topic Re: Splunk for AD - Disable pop up about Windows TA in All Apps and Add-ons

Splunk for AD - Disable pop up about Windows TA

msarro — Mon, 28 Sep 2020 15:30:32 GMT

Greetings. We are working to install the Splunk for AD app in our distributed deployment. However when we enter the app, we receive the following error in a dialog box:

"This instance of Splunk does not have the Splunk_TA_windows app installed."

This is correct; our search head is running linux, it shouldn't have the Splunk_TA_windows app installed. How can I disable this popup? Or is the TA required even on *nix systems? Because if it is, that contradicts the documentation for the deployment of the TA for the windows app.

Re: Splunk for AD - Disable pop up about Windows TA

jbernt_splunk — Mon, 28 Sep 2020 15:30:37 GMT

Hello,

Yes, the Windows Addon (splunk_ta_windows) is required to be installed, even on *nix search heads, as it adds additional knowledge around searching for Windows-based system data. The Windows addon is also a requirement on the indexing tier, as per the instructions, as it adds additional knowledge at this layer as well.
Hope this helps,
Jeff.

Re: Splunk for AD - Disable pop up about Windows TA

mikelanghorst — Wed, 18 Dec 2013 16:27:52 GMT

just be sure to disable the inputs

Re: Splunk for AD - Disable pop up about Windows TA

msarro — Wed, 18 Dec 2013 16:29:13 GMT

Are you sure? The documentation here: http://docs.splunk.com/Documentation/WindowsApp/latest/User/HowtodeploytheSplunkAppforWindows says the opposite. Hence the confusion.

Re: Splunk for AD - Disable pop up about Windows TA

jbernt_splunk — Wed, 18 Dec 2013 16:32:05 GMT

100%
Splunk App for Windows, is different than the AD app. The AD app requires the Windows Addon (as does the Splunk App for Windows). Both require the Windows addon.

Re: Splunk for AD - Disable pop up about Windows TA

jbernt_splunk — Wed, 18 Dec 2013 16:35:06 GMT

Ah, I see the confusion. The Windows Addon has to be on every search head at the very least (regardless of OS). Only on the Windows-based indexers does it need to be installed to send its own Windows log data into Splunk.

Re: Splunk for AD - Disable pop up about Windows TA

msarro — Wed, 18 Dec 2013 16:46:13 GMT

I am aware that the apps are different; I just didn't realize that the AD app overrode the requirements of the Windows app. Thank you for the heads up, I'll give it a shot.