topic Re: Windows TA deployment indexer/forwarder in Getting Data In

Windows TA deployment indexer/forwarder

sonicZ — Fri, 29 Mar 2013 18:42:43 GMT

Basically i am trying this deployment

windows hosts: Installed the Windows TA app/configured inputs.conf with proper perfmon inputs etc.

Search head: Installed Windows app, should be able to see windows TA data, since TA app and windows app are not supported on the same instance of Splunk?

indexer: Nothing installed.

After reading the docs they say the windows TA app can be installed on indexers but does it need to be in order for the windows TA forwarded data to properly index?
http://docs.splunk.com/Documentation/WindowsApp/latest/User/InstalltheSplunkTechnologyAdd-onforWindows

Re: Windows TA deployment indexer/forwarder

jcoates_splunk — Fri, 29 Mar 2013 19:42:17 GMT

Hi,

Yes, that needs to go on your indexers.

jcoates-mba:apps jcoates$ grep index Splunk_TA_windows/README.txt 
Has index-time operations: true, this technology add-on must be placed on indexers

Re: Windows TA deployment indexer/forwarder

crosset2 — Mon, 01 Apr 2013 17:35:16 GMT

Thanks Jcoates, I installed the app on all 8 of our production indexers in the $SPLUNK_HOME\etc\apps directory
bounced them last week, but still no windows related events from the host with the TA app.
I am submitting a case on this..