Microsoft Windows TA Add-on: How to segregate desktops from universal forwarders currently on servers?

[Hudond]

Good Afternoon

We are looking at a pilot project to use Splunk to help manage our desktop inventory using the Microsoft_windows_TA add-on and a universal forwarder installed on the desktops.

The only information we will be extracting at this time is the Windows host information: System Name, OS, IP address, and logged-on user.

We are wondering how we can set up the universal forwarders on the desktops so that when they phone home to the deployment server, and we access the forwarder management page under settings (Settings>forwarder Management), we can segregate the desktops from the universal forwarders currently on the servers, if this is possible that is?

Just wondering if there was an easy way to do this so there are not pages and pages of desktops and servers phoning home making it hard to separate the two when accessing the forwarder management page.

We are a small shop therefore no clustering.
Any guidance would be appreciated.

Thank you

[adonio · Accepted solution]

Use a different serverclass for your desktops ...
https://docs.splunk.com/Documentation/Splunk/8.0.3/Updating/Useforwardermanagement
then you can query through | rest or other
there are other ways as well, for example, rename your TA for desktops, as it seems you really need a single piece of data ... deploy thi app using the new separate serverclass only to desktop and find the app in the _internal data

hope it helps