Splunk® Add-on for Windows

Deploy and Use the Splunk Add-on for Windows

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Add-on for Windows. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Source types for the Splunk Add-on for Windows

The Splunk Add-on for Windows provides Common Information Model mappings, the index-time and search-time knowledge for Windows events, metadata, user and group information, collaboration data, and tasks in the following formats.

Source type Description CIM data model(s)
ActiveDirectory Active Directory related information n/a
DhcpSrvLog Microsoft DHCP Server Log information Network Sessions
Perfmon:CPU
PerfmonMk:CPU
CPU usage statistics provided by the Performance Monitor input Application State, Performance
Perfmon:LogicalDisk
PerfmonMk:LogicalDisk
Information about logical disks on the system provided by the Performance Monitor input in single or multikv mode. Performance
Perfmon:Memory
PerfmonMk:Memory
Memory statistics provided by the Performance Monitor input in single or multikv mode Performance
Perfmon:Network
PerfmonMk:Network
Network statistics provided by the Performance Monitor input in single or multikv mode Performance
Perfmon:PhysicalDisk
PerfmonMk:PhysicalDisk
Information about physical disks on the system provided by the Performance Monitor input in single or multikv mode n/a
Perfmon:Process
PerfmonMk:Process
Information about process running on the system provided by the Performance Monitor input in single or multikv mode Application State, Performance
Perfmon:ProcessorInformation
PerfmonMk:ProcessorInformation
Statistics related to processor state and performance Application State, Inventory, Performance, Vulnerabilities
Perfmon:System
PerfmonMk:System
System Information provided by the Performance Monitor input in single or multikv mode Application State, Performance
Script:InstalledApps List of installed applications n/a
Script:ListeningPorts List of network ports that listen for traffic Application State
Script:NetworkConfiguration To get local IP configurations n/a
Script:TimesyncConfiguration Information on time synchronization service configuration. n/a
Script:TimesyncStatus Information on time synchronization status. Performance
WindowsUpdateLog Windows Update log file Updates
WinEventLog
XmlWinEventLog
Windows Event Log data for Application, System and Security provided by WinEventLog in XML or standard format. Application State, Authentication, Change Analysis, Performance, Updates, Vulnerabilities
WinHostMon Windows host monitoring log Inventory, Performance
WinNetMon Network related information n/a
WinPrintMon Windows Printer related changes n/a
WinRegistry Windows Registry changes Change Analysis
WMI:ComputerSystem Computer system information provided by WMI Performance
WMI:CPUTime CPU usage time provided by WMI Application State, Performance
WMI:FreeDiskSpace Free Disk Space provided by WMI Application State, Performance
WMI:InstalledUpdates List of installed updates/packages provided by WMI Updates
WMI:LocalNetwork Network statistics provided by WMI Performance
WMI:LocalPhysicalDisk Physical Disk information provided by WMI n/a
WMI:LogicalDisk Information about logical disks on the system, provided by WMI Performance
WMI:LocalProcesses Information on processes running locally, provided by WMI Application State
WMI:Memory Memory information provided by WMI Application State, Performance
WMI:ScheduledJobs Information on Scheduled Jobs provided by WMI n/a
WMI:Service Information on services running locally, provided by WMI Application State
WMI:Uptime Information on system uptime, provided by WMI Application State, Performance
WMI:UserAccounts Information on configured user accounts, provided by WMI Application State, Inventory
WMI:Version Information on the system version, provided by WMI Application State, Inventory
WMI:WinEventLog:* Windows Event Log data for Application, System and Security - WMI Application State, Authentication, Change Analysis, Performance, Updates, Vulnerabilities

In versions 5.0.0 and later of the Splunk add-on for Windows, the source type WinEventLog is subdivided into WinEventLog for Classic channels, and XmlWinEventLog for XML channels. See Source and sourcetype changes for WinEventLog data.

Source types for backward compatibility

The Splunk Add-on for Windows includes the following source types for backward compatibility.

Sourcetype Description CIM data model(s)
fs_notification File system notification changes. Included for backward compatibility. Change Analysis
Perfmon:CPUTime CPU usage statistics provided by the Performance Monitor input in single or multikv mode. Included for backward compatibility. Performance
Perfmon:FreeDiskSpace Free Disk Space statistics provided by the Performance Monitor input. Included for backward compatibility. Performance
Perfmon:LocalNetwork Free Disk Space statistics provided by the Performance Monitor input. Included for backward compatibility. Performance
Last modified on 21 September, 2018
PREVIOUS
Splunk Add-on for Windows
  NEXT
Release notes for the Splunk Add-on for Windows

This documentation applies to the following versions of Splunk® Add-on for Windows: 5.0.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters