Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Is it recommended to install Universal Forward...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
kiran331
Builder
02-15-2017
11:50 AM
Hi
Is it the best way to install Universal Forwarders on all Workstations and enable windows security events , Right Now I have UF's on all DC's?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nickhills
Ultra Champion
02-15-2017
12:24 PM
If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"
But you should consider a few things first:
- Monitoring your DCs will show you failed/successful domain logins, but they may not include all the security relevant events, such as all attempts using local credentials or local file/device access.
- With the UF on your workstations you can also start to monitor application logs, or with SplunkStream even wireline traffic for remote diagnostics etc.
- But - you can easily start collecting huge amounts of data, so be sure your indexer disk (or your index management) has been spec'd to cope - and most importantly consider the size of your licence!
If my comment helps, please give it a thumbs up!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nickhills
Ultra Champion
02-15-2017
12:24 PM
If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"
But you should consider a few things first:
- Monitoring your DCs will show you failed/successful domain logins, but they may not include all the security relevant events, such as all attempts using local credentials or local file/device access.
- With the UF on your workstations you can also start to monitor application logs, or with SplunkStream even wireline traffic for remote diagnostics etc.
- But - you can easily start collecting huge amounts of data, so be sure your indexer disk (or your index management) has been spec'd to cope - and most importantly consider the size of your licence!
If my comment helps, please give it a thumbs up!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mpreddy
Communicator
02-15-2017
12:03 PM
some thing related answer:
https://answers.splunk.com/answers/499611/how-to-monitor-remote-logs-in-a-centerized-heavy-f.html
Get Updates on the Splunk Community!
Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year
At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...
Tech Talk Recap | Mastering Threat Hunting
Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...
Observability for AI Applications: Troubleshooting Latency
If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...
