TA-SQLServer folder exists in \Splunk_for_SQLServer\appserver\addons so it should be put to deployment-apps or forwarder directly to be deployed and [serverClass:MSSQL:app:TA-SQLServer] will be effective on forwarder then Thanks to Adrian Hall Hello, That is deliberate. Since I don’t know what directory structure you are using, there is some configuration required. The general process for deployment is: 1) Create a local/serverclass.conf with the changes (including whitelist) 2) Copy the TA-SQLServer to deployment-apps 3) Reload the deployment server Unfortunately, we have incomplete documentation right now, and it won’t get improved until the product reaches general availability and graduates out of the incubator. Adrian Hall Practice Manager, Microsoft Solutions Splunk Inc. ... View more