Hi everyone. I am new in splunk.
I want remote collect data from 20 Windows servers + 80 windows workstations without WEF (not WMI, only eventlog journals)
i didnt find in docs how i can set list of ip addresses or hostnames in inputs.conf?
What is the best way to manage list of ip if i want install second UF? should i manage it right on the UF server or there is better way?
That is described in this section of the documentation: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_WMI
If you can't deploy UFs to each host, you can use WMI to pull logs remotely. Note that this is typically not really recommended as it performs and scales quite poorly (and config is a pain to maintain, as you need to set up WMI stanzas for each host you want to collect from).
I don't entirely follow your questions, can you elaborate a bit? Perhaps share the config you have so far?
[WinEventLog://Application]
disabled = 0
start_from = oldest
index = wineventlog_app
current_only = 1
checkpointInterval = 5
renderXml=false
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
evt_dc_name = dc01.ptdemo.local
evt_dns_name = ptdemo.local
checkpointInterval = 5
index = wineventlog_sec
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
renderXml=false
[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
renderXml=false
index = wineventlog_sys
That configuration will only let it collect the logs of the local machine where your UF is running.
What exactly do you want to achieve? A single UF that remotely pulls logs from all your systems, or do you want to deploy UFs to each of your windows hosts?
i know, that this config allow collect only local logs.
but i want collect remote logs
E.g. i have list of 20 servers
host1
host2
...
host20
Where i should put this list?
UF that remotely pulls logs from all your systems
yes, from all windows servers