Getting Data In

How to get logs from a Windows machine without installing a forwarder?

mmensch
Path Finder

Hi,

I understand that best practice is to install a universal forwarder on a server and send the logs directly to an indexer. However, if I have a circumstance that I cannot install the forwarder on a Windows machine, what would be my options on how to get logs into Splunk?

I've heard of something built into Windows such as WinEventLog forwarding, but I can't seem to find much documentation on it.

Thanks.

0 Karma
1 Solution

spayneort
Contributor

You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.

Event Forwarding info:

Splunk blog post
http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Microsoft blog post and presentation
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forward...

The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding.

View solution in original post

spayneort
Contributor

You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.

Event Forwarding info:

Splunk blog post
http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Microsoft blog post and presentation
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forward...

The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...