Getting Data In

Can you help me with my monitoring Windows servers query?

New Member

I want to monitor Windows Servers — more specifically, application/security/system logs. Once I install the Universal Forwarder on the servers, can I just create a deployment app and put this in the inputs.conf file?

Windows platform specific input processor.

disabled = 0
index = win_servers
disabled = 0
index = win_servers
disabled = 0
index = win_servers

disabled = false
sourcetype = dns

disabled = false
sourcetype = dns

We inherited a Splunk installation and there are several Splunk apps installed, everything is going to the "main" index, and I see a bunch of different sourcetypes defined :

XmlWinEventLog:Security (why would I use this over WinEventLog:Security?)

I also noticed that the Splunk_TA_microsoft_ad created the windows,wineventlog, and winevents on the indexer. Are those even needed? Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...