Need help with AD

[Splunk-tester]

Hi.

I want to try Splunk on windows server 2019, i have windows server and a client, what to do to make splunk read what is happening in the client pc?
is there are step by step tutorial? 

thanks

[gcusello]

Hi @Splunk-tester,

let me understand:

• you want to test Splunk in a lab, composed by a Windows server where to install Splunk,
• and then install a Universal Forwarder (agent) on the client to monitor it,

is it correct?

if this is your need, you have to:

• install Splunk Enterprise on the server,
• install Spluk Universal Forwarder on the client,
• enable receiving on the server [Settings > Forwardering and Receivig > Receiving],
• configure UF to send logs to the Splunk Server (https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwioyaDSgIj-AhWlGQYAHW5xBqEYABAAGgJ3cw&oho...)
• search on Splunk server logs from that host.

To be guided, you can use the links from @richgalloway or search on the above link, or search in the YouTube Splunk Channel https://www.youtube.com/@Splunkofficial some video to learn about Splunk.

Only one last hint: I understand that maybe you know very well windows and not very well Linux, and that Splunk is installable also on Windows, but I usually use windows server for Splunk Enterprise server only in labs or very little infrastructures, never in large production infrastructures.

Ciao.

Giuseppe

[richgalloway]

While it's possible to read some data from a remote PC, it's far easier to install Splunk on the computer where the data resides.  That can be a full instance of Splunk Enterprise or a Splunk Universal Forwarder (agent).

Instructions for installing Splunk on Windows are at https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindows

To learn about monitoring remote PCs, see https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/ConsiderationsfordecidinghowtomonitorW...