Looking for a concrete, production-ready setup. I'm in RevOps and need to get Windows security events from multiple domains into Splunk for compliance dashboards. Cribl seems like the right buffer/transform layer.
Can someone verify this path? Specifically:
* Source: Windows Event Forwarding (WEF) servers sending to a Cribl TCP/UDP listener.
* Cribl needs to handle the proprietary Microsoft format. Are there any built-in Windows Event pre-processing pipelines, or do you have to build a custom parser?
* Destination: Splunk HEC. Any gotchas with metadata (index, source, sourcetype) when the data passes through Cribl?
Main concerns:
- Event loss during peak bursts.
- Needing to add fields (like domain tag) before Splunk.
- Is the Cribl Windows Agent stable for local collection, or is the network listener approach better?
null