All Apps and Add-ons

Splunk Stream Windows host forwarding data without Winpcap

nathanluke86
Communicator

I am wondering if anyone could shed some light on the following:

I was under the impression that to forward stream data I would need to install Winpcap on Windows forwarders. I followed the steps and install Stream TA on forwarder and data started indexing.

I haven't installed Winpcap. Am I missing something here or would I just get more valuable data if Winpcap is installed.

Thanks

0 Karma
1 Solution

uagrawal_splunk
Splunk Employee
Splunk Employee

No, you don't need to install Winpcap to forward data, it will be forwarded by the stream forwarder. The stream app has its own service which monitors and forward the data.

View solution in original post

uagrawal_splunk
Splunk Employee
Splunk Employee

No, you don't need to install Winpcap to forward data, it will be forwarded by the stream forwarder. The stream app has its own service which monitors and forward the data.

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...