Other deployment considerations

In many scenarios, the Splunk Add-on for Windows installs on a Windows host and collects data from that host. You then use Splunk Web to browse the data that the app collects, or use the Splunk App for Windows Infrastructure or another Splunk app to present the data.

There are additional uses for the add-on:

• You can use the add-on to collect Windows data from a number of Windows hosts by installing a universal forwarder on each host and deploying the app to those forwarders. Once the app is installed on each forwarder, you can then forward the data to a receiving indexer that runs the Splunk App for Windows Infrastructure or another Splunk app.

• You can also install the add-on into a Splunk search head or indexer to provide data inputs and knowledge for other apps installed on the instance, such as Splunk Enterprise Security or Splunk IT Service Intelligence.

Configure the Splunk Add-on for Windows on multiple hosts

To install and configure forwarders on multiple hosts, follow the instructions in "Deploy the Splunk Add-on for Windows with Forwarder Management."