Getting Data In

Forwarder and More

paul_1994
Path Finder

I am new to splunk and I an trying to get the solution right for my company that being said . My delima is that the Universal forward is memory intensive, so I wanted a back up plan in case i need to pull files.

my current setup would be

Servers /w Uni FWD ---> consolidator/Forwarder?? ----> indexer

If i deem certain system can't handle the additional Memory overhead is it possible to have the Consolidator/ Forwarder pull items via wmi from the servers and then forward the info to the indexer

Servers/WMI pull ----> to Consolidator/forwarder/Indexer??(THIS WOULD PULL DATA AND THE FWD) ----> indexer

If i have some of the terminology wrong please feel free to correct me.

Thanks in advanced

0 Karma

Ayn
Legend

So is the question if Splunk in general, and Universal Forwarders in particular, can grab logs via WMI? If so the answer is yes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

0 Karma

Ayn
Legend

Yes, since the forwarder can pull logs via WMI, and since its task is to forward logs, it will be able to do what you want to accomplish.

0 Karma

paul_1994
Path Finder

no.. I understand that it can grab data via WMI.. I am curious if i have a segmented environment, can I have a forwarder in a DMZ that can pull my logs via WMI and then Forward them to my indexer outside the DMZ.. So can the forwarder or any component grab the files/logs via WMI and then send them to my Indexer..

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...