Splunk® Add-on for Windows

Deploy and Use the Splunk Add-on for Windows

Download manual as PDF

Download topic as PDF

Release notes for the Splunk Add-on for Windows

Version 6.0.0 of the Splunk Add-on for Windows was released on February 18, 2019.

The Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the steps outlined in Upgrade the Splunk Add-on for Windows. Failure to do so can result in data loss.

Neither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0..0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory.

Compatibility

Version 6.0.0 of the Splunk Add-on for Windows is compatible with the following software, CIM versions, and platforms:

Splunk platform versions 6.6.x, 7.0.x, 7.1.x, 7.2.x
CIM 4.11
Platform Windows
Vendor Products Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012/2012 R2, Windows Server 2016, Microsoft Active Directory, Microsoft Windows DNS Server

New or changed features

Version 6.0.0 of the Splunk Add-on for Windows has the following new or changed features:

  • Windows Server 2016 Compatibility for Microsoft AD and DNS inputs
  • Added support for multi-KV mode for perfmon data inputs of AD and DNS add-ons
  • Added support for the metrics index for Perfmon:* sourcetypes of AD and DNS add-ons
  • Source and sourcetype changes for WinEventLog data of AD and DNS sources
  • Removed out-of-date configurations
  • The Splunk Add-on for Microsoft Active Directory and the Splunk Add-on for Microsoft DNS are merged into version 6.0.0 of the Splunk Add-on for Windows
  • For Windows 10 and Windows Server 2016, the Get-WindowsUpdateLog PowerShell command collects Windows Update Log data at regular, automated intervals
  • For all Wineventlog inputs, the renderXml setting is true by default

Fixed Issues

Version 6.0.0 of the Splunk Add-on for Windows fixes the following issues:

Date resolved Issue number Description
2019-03-08 ADDON-20207 Documentation for release

Known Issues

Version 6.0.0 of the Splunk Add-on for Windows contains the following known issues. If no issues appear below, no issues have yet been reported:

Date filed Issue number Description
2018-09-06 ADDON-19338 Data duplication issue in WindowsUpdate.Log
2016-04-19 ADDON-9162 Field extraction for Account Domain extracts multiple values
PREVIOUS
Source types for the Splunk Add-on for Windows
  NEXT
Hardware and software requirements for the Splunk Add-on for Windows

This documentation applies to the following versions of Splunk® Add-on for Windows: 6.0.0


Comments

Hi there,

Unfortunately the eventgen "stuff" is not currently publicly available.

Jbalik splunk, Splunker
March 20, 2019

I noticed that all of the eventgen "stuff" was stripped out of this version of the Windows TA. Will this be provided in a repository somewhere?

Djl
March 14, 2019

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters