topic Re: Splunk_TA_Windows to be installed on Linux machines in Installation

Splunk_TA_Windows to be installed on Linux machines

amulay26 — Tue, 29 Sep 2020 21:26:57 GMT

I am trying to get the windows events logs on Windows hosts by installing a forwarder and Splunk_TA_windows on windows machines.

Do I need to install the the TA on the indexer which is a Linux host?
Will the linux host be able to collect data?

Any help will be appreciated.

Thank you.

Re: Splunk_TA_Windows to be installed on Linux machines

deepashri_123 — Tue, 29 Sep 2020 21:23:46 GMT

Hey@amulay26,

Yes you need to install Splunk_TA_Windows on your indexer . It doesn't depend on the OS of the indexer.
Refer this link:
http://docs.splunk.com/Documentation/WindowsAddOn/5.0.0/User/Install

Let me know if this helps!!

Re: Splunk_TA_Windows to be installed on Linux machines

kmorris_splunk — Thu, 27 Sep 2018 14:20:55 GMT

@deepashri_123 is correct. I think the docs make it a bit confusing on this. The only reason the indexers would need to be Windows, is if you were also ingesting locally on the indexers as well.

Re: Splunk_TA_Windows to be installed on Linux machines

VatsalJagani — Thu, 27 Sep 2018 14:31:20 GMT

Hello @amulay26,
You need to install TA_Windows on forwarder, indexer and search head all three layer.

Forwarder - You need to configure inputs.conf file for the data collection (
Indexer and Search Head - It is required for different purpose then the data collection. You must require TA_Windows on search head and indexer for the purpose of index time and search field extraction, index creation and lot more. On indexer data collection won't start so that will not be dependent on OS.

http://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Indextimeversussearchtime (Field extraction)