What splunk stream forwarder is used for windows server?

[bobmccoy]

I understand how to use stream with Linux machines but what forwarder do I use for windows servers?
Are there any documents on this?

[p_gurav]

Hi,

Splunk Stream uses the WinPcap driver to capture packets on Windows systems. Due to a flaw in the WinPcap security model, installing Stream on Windows allows all local users to use WinPcap for packet sniffing. Refer below docs:

http://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/InstallSplunkAppforStream#Windo...

https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

[bobmccoy]

yeah that is to unsecured
I found I could do like this and it is working

Once the Splunk App for Stream is installed on a Splunk Search Head, there will be a Splunk_TA_stream directory that’ll be created in $SPLUNK_HOME/etc/apps. Splunk_TA_stream will then need to be copied over to your windows machine under $SPLUNK_HOME\etc\apps (typically C:\Program Files\SplunkUniversalForwarder\etc\apps). From there, you’ll need to create a local directory and inputs.conf file within. Contents of the inputs.conf file should be as follows, just be sure to replace “localhost” with the hostname of the SH where the Stream app exists, and be sure to modify http/https and the port, where appropriate:

[streamfwd://streamfwd]
splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Then, make sure the windows machines has the outputs.conf to send data to Splunk Cloud, and restart the forwarder.