Splunk® IT Service Intelligence

Entity Integrations Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

About the Windows entity integration in ITSI

There are two ways you can collect Windows data in (ITSI). You can either use the data collection script or you can configure data collection agents manually. For information about data you can collect with this integration, see Windows data you can collect with ITSI. Before you start collecting Windows data, make sure you satisfy the Windows integration requirements. For more information, see Windows integration requirements for ITSI.

Collect Windows metrics and logs with the data collection script in ITSI

The data collection script in ITSI collects both Windows metrics and logs data. To use the data collection script you have to have internet access. The data collection script downloads a universal forwarder. If you don't have internet access, configure data collection manually. For more information, see Collect Windows metrics and logs with the data collection script in ITSI.

Manually collect logs and metrics from a Windows host in ITSI

You can manually set up a universal forwarder to collect metrics from a Windows host. Manually configure metrics collection for a host when you meet at least one of these conditions:

  • You're collecting data from a host on a closed network with no internet access.
  • You already installed a universal forwarder on the host.
  • You don't have trusted URLs you can download the required packages from.

If you also want to manually collect log data from a Windows host, see Manually collect logs from a Windows host in ITSI.


If you have problems setting up the Windows entity integration, see Troubleshoot the Windows entity integration in ITSI.

Last modified on 28 April, 2023
Troubleshoot the Unix and Linux entity integration in ITSI
Windows integration requirements for ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters