Getting Data In

Alternatives to Splunk UF for Server 2003/2008 R1


Looking for an alternative way to forward logs to splunk for legacy Windows server 2003/2008r1. I dont see a universal fowarder available for these old server versions. However I still would like to bring logs into splunk. Please assist in providing ideas on how to make this happen. Thanks in advance.

Labels (3)
0 Karma

Path Finder

I would suggest upgrading these servers if possible.

But if that's impossible, I would look into setting up Windows Event Forwarding, so that these 2003 and 2008 servers send their logs to a different windows machine running a later version of windows, which then indexes the events into Splunk. You may have to set up the following Stanzas in your cluster master and deployment server apps so that Splunk knows to re-write the host field so that it reflects the 2003 and 2008 servers rather than the collector server:

# in inputs.conf in deployment server app
disabled = 0
index = forward_event_index

# in props.conf in cluster master app
TRANSFORMS-change_host_windows = WinEventHostOverride

# in transforms.conf in cluster master app
DEST_KEY = MetaData:Host
FORMAT = host::$1


0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...