How do I configure Windows server to send event log my splunk indexer installed in Linux?

[tomero2011]

Hi Splunkers,

I am very new to Splunk and would like to monitor Windows servers, how do I configure the Windows boxes to send their event data over to Splunk indexer? The indexer is installed in a Linux environment. Installing a Splunk forwarder on each Windows box does not seam to be a good option at my place.

Thank you for your advice.

[Ayn]

Do you have a specific reason for thinking that it's not a good option to install a forwarder on each Windows server? This is exactly what I would do. The docs have good information on this subject, this is a good start: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutWindowsdataandSplunk

EDIT: Oh, and this is even more excellent, covers exactly what you're asking about! http://docs.splunk.com/Documentation/Splunk/4.3/Data/ConsiderationsfordecidinghowtomonitorWindowsdat...

[sloshburch]

An updated link that furthers @ayn's point:
What are the best practices for installing Splunk on Windows endpoints?