Skip to content

Hardware and software requirements for the Splunk Add-on for Microsoft Windows

Splunk admin requirements

To install and configure the Splunk Add-on for Microsoft Windows, you must be a member of the admin or sc_admin role.

Hardware and Operating System requirements

The Splunk Add-on for Microsoft Windows installs onto any type of Splunk Enterprise instance. On universal forwarders, you must configure the add-on with configuration files.

The add-on installs on Splunk Enterprise instances that run on many current versions of Windows, including:

  • Windows 8.1
  • Windows 10
  • Windows 11
  • Windows Server 2012/2012 R2
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022
  • Windows Server 2025

The add-on does not support:

  • Windows 8
  • Windows Server 2008 R2
  • Windows 7
  • Windows 95/98/Me
  • Windows NT Workstation/Server 3.1/3.5/4.0
  • Windows Server 2008
  • Windows 2000 Workstation/Server
  • Windows XP
  • Windows Vista

For details about supported versions of Windows for Splunk, see System Requirements in the Splunk Enterprise Installation Manual.

Splunk platform requirements

Because this add-on runs on the Splunk platform, all of the system requirements apply for the Splunk software that you use to run this add-on.

Version 11.0.0 platform compatibility

Splunk Add-on for Microsoft Windows version 11.0.0 is not supported on Splunk Enterprise versions 10.4.0 through 10.4.2 and Splunk Cloud Platform versions 10.4.x through 10.5.x.

  • For Splunk Enterprise system requirements, see System Requirements in the Splunk Enterprise Installation Manual.
  • If you plan to run this add-on entirely in Splunk Cloud, there are no additional Splunk platform requirements.
  • If you are managing on-premises forwarders to get data into Splunk Cloud, see System Requirements in the Splunk Enterprise Installation Manual, which includes information about forwarders.

Universal Forwarder compatibility

Splunk Add-on for Microsoft Windows version 11.0.0 or later includes INDEXED_EXTRACTIONS = XMLKV-WINEVT in both XmlWinEventLog stanzas in default/props.conf. Universal Forwarders earlier than version 10.4 do not recognize this value and can report the following configuration validation error:

Invalid value='XMLKV-WINEVT' for parameter='INDEXED_EXTRACTIONS'

Check the forwarder version before deploying version 11.0.0 or later

The Splunk platform compatibility tables do not mean that these add-on packages work without additional configuration on Universal Forwarders earlier than 10.4. Check the version of each forwarder, including forwarders that send data to Splunk Cloud Platform. The receiving Splunk platform version does not resolve a forwarder’s configuration validation error.

Versions 11.0.1 through 12.0.0 disable XML index-time extraction by default with XML_INDEXED_EXTRACTIONS_PIPELINE = -, but retain INDEXED_EXTRACTIONS = XMLKV-WINEVT. Disabling the pipeline does not prevent this validation error on older forwarders.

For an affected Universal Forwarder, use the local configuration workaround. If you cannot deploy the workaround, remain on add-on version 10.1.2 before upgrading, provided that its compatibility table supports your environment. Version 10.1.2 does not include the XMLKV-WINEVT setting.

The optional index-time optimized XML extraction profile has a separate requirement of Splunk 10.4.3 or later. Do not enable that profile on Splunk 10.4.0 through 10.4.2 or earlier versions.

Installation and configuration overview for the Splunk Add-on for Microsoft Windows

Complete the following steps to install and configure this add-on:

  1. Upgrade the Splunk Add-on for Microsoft Windows or Install the Splunk Add-on for Microsoft Windows.
  2. Configure Splunk Add-on for Microsoft Windows.
  3. (Optional) Deploy the Splunk Add-on for Microsoft Windows with Forwarder Management.