Running two TAs simultaneously

[ArsenyKapralov]

Hi

I need to collect some events from Windows Security log. My task is to collect some logs from all servers which I have and some additional logs from low number of servers.
I tried to do this creating to similar apps (just copying) based on Splunk add-on for Windows, but with different whitelist in inputs.conf and deploying them using different server classes. This resulted in working of only one app.

How can I complete my task?

[dshpritz]

My recommendation is create a series of DS apps that contain the inputs, usually one for each event log branch you want to collect, something like:

DS-all_departments-Inputs-wineventlog_security
DS-all_departments-Inputs-wineventlog_system
DS-all_departments-Inputs-wineventlog_application

Then, in your serverclass.conf, you can mix and match as needed:

# get the windows security logs from all windows systems
[serverClass:WinSecurity]
whitelist.0=*
machineTypesFilter=windows-*
[serverClass:WinSecurity:app:DS-all_departments-Inputs-wineventlog_security]

[serverClass:WinApplication]
whitelist.0=prod.yourcompany.com
[serverClass:WinApplication:app:DS-all_departments-Inputs-wineventlog_application]

# note that we don't have to add the winsecurity logs, 
# as they are already in another class which includes all windows systesm
[serverClass:WinTheWorks]
whitelist .0 = appservers.yourcompany.com
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_application]
[serverClass:WinTheWorks:app:DS-all_departments-Inputs-wineventlog_system]

You can then distribute the Splunk_TA_windows to your indexers and search heads only, not all of your enterprise. But, you can use the inputs.conf from the TA as the base for your input apps.

[woodcock]

We have done this by setting up the less-important input with the legacy method of doing windows events: set up the Windows logging facility on the forwarders to write that subset of events to disk on the forwarder and then monitor that log file.

[ArsenyKapralov]

Thank you!
It's a good idea as a workaround, but first of all I want to find complete and manageble solution.