Getting Data In

What splunk stream forwarder is used for windows server?

bobmccoy
Explorer

I understand how to use stream with Linux machines but what forwarder do I use for windows servers?
Are there any documents on this?

0 Karma

p_gurav
Champion

Hi,

Splunk Stream uses the WinPcap driver to capture packets on Windows systems. Due to a flaw in the WinPcap security model, installing Stream on Windows allows all local users to use WinPcap for packet sniffing. Refer below docs:

http://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/InstallSplunkAppforStream#Windo...

https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

0 Karma

bobmccoy
Explorer

yeah that is to unsecured
I found I could do like this and it is working

Once the Splunk App for Stream is installed on a Splunk Search Head, there will be a Splunk_TA_stream directory that’ll be created in $SPLUNK_HOME/etc/apps. Splunk_TA_stream will then need to be copied over to your windows machine under $SPLUNK_HOME\etc\apps (typically C:\Program Files\SplunkUniversalForwarder\etc\apps). From there, you’ll need to create a local directory and inputs.conf file within. Contents of the inputs.conf file should be as follows, just be sure to replace “localhost” with the hostname of the SH where the Stream app exists, and be sure to modify http/https and the port, where appropriate:

[streamfwd://streamfwd]
splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Then, make sure the windows machines has the outputs.conf to send data to Splunk Cloud, and restart the forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...