Splunk® App for Windows Infrastructure

Deploy and Use the Splunk App for Windows Infrastructure

Download manual as PDF

This documentation does not apply to the most recent version of MSApp. Click here for the latest version.
Download topic as PDF

How to deploy the Splunk App for Windows Infrastructure

To install the Splunk App for Windows Infrastructure, complete the chapters below in sequence.

What if I know how to install Splunk Enterprise and Splunk apps?

If you already have indexers, search heads, forwarders, and a deployment server set up, then you can skip most of the basic infrastructure setup chapter.

If you have experience installing Splunk Enterprise, then perform the installation methods you are comfortable with. It is still a good idea to review the new procedure to get an understanding of how the components work together.

The process is as follows:

  1. Set up indexer(s) to receive data.
  2. Configure universal forwarders to forward data to the indexers.
  3. Follow the "Get Data In" chapter to get the required data into the indexers.
  4. Follow the "Complete Setup" topics to set up the app on search heads.
  5. Run the guided setup experience to check for data presence and correct any problems.

Where to install components

The table below lists what components to install and where to install them. Installing the components on multiple locations is not required.

Recommended Splunk App for Windows Infrastructure Component Installation Locations
Search Head Indexer Univ. Fwder. Deploy. Serv.
Splunk App for Windows Infrastructure X
Splunk Add-on for Windows1 X X X XW
"Send to indexer" app2 X
Splunk Add-on for MS Active Directory X X X
Splunk Add-on for Windows DNS X X X
Splunk Supporting Add-on for Active Dir. X
  1. You must configure this add-on before you install it.
  2. You only require this app when you use a deployment server and want to control all forwarding configurations from there.
W. Only if this host runs Windows and you want to monitor it with the app.

Set up basic infrastructure

This chapter sets up the basic building blocks for the environment.

  1. Install and configuring a Splunk indexer.
  2. Create the "send to indexer" app. This app configures forwarding on hosts that send data to the indexer.
  3. Set up a deployment server to manage the "send to indexer" and other apps.
  4. Install a universal forwarder on each Windows host and tell them to contact the deployment server for configuration and app downloads.
  5. As each universal forwarder connects, add them to a base "universal forwarder" server class to turn them into deployment clients.

After you complete this chapter, you have the basic framework for a deployment.

Get Data In

The next chapters take you through configuring the apps and add-ons that the Splunk App for Windows Infrastructure needs and deploying them to the right deployment clients. At the end of each chapter, you can confirm that data is present on the indexer by running some sample search commands.

  1. The "Get Windows data" chapter discusses getting Windows data into the indexer. Follow it from beginning to end to install the Splunk Add-on for Windows on every Windows host in the environment.
  2. The "Get Active Directory data" chapter details configuring Active Directory and getting AD data into the indexer. Complete the instructions in this chapter to install the Splunk Add-ons for Active Directory onto Active Directory hosts in the environment.
  3. The "Get Domain Name Services (DNS) data" chapter provides instructions on how to get Windows DNS data into the service. Perform the procedures in this chapter to deploy the Splunk Add-ons for Windows DNS on DNS hosts and get DNS data.

Complete setup

After getting data in and confirming that it is there, complete setup.

  1. Installing the app and some add-ons onto the indexer.

Run the guided setup experience

After you add a license, activate the app.

  1. Log into the indexer and select the app to start the guided setup experience.
  2. Follow the prompts to confirm prerequisites, locate minimum data requirements, and configure aliases. You might need to go to other apps like the Splunk Supporting App for Active Directory to add or change configurations.
  3. The app searches for your data, builds lookups and data models, and enables features and pages.
  4. After it completes, it is ready for you to use! You can head over to the Reference manual to learn about the new pages that come with the app, and how to use all of the pages.
PREVIOUS
What a Splunk App for Windows Infrastructure deployment looks like
  NEXT
Install and configure a Splunk platform indexer

This documentation applies to the following versions of Splunk® App for Windows Infrastructure: 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1


Comments

@Pgadhari,
Splunk Add-on for MS Active Directory can be installed on either the heavy forwarder, indexer, or search head. All locations are supported, but not simultaneously required.

Nicolen splunk, Splunker
February 19, 2019

As per installation component list - can we install "Splunk Add-on for MS Active Directory" in Heavy forwarder instead of Indexers. Or, it has to be installed on both HF and Indexers ? Please clarify ?

Pgadhari
February 13, 2019

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters