Getting Data In

Agent vs Agentless event gathering on Windows

maverick
Splunk Employee
Splunk Employee

Regarding agent vs agentless data / event gatering, WMI (agentless) seems easier to setup from within Splunk to pull in the data from remote Windows servers. So why would someone deploy Splunk as a Forwarder (agent) on their Windows servers to push the data in?

1 Solution

piebob
Motivator

piebob
Motivator

maverick
Splunk Employee
Splunk Employee

Please review this topic in our community wiki for more detail regarding this question.

http://www.splunk.com/wiki/Deploy:SnareVwmiVforwarding

Also,

  • WMI does not pull data via SSL, but Splunk Forward can push data over SSL
  • pulling data with WMI may produce gaps in the data, if/when service is restarted
  • Splunk Forwarder can monitor and push up non-Windows data as well (i.e. IIS events, MSSQL, DIR listings every hour, etc.)
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.