Download and configure the Splunk Add-on for Windows

This topic discusses downloading and configuring the Splunk Add-on for Windows and deploying it to the deployment clients to gather Windows data and send it to the Splunk App for Windows Infrastructure indexers.

About the Splunk Add-on for Windows

The Splunk Add-on for Windows collects Windows data from Windows hosts. In the context of the Splunk App for Windows Infrastructure, the add-on collects Windows data and provides knowledge objects for the app. You should deploy the Splunk Add-on for Windows to:

• All hosts that run Active Directory Domain Services (including domain controllers and DNS servers).
• All Windows hosts from which you want Windows data.
• All indexers.
• All search heads.
• Basically, everywhere.

Download the Splunk Add-on for Windows

1. Download the Splunk Add-on for Windows from Splunkbase and save it to an accessible place on the deployment server. You might need to sign in with your Splunk account before the download starts.
2. When prompted, choose an accessible location on your deployment server to save the download. Do not attempt to run the download.
3. Use an archive utility such as WinZip to unarchive the file to an accessible location.

Configure the Splunk Add-on for Windows

Before the add-on can collect Windows data, you must configure it.

Microsoft Windows event logs that are rendered in XML format will not populate in the Splunk App for Windows Infrastructure

1. In the location where you unarchived the download file, locate the Splunk_TA_Windows directory.
2. Inside this directory, make a subdirectory local.
3. Copy the inputs.conf file in the default subdirectory to the local directory.
4. Open the inputs.conf in the local subdirectory with a text editor, such as Notepad.
5. Edit the disabled and mode attributes. Optionally, as shown below, add an index attribute to use specific indexes.
   • From version 5.0.1 onwards, Splunk Add-on for Windows collects data in multikv mode by default. This mode has a different event format over the existing single mode and the Splunk App for Windows Infrastructure app supports single mode only, so please change the value of mode parameter to single in the perfmon stanzas in /Splunk_TA_Windows/default/inputs.conf on forwarder.

   [perfmon://CPU]
   counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = Processor
   useEnglishOnly=true
   
   ## Logical Disk
   [perfmon://LogicalDisk]
   counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = LogicalDisk
   useEnglishOnly=true
   
   ## Physical Disk
   [perfmon://PhysicalDisk]
   counters = Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = PhysicalDisk
   useEnglishOnly=true
   
   ## Memory
   [perfmon://Memory]
   counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s)
   disabled = 0
   interval = 10
   mode = single
   object = Memory
   useEnglishOnly=true
   
   ## Network
   [perfmon://Network]
   counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size 
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = Network Interface
   useEnglishOnly=true
   
   ## Process
   [perfmon://Process]
   counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = Process
   useEnglishOnly=true
   
   ## ProcessInformation
   [perfmon://ProcessorInformation]
   counters = % Processor Time; Processor Frequency
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = Processor Information
   useEnglishOnly=true
   
   ## System
   [perfmon://System]
   counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec; File Read Bytes/sec; File Write Bytes/sec; File Control Bytes/sec; Context Switches/sec; System Calls/sec; File Data Operations/sec; System Up Time; Processor Queue Length; Processes; Threads; Alignment Fixups/sec; Exception Dispatches/sec; Floating Emulations/sec; % Registry Quota In Use
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = System
   useEnglishOnly=true
   

   Note: If you do not complete the above step, then windows perfmon data will not be considered in dashboards.

   • From version 5.0.1 onwards, Splunk Add-on for Windows has removed indexes so you have two options either you can use default windows index as mentioned in below table or you can create your own custom index. For the former one, you have to add index parameter with the values mentioned in below table in /Splunk_TA_Windows/default/inputs.conf on forwarder.

   Table A

   Input Stanza	Indexes	Macro
   [WinEventLog://Application], [WinEventLog://Security], [WinEventLog://System], [WinEventLog://ForwardedEvents]	wineventlog	wineventlog-index
   [monitor://$WINDIR\System32\DHCP], [monitor://$WINDIR\WindowsUpdate.log], [script://.\bin\win_listening_ports.bat], [script://.\bin\win_installed_apps.bat], [script://.\bin\win_timesync_status.bat], [script://.\bin\win_timesync_configuration.bat], [WinHostMon://Computer], [WinHostMon://Process], [WinHostMon://Processor], [WinHostMon://NetworkAdapter], [WinHostMon://Service], [WinHostMon://OperatingSystem], [WinHostMon://Disk], [WinHostMon://Driver], [WinHostMon://Roles], [WinPrintMon://printer], [WinPrintMon://driver], [WinPrintMon://port], [WinNetMon://inbound], [WinNetMon://outbound]	windows	windows-index
   [perfmon://CPU], [perfmon://LogicalDisk], [perfmon://PhysicalDisk], [perfmon://Memory], [perfmon://Network], [perfmon://Process], [perfmon://ProcessorInformation], [perfmon://System]	perfmon	perfmon-index
   [admon://default], [WinRegMon://default], [WinRegMon://hkcu_run], [WinRegMon://hklm_run]	windows	windows-index

   • Here are the few examples of inputs stanzas. Similarly, you can configure others.

