Use a heavy forwader to pull through WMI and send to Splunk cloud

[heskez]

Hi all,

In this particular situation we'd like to use a heavy forwader to be able to pull Windows event logs from windows devices in datacenter though WMI on prem and send to Splunk cloud. Is that possible?

Thanks in advance,
Erik

[anmolpatel]

If you need to go via the WMI route, use this docs to help you get started
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata

You can do this with just the UF.
So, if you've the capability to install UF's (preferred method) then get the Splunk_TA_Windows
https://splunkbase.splunk.com/app/742/

Docs for setting it up the app
https://docs.splunk.com/Documentation/MSApp/2.0.0/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

On your cloud instance you'll have the Universal Forwarder app, which will provide you the config to send data to the cloud.

You might need to raise a Splunk support ticket to have the app deployed on Splunk Cloud, so the data can be parsed correctly.

Now, if you're planning to collect windows data at scale, it would also be ideal to look at setting up a deployment server and pushing out the configurations via that. This will help with centralised management.

[richgalloway]

Yes, it is possible, but you don't need a heavy forwarder to do that. A universal forwarder will work just fine.

Once you install the forwarder of choice, configure an inputs.conf file to pull the desired events. Then download the "Universal Forwarder" app from your Splunk Cloud account and install it on the forwarder.

[heskez]

Thank you for your answer. So in order to pull the logs from all these Windows devices through WMI, one needs only a Universal Forwarder on one Windows device and send it to the Splunk cloud right?

[richgalloway]

Yes. However, WMI uses more resources than running a local UF on each Windows device.