Splunk Stream Windows host forwarding data without Winpcap

[nathanluke86]

I am wondering if anyone could shed some light on the following:

I was under the impression that to forward stream data I would need to install Winpcap on Windows forwarders. I followed the steps and install Stream TA on forwarder and data started indexing.

I haven't installed Winpcap. Am I missing something here or would I just get more valuable data if Winpcap is installed.

Thanks

[uagrawal_splunk · Accepted solution]

No, you don't need to install Winpcap to forward data, it will be forwarded by the stream forwarder. The stream app has its own service which monitors and forward the data.