All Apps and Add-ons

Is the Splunk Add-on for Microsoft Windows necessary on a Windows system?


We currently run Splunk Enterprise Version 6.4.2 on Linux.

We are in the process of installing a light forwarder on a Windows system.

While looking at existing configurations we have found different setups, some with the Splunk Add-on for Microsoft Windows and some
without. The question is going forward, what additional functionality would we get from the add-on since the base forwarder
without the add-on provides us access to the Windows logs?


0 Karma

Esteemed Legend

The method of accessing Windows through the logs or WMI is far more error-prone than using the TA. I always use the TA on Windows forwarders.


Hi ritsma,
I always disable windows logs functionalities in the forwarders installation and I deploy Splunk_TA_Windows using a Deployment Server so I can manageconfigurations.


Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...