Getting Data In

feed Splunk App for Windows Infrastructure without forwarders?


I have a situation where management wants to see server status of some remote deployed servers, but due mostly to politics, installing forwarders on these machines to push metrics back to our Indexer is not an option. We do, however, have an automated file mover that can send back any files we need to where the indexer can access them. We are doing that with simple text based log files already.

Is there anyway to extract the powershell scripts or commands from the typical Universal Forwarder that would generate the metrics and just have the data output to files that we could move, and still feed the Splunk-built Infrastructure app?

0 Karma


Hi DaClyde,
which logs do you need?
in the available Windows Technical Add-Ons (e.g. ), you can find many script to use.


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!