Is Splunk Windows TA needed to forward Windows Event Logs?

[morethanyell]

Hi,

Is the entire "Splunk Add-on for Microsoft Windows" needed to be pushed to forwarders in order to enable forwarding of WinEventLogs?

While in Linux, I'm sure that the "Splunk Add-on for Unix and Linux" is needed because all inputs are scripted and the scripts come with the TA, I am not sure about Windows.

Would it be possible to just push a app that houses a simplistic `inputs.conf` that enables forwarding of selected/whitelisted EventCodes? Or does the `inputs.conf` need to come with the entire Splunk Windows TA?

[gcusello · Accepted solution]

Hi @morethanyell,

no it isn't needed but very advisable because there's no reason to invent hot water every time: in any case you can disable the inputs that don't interest you.

Anyway, there are many scripted inputs also in Windows_TA!

Then Windows_TA gives you the correct parsing of all events, infact it's usually installed also on Indexers and Search Heads even if they are Linux servers because it contains all the parsing configurations.

Ciao.

Giuseppe

[morethanyell]

Thank you. Pushing into a UF tho. So, parsing is not mind. Also, the TA is the index cluster of SplunkCloud where we index the events, so it's gonna be taken care of there, I believe.

[gcusello]

Hi @morethanyell,

as I said there are two level of use of TA_Windows:

• to ingest logs on Forwarders,
• to parse the logs on Indexers and Search Heads,

it's possible to upload TAs also on Splunk Cloud.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