Getting Data In

Can splunk running on unix index windows machines?

I recently set up a linux server to collect my firewall log. I then setup splunk to index the log. It seems that I cannot index the windows machine from the splunk instance running on my linux server.

Is it necessary to forward from the linux splunk to the windows splunk?

Tags (2)

Splunk Employee
Splunk Employee

A Splunk indexer on any platform can index Windows logs. Your best bet is to install a Lightweight Forwarder on the Windows host to forward logs to your Linux-based indexer. You might want to install and configure the Windows app on the Windows forwarder, as well as the Linux indexer, to leverage the canned dashboards/reports.

You could also forward the Linux logs to a Windows indexer, or if you have two indexers installed, configure them for distributed search.

Here is a reference to the reverse -- using Windows to collect *NIX data: