Upgrade the Splunk Add-on for Windows

Version 6.0.0 of the Splunk Add-on for Windows integrates the Splunk Add-on for Microsoft AD version 1.0.0 and the Splunk Add-on for Microsoft DNS version 1.0.1. If you are using these other add-ons, disable the add-ons before upgrading to version 6.0.0 of the Splunk Add-on for Windows.

Upgrade from version 5.0.1 to 6.0.0

If you are using versions of the Splunk Add-on for Windows earlier than version 5.0.1, first upgrade to Windows 5.0.1. See the previous topic, Upgrade the Splunk Add-on for Windows from versions earlier than 5.0.1 to upgrade to version 5.0.1. Then, complete the following steps to upgrade to version 6.0.0.

See the corresponding sections that follow if you are migrating from the Splunk Add-on for Microsoft Active Directory or the Splunk Add-on for Microsoft Windows DNS to the Splunk Add-on for Microsoft Windows 6.0.0.

WindowsUpdate.log changes for Windows 10 and Windows Server 2016

In previous versions of the Splunk Add-on for Windows, users must manually run the Get-WindowsUpdateLog Powershell command at regular intervals to convert ETW traces into a readable WindowsUpdate.log file, as well as manually update the path to index data.

Version 6.0.0 of the Splunk Add-on for Microsoft Windows automates this process:

1. (Only on Windows 10 or Windows Server 2016) Disable the current WindowsUpdateLog input.
2. Copy the following stanza from default/inputs.conf to local/inputs.conf to automatically generate daily WindowsUpdate.log files in $SPLUNK_HOME\var\log\Splunk_TA_windows:

   [powershell://generate_windows_update_logs]
   script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
   schedule = 0 */24 * * *
   disabled = 1
   

3. Copy the following stanza from default/inputs.conf to local/inputs.conf to monitor the generated WindowsUpdate.log in Windows 10 and Server 2016:

   [monitor://$SPLUNK_HOME\var\log\Splunk_TA_windows\WindowsUpdate.log]
   disabled = 1
   sourcetype = WindowsUpdateLog

4. Enable both inputs by setting disabled = 0.

The WindowsUpdate.Log file is generated in $SPLUNK_HOME\var\log\Splunk_TA_windows.

Change WinEventLog collection mode

Previous versions of the Splunk Add-on for Windows collected WinEventLog data collection inputs in Classic mode. By default, version 6.0.0 of the Splunk Add-on for Windows collects all WinEventLog data collection inputs in XML mode.

To continue data collection of WinEventLog data inputs in Classic mode after upgrading to version 6.0.0 of the Splunk Add-on for Windows, follow these steps:

1. Create a local copy of existing [WinEventLog://*] stanzas in local/inputs.conf.
2. For each stanza, add renderXml = false.

Here is an example stanza for the WinEventLog Application inputs stanza to continue collecting data in Classic mode:

[WinEventLog://Application]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml = false

If you want to stop data collection of WinEventLog data inputs in Classic mode and start using XML mode, change the existing WinEventLog stanzas in local/inputs.conf to renderXml = true.

Migrate from the Splunk Add-on for Microsoft Windows Active Directory (AD) version 1.0.0 to the Splunk Add-on for Windows version 6.0.0

Migrate from the Splunk Add-on for Microsoft Windows Active Directory:

Configure Active Directory Inputs

1. Make sure all the inputs of the Splunk Add-on for Microsoft Windows AD are disabled in inputs.conf, admon.conf, and perfmon.conf, since these inputs are also in the Splunk Add-on for Windows version 6.0.0.
2. Disable the Splunk Add-on for Microsoft Windows AD.
3. Move the Splunk_TA_microsoft_ad from $Splunk_Home/etc/apps to $SPLUNK_HOME/etc/disabled-apps.
4. Copy the following input stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf:
   • [WinEventLog://DFS Replication]
   • [WinEventLog://Directory Service]
   • [WinEventLog://File Replication Service]
   • [WinEventLog://Key Management Service]
   • [monitor://$WINDIR\debug\netlogon.log]
   • [script://.\bin\runpowershell.cmd nt6-repl-stat.ps1]
   • [powershell://Replication-Stats]
   • [script://.\bin\runpowershell.cmd nt6-health.ps1]
   • [powershell://AD-Health]
   • [script://.\bin\runpowershell.cmd nt6-siteinfo.ps1]
   • [powershell://Siteinfo]
   • [perfmon://Memory]
   • [perfmon://Processor]
   • [perfmon://Network_Interface]
   • [perfmon://DFS_Replicated_Folders]
   • [perfmon://NTDS]
   • [admon://default]
5. Make sure there are no duplicate stanzas in inputs.conf after migration.
6. Update index configurations as described in Configure Active Directory Indexes.
7. To continue to collect perfmon data in single mode, see Changed default Perfmon data collection mode to multikv from single for AD Perfmon inputs.
8. To continue to collect wineventlog data in classic format, see Changed default WinEventLog data collection mode to XML from classic for AD Inputs.
9. Enable the Active Directory inputs in Splunk_TA_Windows/local/inputs.conf.

Configure Active Directory Indexes

The indexes.conf file in the Splunk Add-on for Microsoft Windows AD 1.0.0 is not in the Splunk Add-on for Windows version 6.0.0, nor is the index=* setting from all stanzas in inputs.conf.

Missing the following steps means your Splunk platform deployment will not have index configurations. This can result in data loss.

1. If you were using indexes.conf or any custom index to store your data in an earlier version of the Splunk Add-on for Microsoft AD 1.0.0, copy or create the msad, wineventlog, perfmon, winevents, and windows stanzas from the indexes.conf and inputs.conf files in your existing Splunk Add-on for Microsoft Windows AD version 1.0.0 in the /Splunk_TA_microsoft_ad/default/ folder to the Splunk Add-on for Windows version v6.0.0 /Splunk_TA_Windows/local/ folder. Update the index configurations for these Active Directory inputs based on your existing configurations. Otherwise, any data collected goes to the default main index.
2. When you forward data from a Windows server using the Splunk Add-on for Windows, the indexer you send events to must also have these indexes present. Install the add-on onto the indexer, and create a new indexes.conf file in the /Splunk_TA_Windows/local/ directory. After creating the indexes, specify these indexes in inputs.conf in the /Splunk_TA_Windows/local/ directory.
3. Make sure there are no duplicate stanzas in indexes.conf.

Changed default Perfmon data collection mode to multikv from single for AD Perfmon inputs

The Splunk Add-on for Windows collects Perfmon data in Multikv mode by default. Multikv data collection has benefits over single mode.

Multikv mode has a different event format than single mode. If you want to use multikv mode, set mode = multikv for all required stanzas:

1. Create a local copy of all the existing [perfmon://*] stanzas in local/inputs.conf.
2. For each stanza add the line mode = multikv .

If you want to collect Perfmon data inputs in single mode event format after migrating to the Splunk Add-on for Windows to 6.0.0, follow these steps:

1. Create a local copy of all the existing AD [perfmon://*] stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf.
2. For each stanza add the line "mode = single".

The following is an example stanza for perfmon Processor inputs stanza to continue collecting Processor related perfmon data in single mode:

[perfmon://Processor]
object = Processor
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
instances = *
interval = 10
disabled = 1
mode = single
useEnglishOnly=true 

Changed default WinEventLog data collection mode to XML from classic for AD Inputs

All WinEventLog data collection inputs in the Splunk Add-on for Windows version 6.0.0 are in XML mode by default.

If you want to continue data collection of WinEventLog data inputs in existing Classic mode after upgrading the Splunk Add-on for Windows to 6.0.0, follow these steps:

1. Create a local copy of all the existing AD [WinEventLog://*] stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf.
2. For each stanza, add the line "renderXml = false"

Here is an example stanza for WinEventLog Application inputs stanza to continue collecting data in classic mode:

[WinEventLog://Application]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false 

If you want to stop data collection of WinEventLog data inputs in existing classic mode and to use XML mode, change the existing WinEventLog stanzas in local/inputs.conf to "renderXml = true".

Configuration file changelog for Windows 6.0.0 and AD 1.0.0

Here is a changelog for Microsoft Active Directory 1.0.0 after migrating to Windows 6.0.0:

Configuration File Name	Name of stanza removed
perfmon.conf	all
admon.conf	all
indexes.conf	all
inputs.conf	[admon://NearestDC]

WinEventLog extraction changes for Active Directory sources

The Splunk Add-on for Windows v6.0.0 updates how source and sourcetypes are assigned to WinEventLog data for AD collection. All WinEventLogs are now assigned to either the WinEventLog or the XmlWinEventLog sourcetype and are distinguished by their source.

WinEventLog format	Source in AD 1.0.0	Sourcetype in AD 1.0.0	Source in Windows 6.0.0	Sourcetype in Windows 6.0.0
Classic	WinEventLog:DFS Replication	WinEventLog:DFS-Replication	WinEventLog:DFS Replication	WinEventLog
Classic	WinEventLog:Directory Service	WinEventLog:Directory-Service	WinEventLog:Directory Service	WinEventLog
Classic	WinEventLog:File Replication Service	WinEventLog:File-Replication-Service	WinEventLog:File Replication Service	WinEventLog
Classic	WinEventLog:Key Management Service	WinEventLog:Key-Management-Service	WinEventLog:Key Management Service	WinEventLog
XML	WinEventLog:DFS Replication	WinEventLog:DFS-Replication	XmlWinEventLog:DFS Replication	XmlWinEventLog
XML	WinEventLog:Directory Service	WinEventLog:Directory-Service	XmlWinEventLog:Directory Service	XmlWinEventLog
XML	WinEventLog:File Replication Service	WinEventLog:File-Replication-Service	XmlWinEventLog:File Replication Service	XmlWinEventLog
XML	WinEventLog:Key Management Service	WinEventLog:Key-Management-Service	XmlWinEventLog:Key Management Service	XmlWinEventLog

Due to these changes, events that have already been indexed will no longer be extracted properly. The following renaming stanzas are in the Splunk Add-on For Microsoft Windows 6.0.0 to rename your already indexed events at search time:

[WinEventLog:DFS-Replication]
rename = wineventlog
 
[WinEventLog:Directory-Service]
rename = wineventlog
  
[WinEventLog:File-Replication-Service]
rename = wineventlog
 
[WinEventLog:Key-Management-Service]
rename = wineventlog

If you collect WinEventLog data in Xml Format in the Splunk Addon For Active Directoy 1.0.0, add the following stanzas in /Splunk_TA_windows/local/props.conf to rename your already indexed xml wineventlog events at search-time.

[WinEventLog:DFS-Replication]
rename = xmlwineventlog
 
[WinEventLog:Directory-Service]
rename = xmlwineventlog
  
[WinEventLog:File-Replication-Service]
rename = xmlwineventlog
 
[WinEventLog:Key-Management-Service]
rename = xmlwineventlog

Renamed sourcetypes are case sensitive.

Change sourcetype-based extractions to source-based (Active Directory)

If you have added custom extractions in the sourcetype-based stanza of the Splunk Add-on for Microsoft Windows AD, see convert sourcetype-based configurations to source-based extractions.

Move any other custom configurations from TA-AD 1.0.0 to TA-Windows 6.0.0

Copy any other custom configurations from /Splunk_TA_microsoft_ad/ to /Splunk_TA_windows/ in appropriate configuration files.

Migrate custom configurations of perfmon.conf (Active Directory)

If you have a perfmon.conf file in the Splunk Add-on for Microsoft Windows AD, it does not exist in the Splunk Add-on for Microsoft Windows. Copy any custom configurations of perfmon.conf to the perfmon stanza in /Splunk_TA_windows/local/inputs.conf.

Migrate custom configurations of admon.conf

If you have an admon.conf in the Splunk Add-on for Microsoft Windows AD, it does not exist in the Splunk Add-on for Microsoft Windows version 6.0.0. Copy any custom configuration of the [NearestDC] stanza of admon.conf to the [admon://default] stanza in /Splunk_TA_windows/local/inputs.conf.

