All Apps and Add-ons

Splunk App for Windows Infrastructure: How many Splunk forwarders are required to monitor 200 Windows servers?

sonia_splunk
New Member

Hello Everyone,

I have installed app Splunk for Windows Infrastructure.

I am going to set up around 200 Windows servers in Splunk for Infra monitoring.

How many forwarders are required for 200 Windows servers?

Thanks

Sonia

0 Karma
1 Solution

javiergn
Super Champion

Short answer: 200
Install 1 universal forwarder on every host you want to monitor.

You can also monitor Windows servers remotely using WMI or Event Log Forwarding but it won't be as reliable and flexible as having your dedicated UF running locally.

Hope that helps.

Thanks,
J

View solution in original post

0 Karma

javiergn
Super Champion

Short answer: 200
Install 1 universal forwarder on every host you want to monitor.

You can also monitor Windows servers remotely using WMI or Event Log Forwarding but it won't be as reliable and flexible as having your dedicated UF running locally.

Hope that helps.

Thanks,
J

0 Karma

sonia_splunk
New Member

Thanks for your reply J !!!!
How universal forwarder works?
Which port number it uses?
Is this similar to agent in other monitoring tool?
Suppose, If Universal forwarder is stooped working, then will it stop sending data to Indexer?
Thanks
Sonia

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...