How can I monitor workstation Event Viewer logs?

[ericlarsen]

Is it possible to ingest individual workstation Event Viewer logs to Splunk? Is installing a UF on each workstation the only way to accomplish it?

[inventsekar]

its possible to ingest individual workstation event viewer logs to splunk.

detailed documentation can be found here -
http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorWindowseventlogdata

Per my understanding, Yes, UF should be installed on each workstation.
not sure, but, --- if UF can not be installed, then, some other tools or scripts should collect the event viewer logs and send it a splunk system (not sure how to accomplish this)

[ericlarsen]

Thanks for the quick response. I'm trying to avoid installing a UF on each workstation if possible. I'm hoping someone has come across a feasible alternative.

[inventsekar]

maybe, check this one -
Configure Computers to Forward and Collect Events
https://msdn.microsoft.com/en-us/library/cc748890(v=ws.11).aspx