Splunk Universal Forwarder for Windows 9.0.4

Splunk Cloud Platform

Hi,

I have installed Splunk Universal Forwarder for windows 9.0.4 to work with Splunk Cloud. Downloaded credential packages and saw logs in Splunk cloud. We need to send these logs to a index other than the main. Do you know how I can do this? Also, which files would need to be edited if we want to add/remove log source (right now, we only have windows security logs, but maybe we want to add windows application logs also) Can the installation of UF and these files be done via Microsoft SCCM when we need to do a mass deployment (instead of using deployment server)?

Thanks,

Krunal Dave

Get Updates on the Splunk Community!

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security