Getting Data In

Central Windows logs pulling point

jrsanders
Path Finder

Hello all,

Before we switched over to Splunk we used Loglogic. In Loglogic it was possible to setup a central pulling point for the windows logs using Lasso. I've been reading the Splunk documentation and I haven't seen anything that would suggest that I can forward the logs unless I install the forwarder on each Windows host. We have quite a bit of Windows host so doing individual installs would be very time consuming. So I was wondering if anyone has figured out how to set up a central point for pulling logs instead of installing the forwarder on each host.

Thanks,
JS

0 Karma
1 Solution

Ayn
Legend

My Loglogic knowledge is a bit rusty, but isn't Lasso the actual Loglogic agents that you deploy on systems? So that would be the equivalent to Splunk's Universal Forwarders?

Remote retrieval of event logs can be achieved by polling them via WMI. This method has its fair share of caveats so consider carefully whether you want to go down that path before you choose what to do. But, yes, Splunk can do this as well. Here goes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

View solution in original post

Ayn
Legend

My Loglogic knowledge is a bit rusty, but isn't Lasso the actual Loglogic agents that you deploy on systems? So that would be the equivalent to Splunk's Universal Forwarders?

Remote retrieval of event logs can be achieved by polling them via WMI. This method has its fair share of caveats so consider carefully whether you want to go down that path before you choose what to do. But, yes, Splunk can do this as well. Here goes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

jrsanders
Path Finder

Thank You!

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...