Getting Data In

How to add input stanzas to monitor Windows application, security and system logs via command line?

splunker12er
Motivator

After installing Splunk Universal forwarder in Windows Server ., how to add monitor stanzas for getting windows application , security, system logs via command line ?

>splunk add monitor
0 Karma

DerekKing
Path Finder

Hi,

You can only do part of the job using ./splunk add monitor (on a forwarder). You would still need to manually alter inputs.conf to add the index information.

Why wouldn't you add manually on the UF, or use forwarder management on the indexer to push out configs. ?

Failing that, I think you can tick a checkbox when you install the UF on a windows box to specifically forward Windows Event Logs.

Derek

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...