I had to make a couple of changes to the .\TA-windnsanalytical\bin\get_dns_analytics.path file to get everything working. $SPLUNK_HOME is not set on the deployment clients, so need to specify full path to SplunkUniversalForwarder The Download tarball expands to TA-windnsanalytical not TA-WindowsDNSAnalytical Original get_dns_analytics.path file: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& '$SPLUNK_HOME\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'" Working get_dns_analytics.path file: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-windnsanalytical\bin\get_dns_analytics.ps1'" ... View more

I had to make a couple of changes to the .\TS-windnsanalytical\bin\get_dns_analytics.path file to get everything to work: $SPLUNK_HOME is not set on the deployment client, so need to explicitly add the full path to SplunkUniversalForwarder. Also, the Download tarball expands to TA-windnsanalytical not TA-WindowsDNSAnalytical Original get_dns_analytics.path file: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& '$SPLUNK_HOME\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'" Working get_dns_analytics.path file: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-windnsanalytical\bin\get_dns_analytics.ps1'" ... View more