Getting Data In

Can you help me with my monitoring Windows servers query?

New Member

I want to monitor Windows Servers — more specifically, application/security/system logs. Once I install the Universal Forwarder on the servers, can I just create a deployment app and put this in the inputs.conf file?

Windows platform specific input processor.

disabled = 0
index = win_servers
disabled = 0
index = win_servers
disabled = 0
index = win_servers

disabled = false
sourcetype = dns

disabled = false
sourcetype = dns

We inherited a Splunk installation and there are several Splunk apps installed, everything is going to the "main" index, and I see a bunch of different sourcetypes defined :

XmlWinEventLog:Security (why would I use this over WinEventLog:Security?)

I also noticed that the Splunk_TA_microsoft_ad created the windows,wineventlog, and winevents on the indexer. Are those even needed? Thanks.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...