I downloaded this and have no idea where it goes: https://splunkbase.splunk.com/app/1908/ Google is not helping either.

1 Answer 1


From the details tab of the App description page of the page you linked:

To gather all data from a SharePoint server:

Download the "Splunk Add-on for Microsoft Windows" (v4.7.3 or later) and configure it to gather the Windows Event Logs for Security, Application and System. Deploy this to all SharePoint servers.

Download the "Splunk Addon for Microsoft PowerShell" and deploy it to all SharePoint servers.

Download this "Add-on for Microsoft SharePoint" and deploy it "as downloaded" to the indexers and search heads.

Create indexes as appropriate for sharepoint, iis, and perfmon data (and restart the indexers)

Create a copy of the TA-Sharepoint add-on and enable inputs, configure indexes as above, and deploy this to the audit reader. The spXXaudit and spXXinventory must be enabled for the appropriate version of SharePoint (XX=10 for SharePoint 2010 and 13 for SharePoint 2013).

For all other servers, enable all inputs EXCEPT spXXaudit and spXXinventory (at the top of the inputs.conf file), configure indexes as above, and then deploy the TA-SharePoint to all OTHER SharePoint servers (except the audit reader).

  • Yeah, I just went through the details after asking this and found it, thank you.
    – tesorrells
    Jul 6, 2016 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.