Migrate from the Splunk Add-on for Microsoft Windows DNS the Splunk Add-on for Microsoft Windows

Migrate from the Splunk Add-on for Microsoft Windows DNS:

Configure DNS Inputs

1. Make sure all the inputs of the Splunk Add-on for Microsoft DNS are disabled in inputs.conf and perfmon.conf, since these inputs are also in the Splunk Add-on for Windows version 6.0.0.
2. Disable the Splunk Add-on for Microsoft DNS.
3. Move the Splunk_TA_microsoft_dns from $Splunk_Home/etc/apps to $SPLUNK_HOME/etc/disabled-apps.
4. Copy the following input stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf:
   • [WinEventLog://DNS Server]
   • [MonitorNoHandle://$WINDIR\System32\Dns\dns.log]
   • [script://.\bin\runpowershell.cmd dns-zoneinfo.ps1]
   • [script://.\bin\runpowershell.cmd dns-health.ps1]
   • [perfmon://Memory]
   • [perfmon://Processor]
   • [perfmon://Network_Interface]
   • [perfmon://DNS].
5. Make sure there are no duplicate stanzas in inputs.conf after migration.
6. Update index configurations as described in Configure DNS Indexes.
7. To continue to collect perfmon data in single mode, see Changed default Perfmon data collection mode to multikv from single for DNS Perfmon inputs.
8. To continue to collect wineventlog data in classic format, see Changed default WinEventLog data collection mode to XML from classic for DNS Inputs.
9. Enable the DNS inputs in Splunk_TA_Windows/local/inputs.conf.

Configure DNS Indexes

The indexes.conf file in the Splunk Add-on for Microsoft DNS 1.0.1 is not in the Splunk Add-on for Windows version 6.0.0, nor is the index=* setting from all stanzas in inputs.conf.

You must complete the following steps to create index configurations in your Splunk platform deployment and to avoid data loss.

1. If you were using indexes.conf or any custom index to store your data in an earlier version of the Splunk Add-on for Microsoft DNS 1.0.1, copy or create the msad, wineventlog, perfmon, winevents, and windows stanzas from the indexes.conf and inputs.conf files in your existing Splunk Add-on for Microsoft DNS version 1.0.1 in the /Splunk_TA_microsoft_dns/default/ folder to the Splunk Add-on for Windows version version 6.0.0 /Splunk_TA_Windows/local/ folder. Update the index configurations for these DNS inputs based on your existing configurations. Otherwise, any data collected goes to the default main index.
2. <When you forward data from a Windows server using the Splunk Add-on for Windows, the indexer you send events to must also have these indexes present. Install the add-on onto the indexer, and create a new indexes.conf file in the /Splunk_TA_Windows/local/ directory. After creating the indexes, specify these indexes in inputs.conf in the /Splunk_TA_Windows/local/ directory.
3. Make sure there are no duplicate stanzas in indexes.conf.

Changed default Perfmon data collection mode to multikv from single for DNS Perfmon inputs

Multikv mode of Perfmon data collection has benefits over single mode.

Multikv mode has a different event format than single mode. If you want to use multikv mode, set mode = multikv for all required stanzas:

1. Create a local copy of all the existing [perfmon://*] stanzas in your local/inputs.conf file.
2. For each stanza, add the line mode = multikv.

If you want to collect Perfmon data inputs in single mode format after migrating to the Splunk Add-on for Windows to 6.0.0, follow these steps:

1. Create a local copy of all DNS [perfmon://*] stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf.
2. For each stanza, add the line mode = single.

The following is an example stanza for perfmon DNS inputs stanza to continue collecting DNS related perfmon data in single mode:

[perfmon://DNS]
object = DNS
counters = Total Query Received; Total Query Received/sec; UDP Query Received; UDP Query Received/sec; TCP Query Received; TCP Query Received/sec; Total Response Sent; Total Response Sent/sec; UDP Response Sent; UDP Response Sent/sec; TCP Response Sent; TCP Response Sent/sec; Recursive Queries; Recursive Queries/sec; Recursive Send TimeOuts; Recursive TimeOut/sec; Recursive Query Failure; Recursive Query Failure/sec; Notify Sent; Zone Transfer Request Received; Zone Transfer Success; Zone Transfer Failure; AXFR Request Received; AXFR Success Sent; IXFR Request Received; IXFR Success Sent; Notify Received; Zone Transfer SOA Request Sent; AXFR Request Sent; AXFR Response Received; AXFR Success Received; IXFR Request Sent; IXFR Response Received; IXFR Success Received; IXFR UDP Success Received; IXFR TCP Success Received; WINS Lookup Received; WINS Lookup Received/sec; WINS Response Sent; WINS Response Sent/sec; WINS Reverse Lookup Received; WINS Reverse Lookup Received/sec; WINS Reverse Response Sent; WINS Reverse Response Sent/sec; Dynamic Update Received; Dynamic Update Received/sec; Dynamic Update NoOperation; Dynamic Update NoOperation/sec; Dynamic Update Written to Database; Dynamic Update Written to Database/sec; Dynamic Update Rejected; Dynamic Update TimeOuts; Dynamic Update Queued; Secure Update Received; Secure Update Received/sec; Secure Update Failure; Database Node Memory; Record Flow Memory; Caching Memory; UDP Message Memory; TCP Message Memory; Nbstat Memory; Unmatched Responses Received
interval = 10
disabled = 0
mode = single
useEnglishOnly=true

