Splunk App for Windows on Linux indexer

[snickered]

I just installed Splunk App for Windows on a Linux indexer. Upon reboot I was presented with

"Splunk has detected that the server operating system is not Windows.  The Splunk for Windows App can be installed on any operating system, but the app inputs can only be configured on Windows operating systems."

I want to be sure I understand this correctly. I'm assuming this just means I can't monitor Windows-specific things like monitor the registry on the local box (the Linux indexer) - obvious.

I want to be sure I can install the Universal Forwarder followed by the Splunk TA for Windows on my Windows boxes, as described here: http://docs.splunk.com/Documentation/WindowsApp/4.5.2/User/Otherdeploymentconsiderations#Configure_t.... After pointing the Windows boxes to my Linux indexer, then edit the TA configuration files to enable the Windows data inputs. Will I get the same dashboards/inputs/etc... on my Linux indexer as I would if my central indexer was Windows? Thanks!

[dshpritz]

This may have been related to a known issue in the Splunk App for Windows app. Checking the Release notes shows:

"The app no longer displays "Unsupported configuration" or other erroneous modal dialogs when you install the full Windows app on a Splunk instance that has the TA installed, or when you install the app on a non-Windows Splunk instance. (SPL-47170)"

Splunk App for Windows Release Notes

Thanks,

Dave

[ITBlogger]

From my experience, it means that you can't use a Linux Indexer to modify configuration of Windows agents to control what data they will grab from their respective hosts and forward to the indexer.

As far as I know, in the scenario of Linux Indexer with Windows Universal Forwarders, the Splunk TA for Windows app needs to be installed on any of the Windows Universal Forwarders to really have any meaningful control over performance monitoring data. I don't think it's necessary to install the Splunk TA for Windows app to pull in event log data to the Indexer.