Getting Data In

What splunk stream forwarder is used for windows server?

bobmccoy
Explorer

I understand how to use stream with Linux machines but what forwarder do I use for windows servers?
Are there any documents on this?

0 Karma

p_gurav
Champion

Hi,

Splunk Stream uses the WinPcap driver to capture packets on Windows systems. Due to a flaw in the WinPcap security model, installing Stream on Windows allows all local users to use WinPcap for packet sniffing. Refer below docs:

http://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/InstallSplunkAppforStream#Windo...

https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

0 Karma

bobmccoy
Explorer

yeah that is to unsecured
I found I could do like this and it is working

Once the Splunk App for Stream is installed on a Splunk Search Head, there will be a Splunk_TA_stream directory that’ll be created in $SPLUNK_HOME/etc/apps. Splunk_TA_stream will then need to be copied over to your windows machine under $SPLUNK_HOME\etc\apps (typically C:\Program Files\SplunkUniversalForwarder\etc\apps). From there, you’ll need to create a local directory and inputs.conf file within. Contents of the inputs.conf file should be as follows, just be sure to replace “localhost” with the hostname of the SH where the Stream app exists, and be sure to modify http/https and the port, where appropriate:

[streamfwd://streamfwd]
splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Then, make sure the windows machines has the outputs.conf to send data to Splunk Cloud, and restart the forwarder.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...