What does the Splunk Add-on for Windows do that the Universal Forwarder alone does not?

[bbeavise2g]

I'm pretty new to Splunk and I have been looking into Forwarder Deployment for central administration. My confusion is that some of our systems (pre-forwarder deployment) have the Universal Forwarder installed and the Windows Add-on (apps/Splunk_TA_windows). I also have systems with just the Universal Forwarder. I did some playing with the Add-on config, trying out the perfmon, etc. My assumption was that the Add-on has more functionality that the Universal Forwarder alone. However, I cannot find documentation to show that. Also, I copied the inputs.conf from the Add-on from one system to the inputs.conf file on a system with only the Universal Forwarder. There has been no change in the data. So what does the Add-on do? Event Log, performance data, etc all look identical whether the Add-on is installed or not. I am not referring to the Splunk indexer, which is on Linux. I'm talking about the clients. Do I need to deploy the Splunk_TA_windows app or just a custom app with the necessary conf files? I'm only looking for Windows event logs and a couple of performance stats. Can some one help straighten me out?

[lguinn2]

The Splunk for Windows TA does not have "more functionality" than the UF alone. The TA simply sets up certain inputs for you, and does it in a way that is compatible with the reporting provided by the Splunk for Windows app - which you could install on your indexers/search head. If you aren't going to use the Splunk for Windows app, you don't need the Splunk for Windows TA on the forwarders. You could use it to set the data collection if you want.

But for what you want to do, you could certainly use a custom app with just the necessary conf files. The custom app would probably be easier than installing the TA and then having to disable the parts that you don't care about.

[bbeavise2g]

That helps a lot. Thanks.