Monitoring Computers connect to a network

[thomashigginson]

How can I add a data input(s) for remote computers connected to a Network using Splunk? Splunk has access to the network and I want to collect data usage and WinLog Events.

[richgalloway]

Install a Splunk Universal Forwarder on each remote computer. Configure the forwarder to send the desired information to your indexer(s).

[thomashigginson]

Thanks for the doc, but unfortunately, my Splunk's CLI keeps exiting as soon as I open it, so I can't add the forwarder as an input.

[Jeff_Lightly_Sp]

I agree that using a forwarder is usually the best and easiest way. A good documentation read can be found here:
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

[richgalloway]

How Splunk reaches out to other computers depends on the computer and how the data is stored. Splunk DB Connect, for example, can extract data from an SQL database. Scripted inputs can be created where the script launches a program that queries other computers for data and indexes it in Splunk. Using a forwarder is usually the easiest way.

[thomashigginson]

I most likely am going to use forwarders then, but how can Splunk be configured to grab data from other computers? It sounds to be more difficult to set up.

[richgalloway]

Splunk can only search for and alert on data in its indexes. While it's possible for Splunk to grab data from other computers, the more common approach is for the other computers to send data to Splunk. If the data you need is already indexed then you don't need a forwarder.

[thomashigginson]

If the main computer with Splunk has access to the Users via the Network, and I'm looking for specific data, can I just use the Add Data and fill out the information to, say, record if a User incorrectly logs in 5 times and send an email alert? Or do I still have to set up the forwarder?

[richgalloway]

Correct. Fortunately, they'll all be configured the same so all you have to do is set up one and copy the config to the others.

[thomashigginson]

Each forwarder, then, needs to be configured to handle data on the local system and only send information I specify to the main computer, correct?