Getting Data In

Can splunk running on unix index windows machines?

connorsvilardo
Engager

I recently set up a linux server to collect my firewall log. I then setup splunk to index the log. It seems that I cannot index the windows machine from the splunk instance running on my linux server.

Is it necessary to forward from the linux splunk to the windows splunk?

Tags (2)

Ron_Naken
Splunk Employee
Splunk Employee

A Splunk indexer on any platform can index Windows logs. Your best bet is to install a Lightweight Forwarder on the Windows host to forward logs to your Linux-based indexer. You might want to install and configure the Windows app on the Windows forwarder, as well as the Linux indexer, to leverage the canned dashboards/reports.

You could also forward the Linux logs to a Windows indexer, or if you have two indexers installed, configure them for distributed search.

Here is a reference to the reverse -- using Windows to collect *NIX data: http://answers.splunk.com/questions/11579/splunk-for-nix

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...