I've a scenario where we have 300 windows servers, due to few reason we are not able to install splunk forwarder.
The alternative thought is of using WMI.
Since we've linux server as an splunk enterprise. We are anticipating to use an windows server as an intermediate forwarder (UF) which will collect logs from the target server WMI providers and an universal forwarder will forward it to Linux splunk enterprise.
Do I need to get the logs in splunk universal forwarder inputs.conf using powershell command Ex:
[powershell://CollectProcessInfoFromWmi] script = Get-CimInstance Win32_Process | Select-Object Field1, Field2, Field3 schedule = 0 */5 * ? * * sourcetype = Windows:MyWmiData
Or
Will this path in inputs.conf will do same?
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0
What is the purpose of splunk-wmi.exe, will it be present with universal forwarder?
Apart from this,
just placing wmi.conf in its appropriate place will manage target servers and queries to thier logs?
Considering windows specific configurations are done (domain acc from AD,firewall & permissions) What are installation steps for UF to work with WMI?
Are their any complexities I'm missing if we use WMI approach?
And how reliable it could be to use WMI against 300servers generating more than 30GB of daily data to be indexed? As I came to know this uses some polling mechanism as against to UFs which push the data.
I've worked with UFs only in the past.
Network traffic or intermediate forwarder as a bottleneck,Could these be a risks?
