- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Universal Forwarder has to be on every machine...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The installer makes it seem like it is possible to pull data from another machine with the universal forwarder. Is this possible? I can't seem to find any documentation on how to configure this if it is.
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's definitely possible! There are examples in the wmi.conf docs on how to do this. See http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wmiconf (specifically the examples section at the end).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It seems like it states a universal forwarder can be configured to perform WMI polling for remote machines though? I have a universal forwarder setup on a Windows machine and it's pulling the local data that gets configured during installation. I'm trying to figure out how to have it pull information from a remote Windows machine. Is that not possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Linux hosts will not be able to perform WMI polling, because it's done via native Windows calls.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By answer I mean why I don't see that.
I've still yet to find any useful documentation that explains how to configure a forwarder either via .conf files or via CLI to collect remote event log information.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I found my answer:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata
I'm currently running Splunk using Linux.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I read through that and found this:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Configure_remote_event_log...
The only problem is the instructions do not match what I see. I don't see Remote Event Log collections.
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
