How to get Windows data into your Splunk deployment

You can collect the following Windows data with Splunk software:

Windows data you can collect	Link to supporting documentation
Event Logs	Monitor Windows event log data with
File system changes	Monitor file system changes on Windows
Active Directory	Monitor Active Directory
Data through the Windows Management Instrumentation (WMI) infrastructure	Monitor data through Windows Management Instrumentation (WMI)
Registry data	Monitor Windows Registry data
Performance metrics	Monitor Windows performance
Host information	Monitor Windows host information
Print information	Monitor Windows printer information
Network information	Monitor Windows network information

Because only Windows machines provide these types of data, only the Windows version of the Splunk platform can get the data. Other operating systems cannot collect Windows data directly. You can send Windows data from Windows machines to Splunk platform instances that don't run Windows. If you use Splunk Cloud Platform and want to monitor these inputs, the Splunk universal forwarder is the only option.

How the Splunk platform interacts with Windows modular and scripted inputs on start-up and shutdown

When you configure a scripted or modular Windows data input in the Splunk platform, the splunkd service sends a signal to the input to begin collecting the data. Similarly, when you shut down the Splunk platform cleanly, the service sends a different signal to the inputs to tell them to stop collecting data, clean up, and exit.

The following table shows the signals, or control messages, that the splunkd service sends to modular and scripted Windows inputs during start-up and shutdown.

Process	Signal
Start-up	CreateProcess
Shut-down	CTRL_BREAK_EVENT

Use Splunk Web to collect Windows data

Almost all Windows inputs let you use the Splunk Web interface to get data in Splunk Enterprise. The exception is the MonitorNoHandle input, which you must set up with a configuration file.

Follow these steps to collect Windows data in Splunk Web:

1. Log into your Splunk deployment.
2. Click Settings > Data inputs.
   The Data inputs page appears.
3. From the list of available inputs, find the Windows input that you want to add from the list of available inputs.
4. Click Add new in the Actions column for the input.
5. Follow the instructions for the input type you selected.
6. Click Save. In most cases, data collection begins immediately.

Use configuration files to collect Windows data

In cases where you can't use Splunk Web to configure Windows inputs, such as on a universal forwarder, you must use configuration files. The universal forwarder installer on Windows lets you configure some Windows inputs at installation time.

Configuration files offer more control over Splunk Web in many cases. Some inputs can only be configured this way.

Follow these steps to use configuration files to collect Windows data:

1. Open a command prompt or PowerShell window.
2. Change the directory to the %SPLUNK_HOME%\etc\system\local directory on your Splunk platform instance.
3. Edit the inputs.conf configuration file in this directory. You might need to create the file if it doesn't already exist.
4. Add inputs to the inputs.conf file by defining input stanzas, settings, and values.
5. Save the file and close it.
6. Restart the Splunk platform instance.
   The software reloads the configuration files and begins collecting data based on the new configuration.