If I plan to install heavy forwarders on Windows servers, do I need to install Splunk App for Windows Infrastructure?

[greich]

Planning to install heavy forwarders on Windows servers. Splunk has multiple data inputs specific to Windows that can be configured.

Is there any benefit to also installing the Splunk App for Windows Infrastructure?

[jbernt_splunk]

Do you have a reason to use heavy forwarders on your Windows servers? The Universal Forwarder is normally sufficient. I'd recommend the Splunk Add-on for Windows (also known as ta-windows) for Windows data. Also the only add-ons included in the Windows Infrastructure app are for Domain Controllers and DNS servers specific to Active Directory. Otherwise, the ta-windows is the only add-on that is needed.

[nkpiquette]

It really depends on your needs honestly. Out of the box there are a few different data sources it can acquire data from that you may find useful. Make sure you look into the inputs.conf and see what data it is polling and decide if that will be useful for you or not.

This can be helpful to get more Windows event log data in: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitorwindowsdata

One thing I recently learned is that you can use the whitelist attribute under the input stanza to specify what event logs you truly care about. This is referenced in the above link.

Hopefully this helps!