Archive
Highlighted

Splunk_TA_Windows to be installed on Linux machines

Path Finder

I am trying to get the windows events logs on Windows hosts by installing a forwarder and SplunkTAwindows on windows machines.

  1. Do I need to install the the TA on the indexer which is a Linux host?
  2. Will the linux host be able to collect data?

Any help will be appreciated.

Thank you.

Tags (1)
Highlighted

Re: Splunk_TA_Windows to be installed on Linux machines

Motivator

Hey@amulay26,

Yes you need to install SplunkTAWindows on your indexer . It doesn't depend on the OS of the indexer.
Refer this link:
http://docs.splunk.com/Documentation/WindowsAddOn/5.0.0/User/Install

Let me know if this helps!!

Highlighted

Re: Splunk_TA_Windows to be installed on Linux machines

Splunk Employee
Splunk Employee

@deepashri_123 is correct. I think the docs make it a bit confusing on this. The only reason the indexers would need to be Windows, is if you were also ingesting locally on the indexers as well.

0 Karma
Highlighted

Re: Splunk_TA_Windows to be installed on Linux machines

Motivator

Hello @amulay26,
You need to install TA_Windows on forwarder, indexer and search head all three layer.

  • Forwarder - You need to configure inputs.conf file for the data collection (
  • Indexer and Search Head - It is required for different purpose then the data collection. You must require TA_Windows on search head and indexer for the purpose of index time and search field extraction, index creation and lot more. On indexer data collection won't start so that will not be dependent on OS.

http://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Indextimeversussearchtime (Field extraction)

0 Karma