Getting Data In

Remote windows event log to linux splunk server


I require to monitor windows event logs on my linux splunk server. I realize that i will likely have to convert the windows event logs to syslog-type logging -- does splunk recommend a software package to do this?

I'd like to do whatever splunk recommends works best with their system.

Tags (1)

New Member

You could use eventlog-to-syslog:

0 Karma

Splunk Employee
Splunk Employee

i think the best thing will be installing splunk as a forwarder on the windows box that you are trying to monitor. Set the unix box as a receiver to accept connections from the windows forwarder. This way you can install the windows app in both forwarder and receiver and be able to do a whole lot more..

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!