Getting Data In

Use a heavy forwader to pull through WMI and send to Splunk cloud

heskez
New Member

Hi all,

In this particular situation we'd like to use a heavy forwader to be able to pull Windows event logs from windows devices in datacenter though WMI on prem and send to Splunk cloud. Is that possible?

Thanks in advance,
Erik

0 Karma

anmolpatel
Builder

If you need to go via the WMI route, use this docs to help you get started
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata

You can do this with just the UF.
So, if you've the capability to install UF's (preferred method) then get the Splunk_TA_Windows
https://splunkbase.splunk.com/app/742/

Docs for setting it up the app
https://docs.splunk.com/Documentation/MSApp/2.0.0/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

On your cloud instance you'll have the Universal Forwarder app, which will provide you the config to send data to the cloud.

You might need to raise a Splunk support ticket to have the app deployed on Splunk Cloud, so the data can be parsed correctly.

Now, if you're planning to collect windows data at scale, it would also be ideal to look at setting up a deployment server and pushing out the configurations via that. This will help with centralised management.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it is possible, but you don't need a heavy forwarder to do that. A universal forwarder will work just fine.

Once you install the forwarder of choice, configure an inputs.conf file to pull the desired events. Then download the "Universal Forwarder" app from your Splunk Cloud account and install it on the forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

heskez
New Member

Thank you for your answer. So in order to pull the logs from all these Windows devices through WMI, one needs only a Universal Forwarder on one Windows device and send it to the Splunk cloud right?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. However, WMI uses more resources than running a local UF on each Windows device.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...