If you can't install the Splunk forwarder on the Windows boxes, can you: set up a Windows box and install a Splunk Forwarder on it, and then configure that Splunk forwarder to do remote event log collection or WMI? Only a Windows machine can collect event logs or WMI. This is not considered the best practice, but it will work. And, over time, perhaps you can install the Splunk Universal Forwarder on the various Windows boxes. ... View more

An updated link that furthers @ayn's point: What are the best practices for installing Splunk on Windows endpoints? ... View more