Getting Data In

How to get Windows data into Splunk Enterprise

Splunk Enterprise lets you collect many different kinds of Windows data.

When you download and install Splunk Enterprise on a Windows machine, you can collect the following Windows statistics:

• Windows Event Logs
• File system changes
• Active Directory
• Data over the Windows Management Instrumentation (WMI) Instrumentation
• Registry data
• Performance metrics
• Host information
• Print information
• Network information

You can collect all of these types of data only on Windows machines. Other operating systems cannot collect Windows data locally. You can forward Windows data from Windows systems to Splunk Enterprise instances that run on systems other than Windows.

Use Splunk Web to collect Windows data

Nearly all Windows inputs let you collect Windows data by using the Splunk Web interface. The exception is the MonitorNoHandle input, which you must set up by using a configuration file.

1. Log into your Splunk Enterprise instance.

2. Click Settings in the upper right corner, then click Data inputs. The Data inputs page appears.

3. Find the input that you want to add in the list of available inputs by clicking Add new in the Actions column for the input.

4. Follow the instructions in the subsequent pages for the input type you select.

See the pages above for specific instructions.

5. Click Save.

Splunk Enterprise begins collecting the data immediately in most cases.

Use configuration files to collect Windows data

In cases where you cannot use Splunk Web to create and enable data inputs, such as when you use a Splunk universal forwarder to collect the data, you must use configuration files. Using configuration files offers more control and configurability than Splunk Web does in many cases. Some inputs can only be configured using configuration files.

Note: The universal forwarder installer on Windows offers the ability to configure some of the Windows inputs at installation time.

1. From a command prompt or PowerShell window, go to the %SPLUNK_HOME%\etc\system\default directory.

2. Make a copy of inputs.conf in this directory and move it to the %SPLUNK_HOME%\etc\system\local directory.

Note: You need to perform this step only once, or if you want to overwrite inputs.conf in the local directory.

3. Use Notepad or another editor to open the inputs.conf file in the local directory for editing.

4. Add your inputs to the inputs.conf file by defining stanzas, or change existing stanzas to meet your needs.

5. Save the file and close it.

6. Restart Splunk Enterprise. The software reloads the configuration files and begins collecting data based on the new configuration.