topic Re: Windows & linux machines Integration in Splunk Enterprise Security

Windows & linux machines Integration

fedayn05 — Thu, 05 Feb 2026 13:39:36 GMT

Hello Team,

I hope you are doing well , I have just integrated linux and windows logs via Splunk Forwarder.

The question i have is does the logs must come with a specific source type in order to be read by Entreprise security or not. Because i have gone through this with firewall integration , i have set the wrong source type and i got the logs on splunk but it were not read at all by splunk entreprise.

Thank you for your time.

Kind regards,

Re: Windows & linux machines Integration

livehybrid — Thu, 05 Feb 2026 16:04:09 GMT

Hi @fedayn05

Are you using the Splunkbase Add-ons from Splunkbase to onboard the Linux and Windows logs? If so the default sourcetype that this comes with should be sufficient for Enterprise Security - It you stray away from the default sourcetypes then you run the risk of missing field extractions etc that map the data to the Common Information Models used by Splunk ES.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Windows & linux machines Integration

PickleRick — Thu, 05 Feb 2026 21:19:11 GMT

There's more to that than this.

Sourcetype is the main way of telling Splunk what the particular "kind" of event is and what to do with it (including how to parse it into fields).

Additionally ES usually expects most of relevant data to fit the CIM data models (have proper fields defined, sometimes have predefined values in those fields).

So technically you could change the sourcetypes for everything you're ingesting. But in order to be able to effectively use this data with ES you'd need to define all those things that are typically done by add-on creators - parsing, normalizing, tagging.

It's definitely _not_ worth the effort if you already have a working add-on which does that for you.

Re: Windows & linux machines Integration

fedayn05 — Fri, 06 Feb 2026 10:53:33 GMT

Hello,

Thank you for your answer. I actually installed the Splunk add-on for microsoft windows , and windows logs are stored with the WinEventLog sourcetype, so i dont know it this is good enough for Entreprise Security.

For linux , I actually did not install any add-on.

Thank uu

Re: Windows & linux machines Integration

fedayn05 — Fri, 06 Feb 2026 10:55:11 GMT

Hello,

Thank you for your answer. Do you have in mind an add-on for this please

Thank you

Re: Windows & linux machines Integration

PickleRick — Fri, 06 Feb 2026 11:26:25 GMT

For Windows data you have the TA_windows from Splunk. For some linux stuff you have the TA_nix. I think there was a separate addon for auditd. So there's no single add-on which will cover all your needs. You have to search on a per-case basis.