How to get Windows data into your Splunk deployment
You can collect the following Windows data with Splunk software:
Windows data you can collect | Link to supporting documentation |
---|---|
Event Logs | Monitor Windows event log data with |
File system changes | Monitor file system changes on Windows |
Active Directory | Monitor Active Directory |
Data through the Windows Management Instrumentation (WMI) infrastructure | Monitor data through Windows Management Instrumentation (WMI) |
Registry data | Monitor Windows Registry data |
Performance metrics | Monitor Windows performance |
Host information | Monitor Windows host information |
Print information | Monitor Windows printer information |
Network information | Monitor Windows network information |
Because only Windows machines provide these types of data, only the Windows version of the Splunk platform can get the data. Other operating systems cannot collect Windows data directly. You can send Windows data from Windows machines to Splunk platform instances that don't run Windows. If you use Splunk Cloud Platform and want to monitor these inputs, the Splunk universal forwarder is the only option.
How the Splunk platform interacts with Windows modular and scripted inputs on start-up and shutdown
When you configure a scripted or modular Windows data input in the Splunk platform, the splunkd service sends a signal to the input to begin collecting the data. Similarly, when you shut down the Splunk platform cleanly, the service sends a different signal to the inputs to tell them to stop collecting data, clean up, and exit.
The following table shows the signals, or control messages, that the splunkd service sends to modular and scripted Windows inputs during start-up and shutdown.
Process | Signal |
---|---|
Start-up | CreateProcess |
Shut-down | CTRL_BREAK_EVENT |
Use Splunk Web to collect Windows data
Almost all Windows inputs let you use the Splunk Web interface to get data in Splunk Enterprise. The exception is the MonitorNoHandle
input, which you must set up with a configuration file.
Follow these steps to collect Windows data in Splunk Web:
- Log into your Splunk deployment.
- Click Settings > Data inputs.
The Data inputs page appears. - From the list of available inputs, find the Windows input that you want to add from the list of available inputs.
- Click Add new in the Actions column for the input.
- Follow the instructions for the input type you selected.
- Click Save. In most cases, data collection begins immediately.
Use configuration files to collect Windows data
In cases where you can't use Splunk Web to configure Windows inputs, such as on a universal forwarder, you must use configuration files. The universal forwarder installer on Windows lets you configure some Windows inputs at installation time.
Configuration files offer more control over Splunk Web in many cases. Some inputs can only be configured this way.
Follow these steps to use configuration files to collect Windows data:
- Open a command prompt or PowerShell window.
- Change the directory to the %SPLUNK_HOME%\etc\system\local directory on your Splunk platform instance.
- Edit the inputs.conf configuration file in this directory. You might need to create the file if it doesn't already exist.
- Add inputs to the inputs.conf file by defining input stanzas, settings, and values.
- Save the file and close it.
- Restart the Splunk platform instance.
The software reloads the configuration files and begins collecting data based on the new configuration.
Monitor Windows data with the Splunk platform | Considerations for deciding how to monitor remote Windows data |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!