I am new to splunk and I an trying to get the solution right for my company that being said . My delima is that the Universal forward is memory intensive, so I wanted a back up plan in case i need to pull files.
my current setup would be
Servers /w Uni FWD ---> consolidator/Forwarder?? ----> indexer
If i deem certain system can't handle the additional Memory overhead is it possible to have the Consolidator/ Forwarder pull items via wmi from the servers and then forward the info to the indexer
Servers/WMI pull ----> to Consolidator/forwarder/Indexer??(THIS WOULD PULL DATA AND THE FWD) ----> indexer
If i have some of the terminology wrong please feel free to correct me.
Thanks in advanced
So is the question if Splunk in general, and Universal Forwarders in particular, can grab logs via WMI? If so the answer is yes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata
Yes, since the forwarder can pull logs via WMI, and since its task is to forward logs, it will be able to do what you want to accomplish.
no.. I understand that it can grab data via WMI.. I am curious if i have a segmented environment, can I have a forwarder in a DMZ that can pull my logs via WMI and then Forward them to my indexer outside the DMZ.. So can the forwarder or any component grab the files/logs via WMI and then send them to my Indexer..