Splunk Search

supported platforms

New Member


is the Windows App supported on Splunk installed on Linux ? When I go for example to section Windows -> Event Log Collections I get a message "In handler 'win-event-log-collections': Admin handler 'win-event-log-collections' not found.". There is no link to create a new "source".



0 Karma

Splunk Employee
Splunk Employee

The Windows app will partially work:

  • The reports and queries and searches my be run on a Linux search head or Linux indexer, and will display results correctly, provided the data is in the queried index.
  • The Windows-specific data inputs (WinEventLog, WMI, Registry) will not run on Linux. The inputs must be run on a Windows machine to collect the data. This data may be forwarded to an indexer that runs on any platform (and reported on from any platform.)

In your case, it appears you are trying to configure inputs on a Linux machine, so this won't work.

Splunk Employee
Splunk Employee

Hi there,

the Splunk for Windows App will not work on a Linux machine.

Reason is that Splunk is using the Windows Event Manager interface to collect Windows data, like WMI and Event logs.

Linux does not have this feature.

See folowing documentation:


Hope that helps?



0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...