Release notes for the Splunk Add-on for Microsoft Windows

Version 12.0.0 of the Splunk Add-on for Microsoft Windows was released .

Compatibility

Version 12.0.0 of the Splunk Add-on for Microsoft Windows is compatible with the following software, CIM versions, and platforms:

Splunk Enterprise versions	9.2.x, 9.3.x, 9.4.x, 10.0.x, 10.2.x, 10.4.x, 10.6.x
Splunk Cloud Platform versions	9.2.x, 9.3.x, 9.4.x, 10.0.x, 10.2.x, 10.3.x, 10.4.x, 10.5.x, 10.6.x and later
Universal Forwarders	Additional configuration is required on versions earlier than 10.4. See Universal Forwarder compatibility.
CIM	4.15 and later
Platform	Windows
Vendor Products	Windows Server 2025, Windows Server 2022, Windows 11, Windows Server 2019, Windows 8.1, Windows 10, Windows Server 2012/2012 R2, Windows Server 2016, Microsoft Active Directory, Microsoft Windows DNS Server

Universal Forwarders earlier than 10.4

Version 12.0.0 still includes INDEXED_EXTRACTIONS = XMLKV-WINEVT, even though XML index-time extraction is disabled by default. Older Universal Forwarders can reject this value. Review Universal Forwarder compatibility and the workaround before deploying the add-on. The optional index-time optimized profile requires Splunk 10.4.3 or later.

Third-party software credits are unchanged from version 11.0.2. See Third-party software credits for version 11.0.2.

New features

Version 12.0.0 of the Splunk Add-on for Microsoft Windows includes the following change: - Added CIM Authentication data model mapping for Windows Security Event ID 4801 (workstation unlocked) to support UEBA detections, while preserving existing Change data model mappings. - Updated CIM Network Sessions field mappings for Windows DHCP events so that dest_dns contains the fully qualified domain name and dest_nt_host contains the short hostname.

Fixed issues

Version 12.0.0 of the Splunk Add-on for Microsoft Windows fixes the following issues:

Known issues

Version 12.0.0 of the Splunk Add-on for Microsoft Windows contains the following, if any, known issues: