Getting Data In

Is it possible to set up Windows Event Viewer forwarding from one server to multiple indexes?

jmt0806
New Member

Is it possible to set up Windows Event Viewer forwarding from one server to multiple Splunk indexes?

We're in a shared server environment, and another group has already setup forwarding for Event Viewer logs.

Prefer having separate copy of logs for ease of querying/control over config changes.

0 Karma

muebel
SplunkTrust
SplunkTrust

You can setup a WinEventLog input, and then create a scripted input set to a different index.

I'd advise not worrying about that, and just have both groups use the same index. The events in the index shouldn't be modified, just the searches that filter the events. So it's perfectly ok for two groups to look at the same data in different ways.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...