Getting Data In

Windows Event collection - A really basic question, Doh

New Member

Guys, I want to use Splunk for some eval work on Windows 7 prof and server 2008 and 2012. I want to stick strictly to Universal Forwarders and not WMI. Am i reading this document link correctly below?

The words "Splunk Enterprise must run on Windows" says to me I have no option other than a Windows install of Splunk Enterprise and therefore my currently built Splunk Enterprise Red Hat server install is not fit for this purpose?

The documentation is good but pulling these simple strings together is not easy. Can anyone point me to a document that will answer these questions please?

0 Karma


Nah - you are fine. Put the appropriate UFs on your Windows devices and have the data sent back to your Red Hat indexer(s). I get why the document looks confusing but haven't had any caffeine yet so can't concisely reword it.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...