How can I get web request data into Splunk?

[hux2000]

Brand new Splunk user here. As a learning experience, I want to index all URLs requested by users/computers (Mac, Linux & Windows) on my network. I've found lots of good info on how to use Splunk to search that data. But thus far I've been unable to figure out how you actually get it into Splunk to begin with.

I'm using the free version, so I want to minimize the data flow so that I don't breach the max. amount you're allowed as a free user.

As far as I can tell, I'm supposed to install the universal forwarder on the various machines on my network. But won't that forward all syslog/Windows events, which is way more than I need? And in any case, are URL requests even stored by syslog/Windows event system?

As you can tell, I'm kind of stuck! Can anyone point me in the right direction?

[richgalloway]

Splunk has a manual dedicated to getting data into Splunk at https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Admin/IntroGDI

AFAIK, URLs are not stored in the Windows event log (at least not by default).  You'll need a tool to collect and save that data.  Then you can use a UF to forward the data to Splunk.

When setting up the UF, disable all the inputs you don't need so you'll use less license quota.