Download and configure the Splunk Add-on for Windows
This topic discusses downloading and configuring the Splunk Add-on for Windows and deploying it to the deployment clients to gather Windows data and send it to the Splunk App for Windows Infrastructure indexers.
About the Splunk Add-on for Windows
The Splunk Add-on for Windows collects Windows data from Windows hosts. In the context of the Splunk App for Windows Infrastructure, the add-on collects Windows data and provides knowledge objects for the app. You should deploy the Splunk Add-on for Windows to:
- All hosts that run Active Directory Domain Services (including domain controllers and DNS servers).
- All Windows hosts from which you want Windows data.
- All indexers.
- All search heads.
- Basically, everywhere.
If you're using TA-Windows version 6.0.0 or later, you don't need TA_AD and TA_DNS. TA_AD and TA_DNS are merged with TA-Windows version 6.0.0.
Download the Splunk Add-on for Windows
- Download the Splunk Add-on for Windows from Splunkbase and save it to an accessible place on the deployment server. You might need to sign in with your Splunk account before the download starts.
- When prompted, choose an accessible location on your deployment server to save the download. Do not attempt to run the download.
- Use an archive utility such as WinZip to unarchive the file to an accessible location.
Configure the Splunk Add-on for Windows
Before the add-on can collect Windows data, you must configure it.
Microsoft Windows event logs that are rendered in XML format will not populate in the Splunk App for Windows Infrastructure
Splunk_TA_windows
directory.local
.inputs.conf
file in the default
subdirectory to the local
directory.inputs.conf
in the local
subdirectory with a text editor, such as Notepad.- From version 5.0.1 onwards, Splunk Add-on for Windows collects data in multikv mode by default. This mode has a different event format over the existing single mode and the Splunk App for Windows Infrastructure app supports single mode only, so please change the value of mode parameter to single in the perfmon stanzas in
/Splunk_TA_windows/default/inputs.conf
on forwarder.
[perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 0 instances = * interval = 10 mode = single object = Processor useEnglishOnly=true ## Logical Disk [perfmon://LogicalDisk] counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec disabled = 0 instances = * interval = 10 mode = single object = LogicalDisk useEnglishOnly=true ## Physical Disk [perfmon://PhysicalDisk] counters = Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec disabled = 0 instances = * interval = 10 mode = single object = PhysicalDisk useEnglishOnly=true ## Memory [perfmon://Memory] counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s) disabled = 0 interval = 10 mode = single object = Memory useEnglishOnly=true ## Network [perfmon://Network] counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size disabled = 0 instances = * interval = 10 mode = single object = Network Interface useEnglishOnly=true ## Process [perfmon://Process] counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private disabled = 0 instances = * interval = 10 mode = single object = Process useEnglishOnly=true ## ProcessInformation [perfmon://ProcessorInformation] counters = % Processor Time; Processor Frequency disabled = 0 instances = * interval = 10 mode = single object = Processor Information useEnglishOnly=true ## System [perfmon://System] counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec; File Read Bytes/sec; File Write Bytes/sec; File Control Bytes/sec; Context Switches/sec; System Calls/sec; File Data Operations/sec; System Up Time; Processor Queue Length; Processes; Threads; Alignment Fixups/sec; Exception Dispatches/sec; Floating Emulations/sec; % Registry Quota In Use disabled = 0 instances = * interval = 10 mode = single object = System useEnglishOnly=true
Note: If you do not complete the above step, then windows perfmon data will not be considered in dashboards.
- From version 5.0.1 onwards, Splunk Add-on for Windows has removed indexes so you have two options either you can use default windows index as mentioned in below table or you can create your own custom index. For the former one, you have to add index parameter with the values mentioned in below table in /Splunk_TA_windows/default/inputs.conf on forwarder.
