Getting Data In

Is Splunk Windows TA needed to forward Windows Event Logs?

morethanyell
Builder

Hi,

Is the entire "Splunk Add-on for Microsoft Windows" needed to be pushed to forwarders in order to enable forwarding of WinEventLogs?

While in Linux, I'm sure that the "Splunk Add-on for Unix and Linux" is needed because all inputs are scripted and the scripts come with the TA, I am not sure about Windows.

Would it be possible to just push a app that houses a simplistic `inputs.conf` that enables forwarding of selected/whitelisted EventCodes? Or does the `inputs.conf` need to come with the entire Splunk Windows TA?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

no it isn't needed but very advisable because there's no reason to invent hot water every time: in any case you can disable the inputs that don't interest you.

Anyway, there are many scripted inputs also in Windows_TA!

Then Windows_TA gives you the correct parsing of all events, infact it's usually installed also on Indexers and Search Heads even if they are Linux servers because it contains all the parsing configurations.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

no it isn't needed but very advisable because there's no reason to invent hot water every time: in any case you can disable the inputs that don't interest you.

Anyway, there are many scripted inputs also in Windows_TA!

Then Windows_TA gives you the correct parsing of all events, infact it's usually installed also on Indexers and Search Heads even if they are Linux servers because it contains all the parsing configurations.

Ciao.

Giuseppe

0 Karma

morethanyell
Builder

Thank you. Pushing into a UF tho. So, parsing is not mind. Also, the TA is the index cluster of SplunkCloud where we index the events, so it's gonna be taken care of there, I believe.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @morethanyell,

as I said there are two level of use of TA_Windows:

  • to ingest logs on Forwarders,
  • to parse the logs on Indexers and Search Heads,

it's possible to upload TAs also on Splunk Cloud.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...