Hi All,
Currently we have BMC-True site application monitoring the application logs using an agent, but we wanted to move forward with an agent-less monitoring in future, not only just monitoring the device but we wanted to use the data to improve our performance.
Please do let me know how we can use Splunk to do this better than the current application.
Thanks in Advance.
You can use just about anything including:
WMI
Http Post (e.g. HEC)
Snare
Kafka
syslog (UDP/TCP)
cribl
NiFi
I also know that @duanewaddle @dwaddle has been thinking about building something in this area and probably has strong opinions here.
Hi @Hemnaath,
Yes with Splunk you can take logs also without agents using other ways as syslogs or WMIs or HEC, but I usually discourage my customers from doing so because the presence of the Universal Forwarder (the Splunk agent) provides many operational, security and guarantee advantages of not losing anything.
In short, the most relevant advantages are (but not the only ones):
In other words, I usually use UFs, I never use WMI and I use syslogs only when I cannot do otherwise (appliances).
Ciao.
Giuseppe
Hey thanks for the valuable information, but how do you monitor log files using the HEC collector, We need to create an POC for the same to understand it better. Is there How to do ? document or steps for capturing log file using the HEC in splunk.
Hi @Hemnaath,
HEC is only for custom application where it's possible to push http/https messages.
You can find docs and videos at:
https://dev.splunk.com/enterprise/docs/dataapps/httpeventcollector/
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/HECExamples
https://www.youtube.com/watch?v=9awwyjORWO8
https://www.youtube.com/watch?v=qROXrFGqWAU
Ciao.
Giuseppe
Hi Gcusello, thanks for your support on this, I had gone through the all the above splunk videos. But I need to implement this practically to understand this concept better. Is there any example which you can share, so that I can create a POC.
Thanks in Advance.
Hi @Hemnaath,
what do you want to monitor: Windows, an application an appliance ?
To easily start you could install Splunk Enterprise on a server (for a PoC you can use Windows or Lunix, but for production I hint to use only Linux) and then Universal Forwarder on a Windows Server.
Then you have to enable Splunk to receive logs on 9997 port and UF to send logs to Splunk.
You can test it searching on Splunk index=_internal host=uf_hostname
.
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Getstartedwithgettingdatain
Then you can take the Splunk_TA_Windows and then untar and copy it both on UF Splunk at $SPLUNK_HOME\etc\apps
.
then on UF you should edit inputs.conf, copy inputs.conf from default folder to local folder and edit it changig disabled=1
to disabled=0
to all the thing you want to tale (e.g. security events).
at the end you have to restart both the splunks.
In this way you'll have the windows logs and you can see them with a simple search like index=wineventlog
.
You can use these logs for your use cases:
e.g. if you want an example of brute force attack with a number of logfail greathen than 10 you could create a search like this
index=wineventlog EventCode=4625
| stats count BY host
| where count>10
Another interesting thing to do in a PoC is to install an app like Splunk App for Windows Infrastructure ( https://splunkbase.splunk.com/app/1680/ ), follow the install instructions!
Another interesting use case is to install the UF on a Domain Controller following the instructions of the above app and monitoring the Domain.
Ciao.
Giuseppe
thanks for your valuable time and input on this.