Getting Data In

Splunk Windows network information

joe06031990
Communicator

Hi,

I have a Splunk instance on Linux and I am trying to get windows network information from a IIS web server for example Port number,Protocol and IP address. I can get it to work on a windows instance just not from Linux not sure if it uses WMI just wondered if it was possible or would it need to be a powershell script?

 

Thanks

 

Joe

Labels (3)
0 Karma
1 Solution

joe06031990
Communicator

I've added:

[WinNetMon://test]
addressFamily = ipv4;ipv6
direction = inbound;outbound
host = WIN-PIDFR5LUJC6
packetType = connect;accept
protocol = tcp;udp

 

works fine now, Thanks for your help.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

you have to:

  • install a Splunk Universal Forwarder on one or all the Windows targets;
  • on these UFs install e.g. the Splunk_Windows_TA (https://splunkbase.splunk.com/app/742/) that contains all the windows inputs: wineventlog, ps scripts, files, etc...;
  • then, you can add more inputs (in the same TA or in a different one) to take the IIS logs and all the things you need, also other PS scripts.

Ciao.

Giuseppe

joe06031990
Communicator

Hi, I have done the bellow and can get all apart from the network logs for ports,up addresses, ETC the only network details I see are bytes in/out.

 

thanks

 

Joe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

Are you using Splunk TAs or custom inputs?

Did you tried the Splunk Add-On for Microsoft IIS (https://splunkbase.splunk.com/app/3185/#/overview)?

Ciao.

Giuseppe

 

joe06031990
Communicator

Hi,

 

I have Splunk TA,IIS and Windows infrastructure app installed.

 

thanks

joe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

if the information that you can have from those TAs aren't sufficient for your needs, the only way is to write your own scripts to insert in a custom TA.

Ciao.

Giuseppe

joe06031990
Communicator

I've added:

[WinNetMon://test]
addressFamily = ipv4;ipv6
direction = inbound;outbound
host = WIN-PIDFR5LUJC6
packetType = connect;accept
protocol = tcp;udp

 

works fine now, Thanks for your help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joe06031990,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...