Getting Data In

Splunk remote windows data collection

Splunk Employee
Splunk Employee


We are looking at using the universal forwarder to collect remote windows data from event logs from approx 11,000 clients. Is this recommended and is there any documentation out there on how to set this up if we have all client machine names?


0 Karma


If you are worried about in flight data loss there is easy way to guaranty reciept of the data from the remove client as wmi is based on interval. I would recommend installing the UF locally on each 11,000 servers as the UF will have check points on the event logs and you can enable indexer acknowledgement.

0 Karma


If you're using WMI this wont work. WMI causes issues once you get over about 60 WMI inputs.

You need to use universal forwarders installed locally on each server. If you're looking to script the install see these resources:

I've tried to powershell this using winrm but havent had luck with msiexec running in a remote shell:

function Deploy-Splunk 
param (
[string] $ServerList = $(Read-Host -prompt "Path to server list (b:\splunk\qa\serverlist.txt)"),
[string] $MSI = $(Read-Host -prompt "Path to MSI (b:\splunkforwarder\forwarder.msi)"),
[string] $Indexer = $(Read-Host -prompt "Indexer Hostname or IP ("),
[string] $Port = $(Read-Host -prompt "Port Number (9999, 9997)"),

begin {

process {
$Indexer='RECEIVING_INDEXER="' + $Indexer + ':' + $Port + '"'
$InstallCommand=msiexec.exe /i $MSI $Indexer $Options

foreach ($Server in (gc $ServerList)) {
$S = new-pssession -computername $Server -credential $Cred
invoke-command -session $S -Argumentlist @($InstallCommand) -ScriptBlock {

if ($error -ne '$null') {
$msg='SplunkUniversalForwarder Failed to Install.'  + '`n`r' + 'Installation Command: ' + $InstallCommand + '`n`r' + 'Calling Stack...' + '`n`r' + $error
Write-EventLog Splunk -Source Splunk -entrytype error -eventID 999 -message "$msg"
} #end if error

if ($error -eq '$null') {
$msg='SplunkUniversalForwarder Installed Successfully.'  + '`n`r' + 'Installation Command: ' + $InstallCommand
Write-EventLog Splunk -Source Splunk -entrytype error -eventID 999 -message "$msg"
} #end if error

} #end invoke-command / scriptblock

} #end foreach loop

} #end process

} #end function Deploy-Splunk

Splunk Employee
Splunk Employee

This is an option that we could do with SCCM and yes we are with in flight data loss.


Why not install a UF on the clients? 11,00 client for one UF seems a bit hefty. Also how concerned are you with in flight data losss?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!