Hi,
We are trying to get AD domain controller log data to Splunk Cloud by installing universal forwarder and Splunk Add-on for Windows in AD domain controllers in ABC.
From the link below, it talks about using GUI interface of Windows.
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/ForwardDataToSplunkCloudFromWindows
However, as our AD DCs are installed only with Windows 2016 Standard Core, there is no GUI available.
After checking below link,
https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/InstallaWindowsuniversalforwarderfro...
it doesn't provide how to install the Splunk Add-on for Windows while installing universal forwarder as mentioned in the GUI guide quoted below.
"Considerations for enabling data inputs in the installer
If you enable data inputs in the Enable Inputs dialog box when installing the universal forwarder, the installer also installs the Splunk Add-on for Windows. It saves the configuration that enables those inputs into the add-on. This configuration includes index definitions."
It would be great if you can provide the cli commands to set up both universal forwarder and Splunk Add-on for Windows in AD domain controller to send logs directly to Splunk Cloud.
