Getting Data In

Configure SYSLog on a Windows Server



my question might be dumb but it is worth to ask,
On a Windows Servers, how do i configure to send the authentication.log to a Splunk heavy forwarder?
is this the same to say "I need to configure the syslog to be sent to the heavy forwarder?"

Thank you!

0 Karma

  1. Install a universal forwarder on your windows server
  2. During the installation, put Heavy Forwarder's IP in the Receiving Indexer field (and deployment server IP if you have one)
  3. Configure monitor input stanza in inputs.conf to point to the authentication.log
  4. restart the universal forwarder.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...