Getting Data In

How do I send Windows data to Splunk?

cgautreaux
New Member

How do I send Windows data to Splunk? I have the app installed but can't figure out how to pull the data from the windows boxes...

Tags (1)
0 Karma
1 Solution

Rob
Splunk Employee
Splunk Employee

Assuming that your environment is that you have a server with Splunk installed and other Windows machines connected on the network for which you want to collect data, you will want to deploy a forwarder on the Windows machines.

You can follow these steps to enable receiving and forwarding for getting data in to Splunk from the Windows machines:

  • On your Splunk server, go to "Manager>>Forwarding and receiving>>Configure receiving"
  • Click on "New"
  • Enter an unused port number on which you would like Splunk to listen on in order to receive Splunk data. (e.g. 9000).
  • Click on "Save"

On your Windows machines do the following:

  • Install Splunk on the Windows machines and configure the data inputs that you want to collect.
  • Go to "Manager>>Forwarding and receiving>>Configure forwarding"
  • Click on "New"
  • Enter the SPlunk hostname or IP and the port number as above. (e.g. Splunkserver:9000 or 192.168.1.100:9000)

You have now set up a forwarder on that Windows machine that will collect data and can be configured via the web interface. You can disable the Web UI by making the Splunk instance on the Windows machine a Light Weight Forwarder. This can be done by going to "Manager>>Forwarding and receiving>>Enable light forwarding" You will see a warning message that the web UI will be disabled and that Splunk will only be accessible via the CLI interface (command line shell on Windows) for further configuration.

View solution in original post

Rob
Splunk Employee
Splunk Employee

Assuming that your environment is that you have a server with Splunk installed and other Windows machines connected on the network for which you want to collect data, you will want to deploy a forwarder on the Windows machines.

You can follow these steps to enable receiving and forwarding for getting data in to Splunk from the Windows machines:

  • On your Splunk server, go to "Manager>>Forwarding and receiving>>Configure receiving"
  • Click on "New"
  • Enter an unused port number on which you would like Splunk to listen on in order to receive Splunk data. (e.g. 9000).
  • Click on "Save"

On your Windows machines do the following:

  • Install Splunk on the Windows machines and configure the data inputs that you want to collect.
  • Go to "Manager>>Forwarding and receiving>>Configure forwarding"
  • Click on "New"
  • Enter the SPlunk hostname or IP and the port number as above. (e.g. Splunkserver:9000 or 192.168.1.100:9000)

You have now set up a forwarder on that Windows machine that will collect data and can be configured via the web interface. You can disable the Web UI by making the Splunk instance on the Windows machine a Light Weight Forwarder. This can be done by going to "Manager>>Forwarding and receiving>>Enable light forwarding" You will see a warning message that the web UI will be disabled and that Splunk will only be accessible via the CLI interface (command line shell on Windows) for further configuration.

sloshburch
Splunk Employee
Splunk Employee

Since this post is old, I'll add to the answer some updated links that could help:
* How do I get basic performance data for my Windows systems?
* What are the best practices for installing Splunk on Windows endpoints?

You may see more within the validated_best-practice tag and within the official product documentation.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...