Getting Data In

What is the best way to send events from a windows server to syslog?

christianubeda
Path Finder

I team!

I need to extract syslog ad events from a windows server and send them to my splunk forwarder.

I can not install the UF directly on the server because it will not have connectivity with the indexer.

My plan is to install a syslog on the server, send the events to the forwarder (on another machine on the same network) and from there to the indexer.

What is the best way to send events from a windows server to syslog?

Thank you!

0 Karma

spayneort
Contributor

You could use a UF on another server as an intermediate forwarder.

https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Configureanintermediateforwarder

Another option is to use Windows Event Forwarding (WEF) to send the events to the second server, then have the UF on that server send them to the indexer.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...