Getting Data In

Forwarder and More

paul_1994
Path Finder

I am new to splunk and I an trying to get the solution right for my company that being said . My delima is that the Universal forward is memory intensive, so I wanted a back up plan in case i need to pull files.

my current setup would be

Servers /w Uni FWD ---> consolidator/Forwarder?? ----> indexer

If i deem certain system can't handle the additional Memory overhead is it possible to have the Consolidator/ Forwarder pull items via wmi from the servers and then forward the info to the indexer

Servers/WMI pull ----> to Consolidator/forwarder/Indexer??(THIS WOULD PULL DATA AND THE FWD) ----> indexer

If i have some of the terminology wrong please feel free to correct me.

Thanks in advanced

0 Karma

Ayn
Legend

So is the question if Splunk in general, and Universal Forwarders in particular, can grab logs via WMI? If so the answer is yes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

0 Karma

Ayn
Legend

Yes, since the forwarder can pull logs via WMI, and since its task is to forward logs, it will be able to do what you want to accomplish.

0 Karma

paul_1994
Path Finder

no.. I understand that it can grab data via WMI.. I am curious if i have a segmented environment, can I have a forwarder in a DMZ that can pull my logs via WMI and then Forward them to my indexer outside the DMZ.. So can the forwarder or any component grab the files/logs via WMI and then send them to my Indexer..

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...