All Apps and Add-ons

commands to install universal forwarder and Splunk Add-on for Windows in AD domain controller

awesomeguan
New Member

Hi,

We are trying to get AD domain controller log data to Splunk Cloud by installing universal forwarder and Splunk Add-on for Windows in AD domain controllers in ABC.

From the link below, it talks about using GUI interface of Windows.

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/ForwardDataToSplunkCloudFromWindows

However, as our AD DCs are installed only with Windows 2016 Standard Core, there is no GUI available.

After checking below link,

https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/InstallaWindowsuniversalforwarderfro...

it doesn't provide how to install the Splunk Add-on for Windows while installing universal forwarder as mentioned in the GUI guide quoted below.

"Considerations for enabling data inputs in the installer
If you enable data inputs in the Enable Inputs dialog box when installing the universal forwarder, the installer also installs the Splunk Add-on for Windows. It saves the configuration that enables those inputs into the add-on. This configuration includes index definitions."

It would be great if you can provide the cli commands to set up both universal forwarder and Splunk Add-on for Windows in AD domain controller to send logs directly to Splunk Cloud.

Tags (1)
0 Karma

jawaharas
Motivator

Instruction to install Splunk Universal Forwarder via CLI can be referred here-

https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/InstallaWindowsuniversalforwarderfro...

And to install the add-on, you can copy the add-on folder to $SPLUNK_HOME/etc/apps/ directory.

0 Karma

jawaharas
Motivator

@awesomeguan
Can you accept the answer if it's helped you? Thanks.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...