   [perfmon://CPU]
   counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
   disabled = 0
   instances = *
   interval = 10
   mode = single
   object = Processor
   useEnglishOnly=true
   index = perfmon
   
   [WinEventLog://Application]
   disabled = 0
   start_from = oldest
   current_only = 0
   checkpointInterval = 5
   renderXml=false
   index = wineventlog
   
   [WinPrintMon://port]
   type = port
   interval = 600
   baseline = 1
   disabled = 0
   index = windows
   

6. Save the inputs.conf file in the local subdirectory.

How to change the configuration files to handle custom indexes

Update the following conf files for using custom index(es)

Update inputs.conf

1. Copy the inputs.conf file from the default subdirectory /Splunk_TA_Windows/default/ to the local directory folder /Splunk_TA_Windows/local/ folder of forwarder.
2. Open the inputs.conf in the local subdirectory with a text editor, such as Notepad.
3. If you are using <<CUSTOM INDEX>> instead of TA_windows default indexes then add index = <<CUSTOM INDEX>> under stanzas as defined in the table (Table A) for TA_windows default index(es). Refer to the above table (Table A) for TA_windows default indexes.

Here are the few examples of inputs stanzas. Similarly, you can configure others.

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
mode = single
object = Processor
useEnglishOnly=true
index = <<CUSTOM INDEX>>

[WinEventLog://Application]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false
index = <<CUSTOM INDEX>>

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 1
index = <<CUSTOM INDEX>>

Update macros.conf

1. Copy the macros.conf file from the default subdirectory /splunk_app_windows_infrastructure/default/ to the local directory folder /splunk_app_windows_infrastructure/local/ folder on search head.
2. Open the macros.conf in the local subdirectory with a text editor, such as Notepad.
3. If you are using <<CUSTOM INDEX>> instead of TA_windows default indexes then update the following macro definitions as shown below.

Default Index	Custom Index	Updated Macro
perfmon	<<CUSTOM INDEX 1>>	[perfmon-index], definition = index=perfmon OR index=<<CUSTOM INDEX 1>>
wineventlog	<<CUSTOM INDEX 2>>	[wineventlog-index], definition = index=wineventlog OR index=<<CUSTOM INDEX 2>>
windows	<<CUSTOM INDEX 3>>	[windows-index], definition = index=windows OR index=<<CUSTOM INDEX 3>>

Update authorize.conf

1. Copy the authorize.conf file in the default subdirectory /splunk_app_windows_infrastructure/default/ to the local directory folder /splunk_app_windows_infrastructure/local/ on Searchhead.
2. Open the authorize.conf in the local subdirectory with a text editor, such as Notepad.
3. Add those main(default) index(es) in authorize.conf under role_winfra-admin stanza against srchIndexesDefault parameter like shown below.

[role_winfra-admin]
srchIndexesDefault = msad;msexchange;windows;perfmon;wineventlog;<<CUSTOM INDEX 1>>;<<CUSTOM INDEX 2>>;<<CUSTOM INDEX 3>>;

Note: If no custom index or default TA_windows indexes are defined then all data will be stored in main index.

Update the following conf files for using main index

Update macros.conf

1. Copy the macros.conf file from the default subdirectory /splunk_app_windows_infrastructure/default/ to the local directory folder /splunk_app_windows_infrastructure/local/ folder on search head.
2. Open the macros.conf in the local subdirectory with a text editor, such as Notepad.
3. If you are using index=main instead of TA_windows default indexes then update the following macro definitions as shown below.

Default Index	Main Index	Updated Macro
perfmon	main	[perfmon-index], definition = index=perfmon OR index=main
wineventlog	main	[wineventlog-index], definition = index=wineventlog OR index=main
windows	main	[windows-index], definition = index=windows OR index=main

Update authorize.conf

1. Copy the authorize.conf file in the default subdirectory /splunk_app_windows_infrastructure/default/ to the local directory folder /splunk_app_windows_infrastructure/local/ on Searchhead.
2. Open the authorize.conf in the local subdirectory with a text editor, such as Notepad.
3. Add those main(default) index(es) in authorize.conf under role_winfra-admin stanza against srchIndexesDefault parameter like shown below.

[role_winfra-admin]
srchIndexesDefault = msad;msexchange;windows;perfmon;wineventlog;default

Note: If you skip this step, your Splunk platform will not have the index configurations which can result into data loss.

What's next?

You have downloaded and configured the Splunk Add-on for Windows.

Next, you will deploy it to the deployment clients. Once they receive the add-on, they will use the configuration in the "send to indexer" app to send Windows data to the indexer.