Agent vs Agentless event gathering on Windows

[maverick]

Regarding agent vs agentless data / event gatering, WMI (agentless) seems easier to setup from within Splunk to pull in the data from remote Windows servers. So why would someone deploy Splunk as a Forwarder (agent) on their Windows servers to push the data in?

[piebob · Accepted solution]

there's also some good info in the official docs here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/ConsiderationsfordecidinghowtomonitorWindowsdat...

[maverick]

Please review this topic in our community wiki for more detail regarding this question.

http://www.splunk.com/wiki/Deploy:SnareVwmiVforwarding

Also,

• WMI does not pull data via SSL, but Splunk Forward can push data over SSL
• pulling data with WMI may produce gaps in the data, if/when service is restarted
• Splunk Forwarder can monitor and push up non-Windows data as well (i.e. IIS events, MSSQL, DIR listings every hour, etc.)