Splunk Search

supported platforms

New Member


is the Windows App supported on Splunk installed on Linux ? When I go for example to section Windows -> Event Log Collections I get a message "In handler 'win-event-log-collections': Admin handler 'win-event-log-collections' not found.". There is no link to create a new "source".



0 Karma

Splunk Employee
Splunk Employee

The Windows app will partially work:

  • The reports and queries and searches my be run on a Linux search head or Linux indexer, and will display results correctly, provided the data is in the queried index.
  • The Windows-specific data inputs (WinEventLog, WMI, Registry) will not run on Linux. The inputs must be run on a Windows machine to collect the data. This data may be forwarded to an indexer that runs on any platform (and reported on from any platform.)

In your case, it appears you are trying to configure inputs on a Linux machine, so this won't work.

Splunk Employee
Splunk Employee

Hi there,

the Splunk for Windows App will not work on a Linux machine.

Reason is that Splunk is using the Windows Event Manager interface to collect Windows data, like WMI and Event logs.

Linux does not have this feature.

See folowing documentation:


Hope that helps?



0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...