Is the Splunk TA_Windows automatically installed with the ufw?

[a212830]

Hi,

Am I imagining things, or does the Splunk TA_Windows automatically get installed with the UFW? Is there any way to stop that? It appears to automatically turn on some events, which I don't want (nor do I want to manually override them)...

[jbailey_splunk]

Currently, if you install the UF with the MSI installer - it will install Splunk_TA_windows on your forwarder by default. The workaround for this (not installing TA_windows with the UF install) is to use the command line install option and perform a silent install of the forwarder.

You could also try to "customize" the install (with MSI installer) and not accept the defaults - if you do not select any input options, it is possible that TA_windows will not get installed, but I'm not 100% sure on this one. Feel free to test this one out.