To Splunk, Windows Event Logs are just another kind of event. Yes you can place any sort of windows event log data into splunk, and can create searches relatively easily to achieve the sorts of goals you outline.
Splunk natively installed on a system as a forwarder can perform windows event log data collection and forwarding. Splunk can acquire all events from the logs. This would involve installing splunk on the windows XP devices. If you were to pursue this approach, I would guesstimate that you would want at least around 1 receiving splunk node per 1000 forwarders, purely to manage the number of open network connections. Forwarders can be configured to automatically distribute themselves across a group or to send to specific nodes (for the regional office case/goal).
Alternatively, as you identify, Splunk can acquire the data over WMI. Similarly this is not restricted in the types of events acquired. The WMI subsystem provided by windows consumes memory proportional to the number of hosts. Because the behavior is typically memory limited, the ram available on the WMI-pollers is an important criteria.
For a rough datapoint, one customer with 16GB WMI-pollers is servicing approximately 120 hosts per WMI-poller. Another customer was able to achieve higher numbers, closer to 300. Because the limiting factors are in a operating system subsystem, we're still learning about the scaling along factors such as data volume, network speed, etc. We've seen cases where the WMI subsystem is a bit brittle when overloaded so it's generally desirable to run it below capacity after testing to determine the capacity in your environment.
Historically, some customers would use Snare to acquire windows event log data and send it to Splunk over syslog. From a splunk perspective, this is a bit more work, and the available data in the events is a bit less, but the point is that other means to transmit windows event log data to Splunk are also viable, should you have other means already in place to accomplish this.
... View more
