Dashboards & Visualizations

Has anyone used syslog-ng PE as a winevent collection server?


Has anyone else used syslog-ng PE as a winevent collection server?

In my scenario, I need to send winevents to Splunk and another application (as raw data). Unfortunately sending winevents via universal forwarders > heavy forwarders (HF) > indexers (cooked) and ... HF > 3rd party app (uncooked) is dropping events.

I am posting a previous comment in this question as a reference.

Thank you

Tags (2)
0 Karma


Author :gergely_bodnar

You have mentioned syslogNG for "windows" which is part of the syslog-ng commercial offering (syslog-ng PE)
With syslog-ng PE there are two options for collecting windows logs,
- the Agent for Windows can gather locally then forward to remote syslog-ng server
- syslog-ng PE is capable to collect Windows events remotely utilising the Windows Event Collector framework.
With both solution you can feed splunk directly with syslog-ng without need any UF on the syslog side. You can use the HTTP destination to feed Splunk. Even more a dedicated Splunk destination will arrive in syslog-ng in this year supporting log batching and load balancing.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...