSplunk

Any information about anybody's experiences is much appreciated.

0 Karma
1 Solution

mikaelbje
Motivator

Hi,

  1. Don't use Windows Event Collector
  2. Did you know that the event collector buffers events (tuning the buffers isn't an optimal solution either), adding a delay before Splunk receives the event. You may end up getting events a long time after they were generated
  3. Listen to me, don't use it. I've implemented solutions for several customers using WEC and it was just a waste of time
  4. Ok, you're persistent. See my answer on how to do it here: https://answers.splunk.com/answers/213603/wineventlogforwardedevents-override.html#answer-330822
  5. Ok, there may be a few good reasons to use WEC - such as preventing Splunk Forwarder from eating up all CPU and RAM because of poorly written runaway scripts. You may choose not to use those scripts. GOTO 1

Mikael

View solution in original post

mikaelbje
Motivator

Hi,

  1. Don't use Windows Event Collector
  2. Did you know that the event collector buffers events (tuning the buffers isn't an optimal solution either), adding a delay before Splunk receives the event. You may end up getting events a long time after they were generated
  3. Listen to me, don't use it. I've implemented solutions for several customers using WEC and it was just a waste of time
  4. Ok, you're persistent. See my answer on how to do it here: https://answers.splunk.com/answers/213603/wineventlogforwardedevents-override.html#answer-330822
  5. Ok, there may be a few good reasons to use WEC - such as preventing Splunk Forwarder from eating up all CPU and RAM because of poorly written runaway scripts. You may choose not to use those scripts. GOTO 1

Mikael

engrimranzakir
Explorer

any other method to collect logs other than wec.

0 Karma

paxos
New Member

Thanks. Just what I was looking for.

0 Karma

dillardo_2
Path Finder

Hi @mikaelbje, what would you recommend instead of using Windows Event Collectors? Is the alternative simply installing a universal forwarder on every endpoint?

dillardo_2
Path Finder

@mikaelbje

0 Karma

bharrell
Path Finder

I would also like to know what's recommended.  Are people really installing Splunk Universal Forwarder on every endpoint?   Thanks.

0 Karma

adonio
Ultra Champion

hello paxos,
I must ask, why not use the Universal Forwarder?

0 Karma

paxos
New Member

There are a couple of reasons I am trying to avoid that:
a) the logs are already collected (for another purpose) from the clients on a Windows Event Collector server using the inbuilt Windows Event Forwarding. Collecting them again using a Universal Forwarder would just be doubling the load on those clients and "duplicating" the traffic.
b) to avoid the administrative and cost overhead in organising the installation and update of the Forwarder in an environment managed by an outsourced provider.

0 Karma

itrimble1
Path Finder

What did you end up going with ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...