supported platforms

New Member


is the Windows App supported on Splunk installed on Linux ? When I go for example to section Windows -> Event Log Collections I get a message "In handler 'win-event-log-collections': Admin handler 'win-event-log-collections' not found.". There is no link to create a new "source".



0 Karma

Splunk Employee
Splunk Employee

The Windows app will partially work:

  • The reports and queries and searches my be run on a Linux search head or Linux indexer, and will display results correctly, provided the data is in the queried index.
  • The Windows-specific data inputs (WinEventLog, WMI, Registry) will not run on Linux. The inputs must be run on a Windows machine to collect the data. This data may be forwarded to an indexer that runs on any platform (and reported on from any platform.)

In your case, it appears you are trying to configure inputs on a Linux machine, so this won't work.

Splunk Employee
Splunk Employee

Hi there,

the Splunk for Windows App will not work on a Linux machine.

Reason is that Splunk is using the Windows Event Manager interface to collect Windows data, like WMI and Event logs.

Linux does not have this feature.

See folowing documentation:

Hope that helps?



0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!