Getting Data In
Highlighted

Agent vs Agentless event gathering on Windows

Builder

Regarding agent vs agentless data / event gatering, WMI (agentless) seems easier to setup from within Splunk to pull in the data from remote Windows servers. So why would someone deploy Splunk as a Forwarder (agent) on their Windows servers to push the data in?

Highlighted

Re: Agent vs Agentless event gathering on Windows

Builder

Please review this topic in our community wiki for more detail regarding this question.

http://www.splunk.com/wiki/Deploy:SnareVwmiVforwarding

Also,

  • WMI does not pull data via SSL, but Splunk Forward can push data over SSL
  • pulling data with WMI may produce gaps in the data, if/when service is restarted
  • Splunk Forwarder can monitor and push up non-Windows data as well (i.e. IIS events, MSSQL, DIR listings every hour, etc.)
Highlighted

Re: Agent vs Agentless event gathering on Windows

Motivator