Getting Data In

Forwarder and More

paul_1994
Path Finder

I am new to splunk and I an trying to get the solution right for my company that being said . My delima is that the Universal forward is memory intensive, so I wanted a back up plan in case i need to pull files.

my current setup would be

Servers /w Uni FWD ---> consolidator/Forwarder?? ----> indexer

If i deem certain system can't handle the additional Memory overhead is it possible to have the Consolidator/ Forwarder pull items via wmi from the servers and then forward the info to the indexer

Servers/WMI pull ----> to Consolidator/forwarder/Indexer??(THIS WOULD PULL DATA AND THE FWD) ----> indexer

If i have some of the terminology wrong please feel free to correct me.

Thanks in advanced

0 Karma

Ayn
Legend

So is the question if Splunk in general, and Universal Forwarders in particular, can grab logs via WMI? If so the answer is yes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

0 Karma

Ayn
Legend

Yes, since the forwarder can pull logs via WMI, and since its task is to forward logs, it will be able to do what you want to accomplish.

0 Karma

paul_1994
Path Finder

no.. I understand that it can grab data via WMI.. I am curious if i have a segmented environment, can I have a forwarder in a DMZ that can pull my logs via WMI and then Forward them to my indexer outside the DMZ.. So can the forwarder or any component grab the files/logs via WMI and then send them to my Indexer..

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...