Add splunk input for all windows data streams

packages/windows/_dev/build/docs/README.md

@@ -8,6 +8,13 @@ always applies to the local server, the `hosts` config option is not needed. Not
 The Windows datasets collect different kinds of metric data, which may require dedicated permissions
 to be fetched and which may vary across operating systems.
 
+## Configuration
+
+### Splunk Enterprise
+
+To configure Splunk Enterprise to be able to pull events from it, please visit
+[Splunk docs](https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata) for details. **The integration requires events in XML format, for this `renderXml` option needs to be set to `1` in your `inputs.conf`.**
+
 ## Metrics
 
 ### Service

packages/windows/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.5.0"
+  changes:
+    - description: Add Splunk input for Winlog data streams.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/821
 - version: "0.4.3"
   changes:
     - description: Updating package owner

packages/windows/data_stream/forwarded/manifest.yml

@@ -6,3 +6,29 @@ streams:
     template_path: winlog.yml.hbs
     title: Forwarded
     description: 'Collect ForwardedEvents channel logs'
+  - input: httpjson
+    title: Windows ForwardedEvents via Splunk Enterprise REST API
+    description: Collect ForwardedEvents via Splunk Enterprise REST API
+    enabled: false
+    template_path: httpjson.yml.hbs
+    vars:
+      - name: interval
+        type: text
+        title: Interval to query Splunk Enterprise REST API
+        description: Go Duration syntax (eg. 10s)
+        show_user: true
+        required: true
+        default: 10s
+      - name: search
+        type: text
+        title: Splunk search string
+        show_user: false
+        required: true
+        default: "search sourcetype=\"XmlWinEventLog:ForwardedEvents\""
+      - name: tags
+        type: text
+        title: Tags
+        multi: true
+        show_user: false
+        default:
+          - forwarded