Install the Splunk Add-on for Windows on universal forwarders

If you have a deployment with many universal forwarders, use the Splunk Enterprise Forwarder Management interface to distribute the add-on to those forwarders.

Download, configure, and install the Splunk Add-on for Windows

Make the Splunk Add-on for Windows available to Forwarder Management:

1. Download the Splunk Add-on for Windows.
2. Unarchive the downloaded file into an accessible location.
3. Remove transforms.conf.spec from the $SPLUNK_HOME/etc/apps/Splunk_TA_windows/README directory.
4. Enable the input stanzas for the Windows data that the add-on should collect.
5. After enabling input stanzas, copy the Splunk Add-on for Windows folder to %SPLUNK_HOME%\etc\deployment-apps on the deployment server. This is the Splunk Enterprise instance that runs Forwarder Management.
6. Restart Splunk Enterprise on the deployment server.
7. Note the host name or IP address and management port of the deployment server. You will use this information to configure deployment clients.

Set up universal forwarders as deployment clients

Set up universal forwarders as deployment clients to the Forwarder Management instance using one of the following methods:.

• Use the CLI to configure the forwarder as a deployment client:

> .\splunk set deploy-poll <IP address/hostname of Forwarder Management server>:<port>

• On the universal forwarder, edit deploymentclient.conf in %SPLUNK_HOME%\etc\system\local and add the following text to the file:

[deployment-client]
[target-broker:deploymentServer]
targetUri= <IP address/hostname of Forwarder Management server>:<port>

After performing either method, restart the forwarder.

Set up server classes on the deployment server

After you configure the Splunk Add-on for Windows and set up the forwarders as deployment clients, define a server class for the forwarders on the deployment server instance.

1. Log in to Splunk Enterprise on the deployment server.
2. From Splunk Home, select Settings > Forwarder Management.
3. Click the Server classes tab.
4. Click New Server Class.
5. In the dialog box, type a name for the server class.
6. Click Save.
7. Click Add Apps.
8. Under Unselected Apps, select Splunk Add-on for WIndows.
9. Click Save.
10. Click Add clients.
11. Specify the clients that should receive the Splunk Add-on for Windows by populating Include (whitelist). You can enter host names, DNS names, IP addresses, or a wild card that represents more than one deployment client. Separate multiple hostnames with commas. Alternately, you can specify clients that should not receive the add-on by entering host names, DNS names, IP addresses or wild cards in Exclude (blacklist) field. Do not specify a host in both fields, as this prevents any host from receiving the add-on.
12. Click Save. Forwarder Management returns you to the Edit Server Class screen, which displays the clients that have received the Splunk Add-on for Windows.