Install the Splunk Add-on for Windows

Where to install the add-on

The Splunk Add-on for Windows can be installed on a search head, an indexer, or a forwarder. It can be installed manually, with the CLI, or with Forwarder Management, depending on the type of Splunk instance you install it into.

When you install it onto a forwarder, you must configure it to collect Windows data and send it to an indexer.

When you install it onto an indexer or search head, you can configure it to collect Windows data from that indexer or search head. Otherwise, you do not need to configure the add-on.

How to install the add-on

To install the add-on into a universal forwarder, you can install it manually with Splunk Web or the CLI, or use Forwarder Management. You cannot install the add-on using the universal forwarder CLI. This is because the CLI cannot install apps because it does not have Python.

To install the add-on into many universal forwarders using the Forward Management interface included with Splunk Enterprise, see "Deploy the Splunk Add-on for Windows with Forwarder Management".

Install the add-on from the command line

On Splunk Enterprise indexers and search heads, you can install the add-on from the command line, using the CLI.

On Splunk universal forwarders, you cannot install the add-on with the CLI. See Install the add-on on a universal forwarder.

1. Download the Splunk Add-on for Windows from Splunkbase.
2. Run the splunk install CLI command:

   > cd \opt\splunk\bin
   > .\splunk install app <path>\splunk-add-on-for-microsoft-windows.tar.gz
   App 'windows' is installed.
   

   Note: You might be required to log into your Splunk Enterprise instance before it installs the app.

3. (Optional) configure the add-on to enable Windows inputs. Note: You do not need to configure the input when you install it on a search head unless you want to collect Windows data from that search head.

Install the add-on with Splunk Web

You can install the add-on with Splunk Web, provided you do so on a full instance of Splunk Enterprise such as a search head or indexer. The most common use case for this method of installation is to provide support for another app that is on the same host.

Splunk Web is available for installations of the Splunk add-on for Windows on full instances of Splunk Enterprise only. It is not available for installations on universal or light forwarders.

1. Download the Splunk Add-on for Windows from Splunkbase. The file downloads with a .tar.gz extension. Do not attempt to run this file.
2. Log into Splunk Web on the Splunk Enterprise instance on which you want to install the app.
3. After you log in, click the App menu from the upper right menu bar, and select Manage apps...
4. On the next page, click the Install app from file button.
5. On the Upload a file screen, click Browse...
6. Locate the downloaded splunk-add-on-for-microsoft-windows.tar.gz file and click Open.
7. Click Upload. Splunk Enterprise opens the splunk-add-on-for-microsoft-windows.tar.gz package and installs the application.
8. Click the Restart Splunk button or the link in the banner to restart Splunk.
9. After Splunk restarts, click OK to return to the Splunk login page.
10. (Optional) configure the add-on to enable Windows inputs.

Install the add-on on a universal forwarder

You cannot use Splunk Web or the CLI to install the add-on on a universal forwarder.

1. Download the Splunk Add-on for Windows from Splunkbase.
2. Unarchive the splunk-add-on-for-microsoft-windows.tar.gz file into %SPLUNK_HOME%\etc\apps with a file archive extraction utility.
3. (Optional) Configure the add on to enable Windows inputs.