Splunk Enterprise

What is the process to downgrade Splunk_TA_windows from 5.x to 4.x

DomenicTroilo
New Member

Before we looked at the long term usage, we installed the Splunk_TA_windows from 5.01. Now of course we are looking to do Active Directory, DNS and utilize the Splunk App for Windows Infrastructure. As it is well documented the apps require the Splunk_TA_windows version 4.x has anyone downgraded this TA? Any procedures you may have would be wonderful,

Tags (1)
0 Karma

DomenicTroilo
New Member

Based off this link: https://docs.splunk.com/Documentation/MSApp/1.5.1/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

it notes the following:

From version 5.0.1 onwards, Splunk Add-on for Windows collects data in multikv mode by default. This mode has a different event format over the existing single mode and the Splunk App for Windows Infrastructure app supports single mode only, so please change the value of mode parameter to single in the perfmon stanzas in /Splunk_TA_Windows/default/inputs.conf on forwarder.

This is contrary to the splunkbase note of "Splunk App for Windows Infrastructure" which states:

Note: The Splunk App for Windows Infrastructure is not compatible with The Splunk Add-on for Windows 5.0.0.

So I will be able to use the Spluk_TA_windows 5.0.1 if I change the mode noted above?

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...