Getting Data In

Is Splunk Windows TA needed to forward Windows Event Logs?

morethanyell
Builder

Hi,

Is the entire "Splunk Add-on for Microsoft Windows" needed to be pushed to forwarders in order to enable forwarding of WinEventLogs?

While in Linux, I'm sure that the "Splunk Add-on for Unix and Linux" is needed because all inputs are scripted and the scripts come with the TA, I am not sure about Windows.

Would it be possible to just push a app that houses a simplistic `inputs.conf` that enables forwarding of selected/whitelisted EventCodes? Or does the `inputs.conf` need to come with the entire Splunk Windows TA?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

no it isn't needed but very advisable because there's no reason to invent hot water every time: in any case you can disable the inputs that don't interest you.

Anyway, there are many scripted inputs also in Windows_TA!

Then Windows_TA gives you the correct parsing of all events, infact it's usually installed also on Indexers and Search Heads even if they are Linux servers because it contains all the parsing configurations.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

no it isn't needed but very advisable because there's no reason to invent hot water every time: in any case you can disable the inputs that don't interest you.

Anyway, there are many scripted inputs also in Windows_TA!

Then Windows_TA gives you the correct parsing of all events, infact it's usually installed also on Indexers and Search Heads even if they are Linux servers because it contains all the parsing configurations.

Ciao.

Giuseppe

0 Karma

morethanyell
Builder

Thank you. Pushing into a UF tho. So, parsing is not mind. Also, the TA is the index cluster of SplunkCloud where we index the events, so it's gonna be taken care of there, I believe.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

as I said there are two level of use of TA_Windows:

  • to ingest logs on Forwarders,
  • to parse the logs on Indexers and Search Heads,

it's possible to upload TAs also on Splunk Cloud.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...