I have a unix machine that is my main interface for splunk.
I would like to index some windows machines.
Why should I install a light forwarder on the windows machine as opposed to installing the windows app on the unix machine?
The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.
On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.
The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.
On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.