All Apps and Add-ons

If I plan to install heavy forwarders on Windows servers, do I need to install Splunk App for Windows Infrastructure?

greich
Communicator

Planning to install heavy forwarders on Windows servers. Splunk has multiple data inputs specific to Windows that can be configured.

Is there any benefit to also installing the Splunk App for Windows Infrastructure?

0 Karma

jbernt_splunk
Splunk Employee
Splunk Employee

Do you have a reason to use heavy forwarders on your Windows servers? The Universal Forwarder is normally sufficient. I'd recommend the Splunk Add-on for Windows (also known as ta-windows) for Windows data. Also the only add-ons included in the Windows Infrastructure app are for Domain Controllers and DNS servers specific to Active Directory. Otherwise, the ta-windows is the only add-on that is needed.

nkpiquette
Path Finder

It really depends on your needs honestly. Out of the box there are a few different data sources it can acquire data from that you may find useful. Make sure you look into the inputs.conf and see what data it is polling and decide if that will be useful for you or not.

This can be helpful to get more Windows event log data in: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitorwindowsdata

One thing I recently learned is that you can use the whitelist attribute under the input stanza to specify what event logs you truly care about. This is referenced in the above link.

Hopefully this helps!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...