Getting Data In

How can I get web request data into Splunk?

hux2000
Engager

Brand new Splunk user here. As a learning experience, I want to index all URLs requested by users/computers (Mac, Linux & Windows) on my network. I've found lots of good info on how to use Splunk to search that data. But thus far I've been unable to figure out how you actually get it into Splunk to begin with.

I'm using the free version, so I want to minimize the data flow so that I don't breach the max. amount you're allowed as a free user.

As far as I can tell, I'm supposed to install the universal forwarder on the various machines on my network. But won't that forward all syslog/Windows events, which is way more than I need? And in any case, are URL requests even stored by syslog/Windows event system?

As you can tell, I'm kind of stuck! Can anyone point me in the right direction?

Labels (1)

richgalloway
SplunkTrust
SplunkTrust

Splunk has a manual dedicated to getting data into Splunk at https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI

AFAIK, URLs are not stored in the Windows event log (at least not by default).  You'll need a tool to collect and save that data.  Then you can use a UF to forward the data to Splunk.

When setting up the UF, disable all the inputs you don't need so you'll use less license quota.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...