Getting Data In

Universal Forwarder has to be on every machine?

byronious
New Member

The installer makes it seem like it is possible to pull data from another machine with the universal forwarder. Is this possible? I can't seem to find any documentation on how to configure this if it is.

Thanks!

Tags (1)
0 Karma
1 Solution

Ayn
Legend

In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

View solution in original post

0 Karma

Ayn
Legend

In Windows environments, you can make use of WMI polling to grab data from other machines. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

0 Karma

Ayn
Legend

It's definitely possible! There are examples in the wmi.conf docs on how to do this. See http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Wmiconf (specifically the examples section at the end).

byronious
New Member

It seems like it states a universal forwarder can be configured to perform WMI polling for remote machines though? I have a universal forwarder setup on a Windows machine and it's pulling the local data that gets configured during installation. I'm trying to figure out how to have it pull information from a remote Windows machine. Is that not possible?

0 Karma

Ayn
Legend

Linux hosts will not be able to perform WMI polling, because it's done via native Windows calls.

0 Karma

byronious
New Member

By answer I mean why I don't see that.

I've still yet to find any useful documentation that explains how to configure a forwarder either via .conf files or via CLI to collect remote event log information.

0 Karma

byronious
New Member

I think I found my answer:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata

I'm currently running Splunk using Linux.

0 Karma

byronious
New Member

So I read through that and found this:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Configure_remote_event_log...
The only problem is the instructions do not match what I see. I don't see Remote Event Log collections.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...