Splunk Add On for Microsoft Windows: What Really Changed

The upgrades have always been a crucial part of Splunk implementation, as every time there is something better and new offered by Splunk. In this blog, we will try to understand what has changed in the latest version of the Splunk add-on for Microsoft Windows. 

The latest version of Splunk add-on 8.1.2 has much to offer regarding compatibility and fixes. 

Let us have a detailed view of the changes. Read on to know more. 

The Changes 

There’s a laundry list of adjustments and improvements between the major version changes. Without listing everything here’s a small list of items worth noting.

• Switching from non-XMLl format to XML format.
• Joining the AD, and DNS add-ons into a single manageable input that can be broken out for job segregation later.
• Better supporting functionality for data models. (The items that help field ES).
• Supporting Python 3.0.

Version 5.0

Version 8.0

There are also some prominent changes in terms of compatibility. We will have a look at the table for a clear picture. 

Splunk Versions	7.3x, 8.0x, 8.1x
CIM Version	4.15 and later
Platform	Windows
Vendor Products	Windows 2019, Windows 8.1, Windows 10, Windows Server 2012/2012 R2, Windows Server 2016, Microsoft Active Directory, Microsoft Windows DNS Server

Apart from these changes, the latest version of Splunk has several changed features prominent among which is the whole new updated Common Information Model. It has also fixed the version value in the app.conf

Moreover, in terms of manageability we have a few more benefits then before. We now have a single add-on that we can trouble shoot (and a single add-on that splunk can manage), modify, etc.. as needed. Rather then going through the back end and accessing 3 different add-ons.

Data models are largely useful for many reasons premium apps, search queries, etc… A single data source can have upwards of thousands of events. Not all common and some very unique. With each version of the Windows TA comes better definitions that supports greater functionality which in turn improves our analytical work.

In efforts to foresee 3rd parties switching their own development to python 3. So has come the request to support that same change within TAs. The effort is largely based to support the different/newer version of Python as time passes and the old ways exit life.

You can also have a detailed look at all the changes in the latest version of Splunk add-on 

along with the technicalities here. 

Summing Up

With each change comes a small push back. There’s new processes we’re not willing to learn, more knowledge we’ll have to comprehend, and more. 

At the same time it’s worth noting that technology is also ever changing, growing, improving. As with the TA versions. Upgrading/modifying existing applications to-date might break some processes but ultimately it’s for improvement.