Collect Windows metrics and logs with the data collection script in ITSI

Use the data collection script to configure data collection agents on Windows hosts you want to collect metrics and log data from.

The data collection script requires internet access. If you don't have internet access, configure data collection manually. For more information, see these topics:

• Manually collect metrics from a Windows host in ITSI
• Manually collect logs from a Windows host in ITSI

If you haven't seen the requirements yet, see Windows integration requirements for ITSI.

If you're using Splunk Cloud Platform, you need to enter specific information according to your cloud stack when you configure an integration. For more information, see Send data to Splunk Cloud Platform with ITSI data collection agents.

To see which data the Windows integration sends to ITSI, see Windows data you can collect with ITSI.

Prerequisites

Requirement	Description
Windows host	See Windows operating system support.
Dependencies	See Required Windows dependencies.
Administrator role	In Splunk Enterprise, you have to be a user with the admin role. In Splunk Cloud Platform, you have to be a user with the sc_admin role.
Internet access	The data collection script downloads a universal forwarder package from https://www.splunk.com/en_us/download/universal-forwarder.html.

Steps to configure the data collection script for Windows hosts

Follow these steps to configure and use the data collection script to collect Windows metrics and logs in ITSI.

1. Specify configuration options

Configure data collection options for collecting metrics and logs from your host.

1. From the ITSI main menu, go to Configuration > Data Integrations.
2. Click the Windows chicklet.
3. Click Customize to select the metrics and log sources you want to collect data for.
• The cpu and uptime metrics are selected by default, and cannot be deselected.
• If you select cpu > Collect data for each CPU the metrics are stored for each CPU core so that you can split CPU usage by each core in the Analysis Workspace.
• If you select cpu > Collect sum over all CPUs, only aggregate metrics are stored for CPU usage.
• ITSI creates a custom script for you to run on your host system based off of your data selections and customizations.
4. (Optional) Add a custom source.
5. When you're finished selecting metrics and log sources, click Save.
6. Add Dimensions for easier troubleshooting, analysis, and filtering of entities. Dimensions are key/value pairs associated with an entity that you can use for searching and filtering during an investigation. Use the format dimension:value, such as env:prod or region:uswest. You can't delete dimensions the plug-in creates.
7. Enter the Monitoring machine hostname or IP address of the Splunk Enterprise instance you want to send metrics and log data to.
8. Enter the Receiver port of the machine you want to send log data to. You can use any port as receiver port. The recommended port is 9997 if it's available.
9. For Install Location, specify the directory where you want the script to install the universal forwarder on the host.

2. Copy and paste the data collection script in a PowerShell window on the host

Deploy the script on your host to collect metrics and logs.

Follow these steps to deploy the script:

1. Connect to the Windows host.
2. Open a PowerShell window on the host.
3. Paste the script into the PowerShell window on the host and run the script.
4. When you run the script on a Windows system for the first time, you might receive a message stating that the universal forwarder was installed without creating an admin user. If this occurs, you have to manually create admin credentials. For information about creating admin credentials, see user-seed.conf in the Splunk Enterprise Admin Manual.

3. Verify your data connection

Verify your data connection to start monitoring your infrastructure. It can take up to about five minutes for your host to display in the user interface.

In the ITSI user interface, go to Configuration > Entity Management and wait for new hosts to start appearing. Each host has the entity type Windows.