splunk search server event logs from my PC without forwarders?

[sldadmin]

Hi, from my workstation PC, can I install Splunk and then search event logs on my domain controllers and windows servers, WITHOUT installing anything onto those servers? I'm just testing Splunk and don't want to install anything onto these servers, especially if install (and later uninstall) would require a reboot of the server. And risk (any) 3rd party product making my server unstable (especially the DCs).

Also, I need to search logs for many domain names and IPs. Will Splunk do this? (take these from a list or XLS) f not, any product known that will do this, hopefully without any agent on the servers?

[yannK]

To monitor WinEventLogs remotely, check the WMI inputs.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ConsiderationsfordecidinghowtomonitorWindowsd...

To monitor AD, it can be done remotely, you need to check this guide :
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/AuditActiveDirectory

[sldadmin]

Thanks for the config pointers. But a couple other key questions were left unanswered, if anyone can help. They were:

emphasized text*Is restart required after agent (univ forwarder) install on a server? Or upon install?*emphasized text

*emphasized text*Also, I need to search logs for many domain names and IPs. Will Splunk do this? (take these from a list or XLS) If not, any product known that will do this?