Universal Forwarder has to be on every machine?

[byronious]

The installer makes it seem like it is possible to pull data from another machine with the universal forwarder. Is this possible? I can't seem to find any documentation on how to configure this if it is.

Thanks!

[Ayn · Accepted solution]

In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

[Ayn]

It's definitely possible! There are examples in the wmi.conf docs on how to do this. See http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wmiconf (specifically the examples section at the end).

[byronious]

It seems like it states a universal forwarder can be configured to perform WMI polling for remote machines though? I have a universal forwarder setup on a Windows machine and it's pulling the local data that gets configured during installation. I'm trying to figure out how to have it pull information from a remote Windows machine. Is that not possible?

[Ayn]

Linux hosts will not be able to perform WMI polling, because it's done via native Windows calls.

[byronious]

By answer I mean why I don't see that.

I've still yet to find any useful documentation that explains how to configure a forwarder either via .conf files or via CLI to collect remote event log information.

[byronious]

I think I found my answer:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata

I'm currently running Splunk using Linux.

[byronious]

So I read through that and found this:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Configure_remote_event_log...
The only problem is the instructions do not match what I see. I don't see Remote Event Log collections.