Those using the configuration file approach can copy and paste the configuration template from below into the appropriate nf file such as Splunk_TA_windows-mine/local/nf. Those using Splunk Web can use the instructions already available in the documentation Use Splunk Web to configure event log monitoring. You'll create the following simplified configuration regardless of your implementation method. If you're unfamiliar with the add-on, see our related post Is it a best practice to use the Splunk Add-on for Microsoft Windows?
#Splunk for windows 10 windows
Alternatively, those interested in Deploying and Using the Splunk Add-on for Windows may prefer to Use nf to configure event log monitoring. An excellent way to implement this is to Use Splunk Web to configure event log monitoring. Use WinEventLog data inputs to collect all Windows Event Logs. To filter noisy and low value event logs, we'll focus specifically on the Security, Application, and System channels with some specific blacklist filters. But before you turn on the flood gates to collect all Window events, recognize there are hundreds of different event codes and such an approach can prove too noisy to be effective. The Monitor Windows event log data documentation explains why Windows Event Log data is a critical provider of security-relevant data. This topic provides the relevant knowledge to understand the Splunk configuration details in this post. If you're new to collecting Windows endpoint Event Log data with Splunk, then review Monitor Windows event log data in the Getting Data In Manual. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices. The Splunk Product Best Practices team provided this response.
0 kommentar(er)
