Install the Collector for Windows with the installer script

Describes how to install the Splunk Distribution of the OpenTelemetry Collector for Windows.

Note: You can use the legacy or new API and service endpoint URLs as of March 24, 2026. The legacy endpoints have the domain signalfx, and the new endpoints have the domain observability.splunkcloud. Thus, you can use the legacy ingest endpoint ingest.realm.signalfx.com or the new ingest endpoint ingest.realm.observability.splunkcloud.com. See Splunk Observability Cloud domain change for more information.

The Splunk Distribution of the OpenTelemetry Collector for Windows is a package that provides integrated collection and forwarding for all data types. Read on to see how to install it using the installer script.

Note: The Splunk Distribution of the OpenTelemetry Collector comes with a default configuration, as detailed in Collector for Windows default configuration. To modify this configuration, refer to Advanced configuration for Windows. To learn how to obtain logs, see Collect logs with the Collector for Windows.

Alternatively, you can also install the Collector for Windows:

Prerequisites

For metrics collection, use the Splunk Distribution of OpenTelemetry Collector v0.157.0 or higher.

The Collector supports the following Windows versions on amd64 and arm64 CPUs:

  • Windows 11 Pro and Home

  • Windows Server 2016, 2019, 2022, and 2025

Important: Microsoft Windows PowerShell 5.1 or higher is required.

Included packages

The Windows installer script installs the following packages:

Install the Collector for Windows using the installer script

The installer script is available for Windows 64-bit environments, and deploys and configures the Splunk Distribution of the OpenTelemetry Collector for Windows.

To install the package using the installer script, follow these steps:

  1. Ensure that you have Administrator access on your host.

  2. Run the following PowerShell command on your host, replacing the following variables for your environment:

POWERSHELL 
& {Set-ExecutionPolicy Bypass -Scope Process -Force; $script = ((New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')); $params = @{access_token = "SPLUNK_ACCESS_TOKEN"; realm = "SPLUNK_REALM"}; Invoke-Command -ScriptBlock ([scriptblock]::Create(". {$script} $(&{$args} @params)"))}

To install the Collector with Splunk Observability Cloud collection, Splunk platform log collection, and Splunk platform metric collection, pass the Splunk platform settings as MSI public properties:

POWERSHELL 
& {
  Set-ExecutionPolicy Bypass -Scope Process -Force
  $script = (New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')
  $params = @{
    access_token = "SPLUNK_ACCESS_TOKEN"
    realm = "SPLUNK_REALM"
    msi_public_properties = "SPLUNK_PLATFORM_URL=<URL> SPLUNK_PLATFORM_TOKEN=<TOKEN> SPLUNK_PLATFORM_LOGS_INDEX=<LOGS_INDEX> SPLUNK_PLATFORM_METRICS_INDEX=<METRICS_INDEX>"
  }
  & ([scriptblock]::Create($script)) @params
}

If you need to activate TLS in PowerShell, use the command:

POWERSHELL 
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
CAUTION: Starting from version 0.89, the installer for the Splunk Distribution of the OpenTelemetry Collector for Windows sets its configuration using environment variables at service level instead of global level. To configure additional settings use service, process, or terminal scopes.

Start the Collector executable manually

If you experience unexpected start failures, try to start the Collector executable manually.

To do so, run the following PowerShell command as an Admin:

POWERSHELL 
& 'C:\Program Files\Splunk\OpenTelemetry Collector\otelcol.exe' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\agent_config.yaml' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_logs_config_windows.yaml' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_metrics_config_windows.yaml' `
  --feature-gates=confmap.enableMergeAppendOption

When you provide multiple configuration files, include --feature-gates=confmap.enableMergeAppendOption.

Configure OpAMP Supervisor for Fleet Management remote configuration

With Collector version 0.159.0 or higher, you can run the Collector with the OpAMP Supervisor to use Fleet Management remote configuration feature. The OpAMP Supervisor is deactivated by default.

