Usinig Windows Storage Server 2012 as the Event collector and Splunk forwarder.

[yn03594042]

Hi all,

Is it available using Windows Storage Server 2012 as the Event collector and Splunk forwarder which gather taraget monitoring Windows servers or clients event log? These target machines are prohibited Splunk installation.
This question is two points as following.
- whether Storage Server is to be Windows Event Collector
- whether Splunk forwader is able to install to Storage Server

Best regards,
Y.N

[jkat54]

There are no components in Splunk named "Event Collector". In some cases you might use a heavy forwarder to collect events.

1. whether Storage Server is to be Windows Event Collector?

Sure it can be used as a forwarder. To collect the events from the other windows machines however, you would usually put a universal forwarder on all of them. Instead, you said that you cant put a universal forwarder on them. Then you must read the event logs using WMI, Windows Remoting, or another technology that is allowed on the servers, feed the data back to your forwarder somehow, and then ingest the data there. It's so much easier to just use the UF.

1. whether Splunk forwader is able to install to Storage Server

Yes, splunk will install on storage server. Just download the 64bit or 32bit version based on your os type.