Alternatives to Splunk UF for Server 2003/2008 R1

[smithke]

Looking for an alternative way to forward logs to splunk for legacy Windows server 2003/2008r1. I dont see a universal fowarder available for these old server versions. However I still would like to bring logs into splunk. Please assist in providing ideas on how to make this happen. Thanks in advance.

[dave_null]

I would suggest upgrading these servers if possible.

But if that's impossible, I would look into setting up Windows Event Forwarding, so that these 2003 and 2008 servers send their logs to a different windows machine running a later version of windows, which then indexes the events into Splunk. You may have to set up the following Stanzas in your cluster master and deployment server apps so that Splunk knows to re-write the host field so that it reflects the 2003 and 2008 servers rather than the collector server:

# in inputs.conf in deployment server app
[WinEventLog://ForwardedEvents]
disabled = 0
sourcetype=XmlWinEventLog:ForwardedEvents
host=WinEventLogForwardHost
index = forward_event_index


# in props.conf in cluster master app
[host::WinEventLogForwardHost]
TRANSFORMS-change_host_windows = WinEventHostOverride


# in transforms.conf in cluster master app
[WinEventHostOverride]
DEST_KEY = MetaData:Host
REGEX=<Computer>([^.<]+).*?<\/Computer>
FORMAT = host::$1