Getting Data In

How to get logs from a Windows machine without installing a forwarder?

mmensch
Path Finder

Hi,

I understand that best practice is to install a universal forwarder on a server and send the logs directly to an indexer. However, if I have a circumstance that I cannot install the forwarder on a Windows machine, what would be my options on how to get logs into Splunk?

I've heard of something built into Windows such as WinEventLog forwarding, but I can't seem to find much documentation on it.

Thanks.

0 Karma
1 Solution

spayneort
Contributor

You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.

Event Forwarding info:

Splunk blog post
http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Microsoft blog post and presentation
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forward...

The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding.

View solution in original post

spayneort
Contributor

You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.

Event Forwarding info:

Splunk blog post
http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Microsoft blog post and presentation
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forward...

The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...