To enable the OpAMP Supervisor during installation, provide a Splunk Observability Cloud access token and pass the -with_supervisor $true option. For example:

JSON 
& {
    Set-ExecutionPolicy Bypass -Scope Process -Force
    $script = (New-Object System.Net.WebClient).DownloadString(
        'https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1'
    )
    $params = @{
        access_token    = "SPLUNK_ACCESS_TOKEN"
        realm           = "SPLUNK_REALM"
        with_supervisor = $true
    }
    & ([scriptblock]::Create($script)) @params
}

If you omit the -with_supervisor option or set it to $false, the Collector runs directly without the OpAMP Supervisor. To determine when to use the OpAMP Supervisor, see OpenTelemetry Fleet Management.

Options of the installer script for Windows

The Windows installer script supports the following options:

Option

Description

Default value

access_token

The token used to send metric data to Splunk.

realm

The Splunk realm to use. The ingest, API, trace, and HEC endpoint URLs are automatically created using this value. To find your Splunk realm, see Note about realms.

us0

memory

Total memory in MIB to allocate to the Collector. Automatically calculates the ballast size. See Sizing and scaling for more information.

512

mode

Configure the Collectorservice to run in host monitoring (agent) or data forwarding (gateway).

agent

network_interface

The network interface the Collectorreceivers listen on.

0.0.0.0

ingest_url

Set the base ingest URL explicitly instead of the URL inferred from the specified realm.

https://ingest.REALM.observability.splunkcloud.com

api_url

Set the base API URL explicitly instead of the URL inferred from the specified realm.

https://api.REALM.observability.splunkcloud.com

trace_url

Set the trace endpoint URL explicitly instead of the endpoint inferred from the specified realm.

https://ingest.REALM.observability.splunkcloud.com/v2/trace

hec_url

Set the HEC endpoint URL explicitly instead of the endpoint inferred from the specified realm.

https://ingest.REALM.observability.splunkcloud.com/v1/log

hec_token

Set the HEC token if it’s different than the specified Splunk access token.

with_dotnet_instrumentation

Whether to install and configure .NET tracing to forward .NET application traces to the local collector.

$false

deployment_env

A system-wide environment tag used by .NET instrumentation. Sets the SIGNALFX_ENV environment variable. Ignored if -with_dotnet_instrumentation is set to false.

bundle_dir

The location of your Smart Agent bundle for monitor functionality.

C:\Program Files\Splunk\OpenTelemetry Collector\agent-bundle

insecure

If true then certificates aren’t checked when downloading resources.

$false

collector_version

Specify a specific version of the Collector to install.

Latest version available

stage

The package stage to install from [test, beta, release].

release

collector_msi_url

When installing the Collector, instead of downloading the package, use this local path to a Splunk OpenTelemetry Collector MSI package. If specified, the -collector_version and -stage parameters are ignored.

https://dl.observability.splunkcloud.com/splunk-otel-collector/msi/release/splunk-otel-collector-<version>-amd64.msi

msi_path

Specify a local path to a Splunk OpenTelemetry Collector MSI package to install instead of downloading the package. If specified, the -collector_version and -stage parameters will be ignored.

msi_public_properties

Specify public MSI properties to be used when installing the Splunk OpenTelemetry Collector MSI package.
with_supervisor

Whether to manage the Splunk OpenTelemetry Collector with OpAMP Supervisor.

$false

Use msi_public_properties to pass Splunk platform settings to the MSI installer:

MSI public property

Description

SPLUNK_PLATFORM_URL

Required. The Splunk HEC endpoint URL, such as https://splunk.example.com:8088/services/collector.

SPLUNK_PLATFORM_TOKEN

Required. The Splunk HEC token that authenticates requests to the Splunk platform.

SPLUNK_PLATFORM_LOGS_INDEX

The Splunk index to send logs to.

SPLUNK_PLATFORM_METRICS_INDEX

The Splunk index to send metrics to.

Next steps

After you have installed the package, see: