Universal Fowarder support Apps

[ngcgoon]

I haven't seen any conclusive documentation on this, however does the Universal forwarder support Apps like the Splunk for windows app? I want to monitor server health, last time you have to install the app on the server and on the indexer. I would be nice to have that app running with the universal forwarder even if it's command line configured else I will use the splunk light forwarder.

[sf-mike]

If you have apps that use python, you can still use them. You'll just have to install python separately.

[araitz]

You will also need to make sure that the path to python is in Splunk's system path and that all the necessary modules (e.g. splunk, splunk.search, splunk.auth) are present.

[dwaddle · Accepted solution]

Universal forwarder can support a large percentage of Splunk Apps - but there will be some that won't work. Some apps may have python scripted inputs that may not work on universal forwarder, because it does not include the python runtime.

I know UF can support Splunk for *nix, and I assume Splunk for Windows works as well (but I'm not sure)

The vaguest (but most accurate) answer is "it depends on the app"