Thanks for your response. My question is entirely accurate though.
The Windows TA IS built in to at least version 6.0-182611 of the Splunk Forwarder for Windows. Try installing the forwarder manually on a Windows machine that has not had the TA installed.
The Universal Forwarder - InstallShield Wizard asks you to select a Splunk Technology Add-on for Windows installation. You get 2 choices,
Install the Splunk Technology Add-on for Windows included with this installer (Recommended) ver 4.6.4-182495
Install an existing local copy of the Splunk Technology Add-on for Windows.
... View more
When you manually run the Windows Universal Forwarder .msi installer on a windows workstation, part of the setup process asks you to install the Technology Add-On for windows, (built in to the forwarder installer,) at the same time. After the manual install completes the forwarder starts sending windows event log data to the indexer specified during the install process. When I try to push the installer using command line options the TA does not get installed and there is no option in the documentation that I can find to get it to install. This causes the forwarder to check in with the indexer as specified on the command line but not start sending windows event log data as also specified on the install command line.
Is there a way to have the universal forwarder install also install the TA like it does when you manually run the installer or do I have push the TA as a separate process?
... View more