Changed default WinEventLog data collection mode to XML from classic for DNS Inputs

All WinEventLog data collection inputs in the Splunk Add-on for Windows version 6.0.0 are in XML mode by default.

If you want to continue data collection of WinEventLog data inputs in existing Classic mode after upgrading the Splunk Add-on for Windows to 6.0.0, follow these steps:

1. Create a local copy of all the existing DNS [WinEventLog://*] stanzas from Splunk_TA_Windows/default/inputs.conf to Splunk_TA_Windows/local/inputs.conf.
2. For each stanza, add the line "renderXml = false".

Here is an example stanza for WinEventLog Application inputs stanza to continue collecting data in classic mode:

[WinEventLog://Application]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false 

If you want to stop data collection of WinEventLog data inputs in existing classic mode and to use XML mode, change the existing WinEventLog stanzas in local/inputs.conf to "renderXml = true".

Configuration file changelog for Windows 6.0.0 and DNS 1.0.1

Here is a changelog for DNS 1.0.1 after migrating to Windows 6.0.0:

Configuration File Name	Name of stanza removed
perfmon.conf	all
indexes.conf	all
tags.conf	[eventtype=nt6-dns-events]

WinEventLog extraction changes for DNS sources

The Splunk Add-on for Windows version 6.0.0 updates how source and sourcetypes are assigned to WinEventLog data for DNS collection. All WinEventLogs are now assigned to either the WinEventLog or the XmlWinEventLog sourcetype and are distinguished by their source.

WinEventLog format	Source in DNS 1.0.1	Sourcetype in DNS 1.0.1	Source in Windows 6.0.0	Sourcetype in Windows 6.0.0
Classic	WinEventLog:DNS Server	WinEventLog:DNS-Server	WinEventLog:DNS Server	WinEventLog
XML	WinEventLog:DNS Server	WinEventLog:DNS-Server	XmlWinEventLog:DNS Server	XmlWinEventLog

Due to these changes, events that have already been indexed will no longer be extracted properly. The following renaming stanza is in the Splunk Add-on For Microsoft Windows 6.0.0 to rename your already indexed events at search time:

[WinEventLog:DNS-Server]
rename = wineventlog
 

If you have been collecting WinEventLog data in Xml Format while using Splunk Addon For Active Directory 1.0.0, add the following stanza in /Splunk_TA_windows/local/props.conf to rename your already indexed xml wineventlog events at search time.

[WinEventLog:DNS-Server]
rename = xmlwineventlog

Renamed sourcetypes are case sensitive.

Change sourcetype-based extractions to source-based

There are no preconfigured extractions for the sourcetype WinEventLog:DNS-Server in Splunk Addon For Microsoft Windows DNS 1.0.1. But if you have added custom extractions in its sourcetype-based stanza, see Change sourcetype-based extractions to source-based extractions.

Move any other custom configurations from TA-DNS 1.0.1 to TA-Windows 6.0.0

Copy any other custom configurations from /Splunk_TA_microsoft_dns/ to /Splunk_TA_windows/ in appropriate conf files.

Migrate custom configurations of perfmon.conf (DNS)

Since perfmon.conf in the Splunk Add-on for Microsoft DNS does not exist in the Splunk Add-on for Windows, copy any custom configuration of PERFMON:* stanzas of perfmon.conf to its related perfmon stanza in /Splunk_TA_windows/local/inputs.conf.