Splunk Search

Export Windows Event LOG

robertocapizzo9
Loves-to-Learn

Hi,
I need to import the security and application logs of many windows servers to splunk, but for security reasons I cannot install a splunk universal forwarder instance, I read on the splunk documentation that it is not recommended to use wmi to import the logs .. .
What do you recommend?

thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start by telling your Security people that you'll be using Splunk to monitor WinEventLog:Security, which will *enhance* the security of those servers.  They probably won't care, but at least then you'll know what hypocrites they are.

Another possibility is to forward the Windows events to another server that can run a UF.  See https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-... for more about event forwarding.

Still another possibility that I've never seen done is to forward the Windows events in HTTP protocol directly to a HEC input.  See the same link above.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...