Table A
Input Stanza | Indexes | Macro |
---|---|---|
[WinEventLog://Application] , [WinEventLog://Security] , [WinEventLog://System] , [WinEventLog://ForwardedEvents]
|
wineventlog | wineventlog-index |
[monitor://$WINDIR\System32\DHCP] , [monitor://$WINDIR\WindowsUpdate.log] , [script://.\bin\win_listening_ports.bat] , [script://.\bin\win_installed_apps.bat] , [script://.\bin\win_timesync_status.bat] , [script://.\bin\win_timesync_configuration.bat] , [WinHostMon://Computer] , [WinHostMon://Process] , [WinHostMon://Processor] , [WinHostMon://NetworkAdapter] , [WinHostMon://Service] , [WinHostMon://OperatingSystem] , [WinHostMon://Disk] , [WinHostMon://Driver] , [WinHostMon://Roles] , [WinPrintMon://printer] , [WinPrintMon://driver] , [WinPrintMon://port] , [WinNetMon://inbound] , [WinNetMon://outbound]
|
windows | windows-index |
[perfmon://CPU] , [perfmon://LogicalDisk] , [perfmon://PhysicalDisk] , [perfmon://Memory] , [perfmon://Network] , [perfmon://Process] , [perfmon://ProcessorInformation] , [perfmon://System]
|
perfmon | perfmon-index |
[admon://default], [WinRegMon://default], [WinRegMon://hkcu_run], [WinRegMon://hklm_run]
|
windows | windows-index |
[monitor://$WINDIR\debug\netlogon.log], [MonitorNoHandle://$WINDIR\System32\Dns\dns.log], [script://.\bin\runpowershell.cmd nt6-repl-stat.ps1], [powershell://Replication-Stats], [script://.\bin\runpowershell.cmd nt6-health.ps1], [powershell://AD-Health][script://.\bin\runpowershell.cmd nt6-siteinfo.ps1], [powershell://Siteinfo], [script://.\bin\runpowershell.cmd dns-zoneinfo.ps1], [script://.\bin\runpowershell.cmd dns-health.ps1], [admon://default]
|
msad | msad-index |
- Here are the few examples of inputs stanzas. Similarly, you can configure others.
[perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 0 instances = * interval = 10 mode = single object = Processor useEnglishOnly=true index = perfmon [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=false index = wineventlog [WinPrintMon://port] type = port interval = 600 baseline = 1 disabled = 0 index = windows [script://.\bin\runpowershell.cmd nt6-siteinfo.ps1] source=Powershell sourcetype=MSAD:NT6:SiteInfo interval=3600 disabled=0 index = msad
inputs.conf
file in the local
subdirectory.How to change the configuration files to handle custom indexes
Update the following conf files for using custom index(es)
Update inputs.conf
- Copy the inputs.conf file from the default subdirectory
/Splunk_TA_windows/default/
to the local directory folder/Splunk_TA_windows/local/
folder of forwarder. - Open the inputs.conf in the local subdirectory with a text editor, such as Notepad.
- If you are using
<<CUSTOM INDEX>>
instead of TA_windows default indexes then addindex = <<CUSTOM INDEX>>
under stanzas as defined in the table (Table A) for TA_windows default index(es). Refer to the above table (Table A) for TA_windows default indexes.
Here are the few examples of inputs stanzas. Similarly, you can configure others.
[perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 1 instances = * interval = 10 mode = single object = Processor useEnglishOnly=true index = <<CUSTOM INDEX>> [WinEventLog://Application] disabled = 1 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=false index = <<CUSTOM INDEX>> [WinPrintMon://port] type = port interval = 600 baseline = 1 disabled = 1 index = <<CUSTOM INDEX>>
Update macros.conf
- Copy the macros.conf file from the default subdirectory
/splunk_app_windows_infrastructure/default/
to the local directory folder/splunk_app_windows_infrastructure/local/
folder on search head. - Open the macros.conf in the local subdirectory with a text editor, such as Notepad.
- If you are using
<<CUSTOM INDEX>>
instead of TA_windows default indexes then update the following macro definitions as shown below.
Default Index | Custom Index | Updated Macro |
---|---|---|
perfmon | <<CUSTOM INDEX 1>> | [perfmon-index] , definition = index=perfmon OR index=<<CUSTOM INDEX 1>>
|
wineventlog | <<CUSTOM INDEX 2>> | [wineventlog-index] , definition = index=wineventlog OR index=<<CUSTOM INDEX 2>>
|
windows | <<CUSTOM INDEX 3>> | [windows-index] , definition = index=windows OR index=<<CUSTOM INDEX 3>>
|
Note: If no custom index or default TA_windows indexes are defined then all data will be stored in main index.
Update the following conf files for using main index
Update macros.conf
- Copy the macros.conf file from the default subdirectory
/splunk_app_windows_infrastructure/default/
to the local directory folder/splunk_app_windows_infrastructure/local/
folder on search head. - Open the macros.conf in the local subdirectory with a text editor, such as Notepad.
- If you are using index=main instead of TA_windows default indexes then update the following macro definitions as shown below.
Default Index | Main Index | Updated Macro |
---|---|---|
perfmon | main | [perfmon-index] , definition = index=perfmon OR index=main
|
wineventlog | main | [wineventlog-index] , definition = index=wineventlog OR index=main
|
windows | main | [windows-index] , definition = index=windows OR index=main
|
Note: If you skip this step, your Splunk platform will not have the index configurations which can result into data loss.
What's next?
You have downloaded and configured the Splunk Add-on for Windows.
Next, you will deploy it to the deployment clients. Once they receive the add-on, they will use the configuration in the "send to indexer" app to send Windows data to the indexer.
Add the universal forwarder to the server class | Deploy the Splunk Add-on for Windows |
This documentation applies to the following versions of Splunk® App for Windows Infrastructure (Legacy): 2.0.3, 2.0.4
Feedback submitted, thanks!