I currently am running splunk enterprise on a Linux Distribution (Red Hat). I am following the guide to import WMI data to splunk, and there is no "Remote event log collections".
Forwarder: Windows 7 (64 bit)
Is it possible to use WMI on a Windows forwarder and send it to indexer / search heads running linux?
Yes, you can use a forwarder to collect data via WMI and send the results to a linux-based Splunk instance. Check the table here for what is required to monitor hosts using WMI. That topic includes a
wmi.conf example. The reasons for collecting data via WMI instead of using forwarders must be evaluated and the trade-offs reviewed.
We operate in an environment where agents are viewed as evil. I do not personally agree with that, but will take the wins where I can get them. According to that table, splunk enterprise must be running on windows. My linux enterprise version does not list "Remote Event Log Collections" as an option under data inputs. Is there an addon I have to install?
snip of @ekost's answer: Yes, you can use a forwarder to collect data via WMI and send the results to a linux-based Splunk instance.
Sorry, I know I sound like a broken record here. The issue is following the instructions to get this setup. The link is here:
Under "Configure remote event log monitoring", it says go to Data Inputs and click Remote Event Log Collections. That option is not there. All I have is TCP, UDP, Local File and Scripts. Is there something else I need to install for that to show up?
I'm guessing you attempted to configure Remote event log collections from a linux box.
Here's what I did: Start up an ancient Windows VM, dropped in a copy of Splunk 6.1.4 and ran an install.
Once installed, I went to Settings > Data Inputs and chose Remote event log collections.
I configured a remote connection in the UI, which updates a couple .conf files and restarted the services.
I verified data was coming into the instance.
Now I have a choice:
Thank you, this is similar to the method I used as well. I basically made the WMI.conf file on my windows forwarder (dropping a full version would have probably been much easier).