Getting Data In

How do I configure Windows server to send event log my splunk indexer installed in Linux?

tomero2011
Engager

Hi Splunkers,

I am very new to Splunk and would like to monitor Windows servers, how do I configure the Windows boxes to send their event data over to Splunk indexer? The indexer is installed in a Linux environment. Installing a Splunk forwarder on each Windows box does not seam to be a good option at my place.

Thank you for your advice.

Tags (1)

Ayn
Legend

Do you have a specific reason for thinking that it's not a good option to install a forwarder on each Windows server? This is exactly what I would do. The docs have good information on this subject, this is a good start: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutWindowsdataandSplunk

EDIT: Oh, and this is even more excellent, covers exactly what you're asking about! http://docs.splunk.com/Documentation/Splunk/4.3/Data/ConsiderationsfordecidinghowtomonitorWindowsdat...

sloshburch
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...