Splunk for AD - Disable pop up about Windows TA

[msarro]

Greetings. We are working to install the Splunk for AD app in our distributed deployment. However when we enter the app, we receive the following error in a dialog box:

"This instance of Splunk does not have the Splunk_TA_windows app installed."

This is correct; our search head is running linux, it shouldn't have the Splunk_TA_windows app installed. How can I disable this popup? Or is the TA required even on *nix systems? Because if it is, that contradicts the documentation for the deployment of the TA for the windows app.

[jbernt_splunk · Accepted solution]

Hello,

Yes, the Windows Addon (splunk_ta_windows) is required to be installed, even on *nix search heads, as it adds additional knowledge around searching for Windows-based system data. The Windows addon is also a requirement on the indexing tier, as per the instructions, as it adds additional knowledge at this layer as well.
Hope this helps,
Jeff.

[msarro]

I am aware that the apps are different; I just didn't realize that the AD app overrode the requirements of the Windows app. Thank you for the heads up, I'll give it a shot.

[jbernt_splunk]

Ah, I see the confusion. The Windows Addon has to be on every search head at the very least (regardless of OS). Only on the Windows-based indexers does it need to be installed to send its own Windows log data into Splunk.

[jbernt_splunk]

100%
Splunk App for Windows, is different than the AD app. The AD app requires the Windows Addon (as does the Splunk App for Windows). Both require the Windows addon.

[msarro]

Are you sure? The documentation here: http://docs.splunk.com/Documentation/WindowsApp/latest/User/HowtodeploytheSplunkAppforWindows says the opposite. Hence the confusion.

[mikelanghorst]

just be sure to disable the inputs