How to collect logs from a DC with a Splunk Universal Forwarder and with a 3rd party WMI at the same time?

[ikulcsar]

Hi,

Our customer has several DC (Domain Controllers). They already collect logs from DC using SyslogNG Agent over WMI. They planning to implement a Splunk system and want to collect logs with UF (Universal Forwarders), too. So SyslogNG Agent over WMI and Universal Forwarder will operate at once on DCs.

Can this scenario lead to any problem? Compatibility, performance, etc?

Does anyone have any experience on the subject?
I forgotten it: the main focus on only security logs, at least now.

Regads,
István

[JDukeSplunk]

The biggest issue I can see is the duplication of data in your indexers. This can be sorted out in a search by sourcetype/index but it will still impact your license. Also, there will be a performance hit, but as long as the windows host is sufficiently powered it will not feel except for the first few seconds of the SplunkFowarder service starting.

I highly recommend the Splunk_TA_Windows app.

If I were you, I would stop using the WMI input once the forwarder is in place. Historical searches will need to use the WMI based search parameters, of course.

Good luck.