Getting Data In

Is it possible to collect Windows event logs from a NAS server (Public folder) without a universal forwarder?

yn03594042
New Member

Dear guys,

Is it possible to gather Windows event logs to indexer server by way of NAS Server which were transferred from any monitoring Windows server? This is under the condition of not deploying a Universal Forwarder on these monitoring PCs.

Best regards,
y.niii

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Not sure I understand, but if installing a forwarder is not an option, the usual approach is to have source systems send their event logs to a Windows event collection server and install the forwarder there.
Remember, event logs are binary and we need to properly format them before indexing into Splunk, which is what the executables do that ship with the Windows UF.
Take a look here for a description on how that works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...