Streams targeted packet capture for Windows

[torowa]

Hi Splunkers.

In the Configuring Streams manual, it outlines configuring Splunk_TA_stream to point to an NFS server in the streamfwd stanza on the UF.
i.e.:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

The manual doesn't specifically mention a separate approach for Windows (which wouldn't normally have any NFS support installed).

What's the approach people are taking in mixed Windows/Linux UF invironments?
Is further config needed beyond the stanza above on Windows endpoints to get the captured packets onto the remote fileserver.
For example, does NFS support need to be installed separately on each of the Windows endpoints to be able to use target packet capture on them?

Streams would be deployed via a deployment server, so looking to avoid any manual install/config actions across the fleet.

Thanks.

[torowa · Accepted solution]

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.