topic Re: Splunk UF Dmg/PKG Silent Install for Mac in Splunk Enterprise

Splunk UF Dmg/PKG Silent Install for Mac

jason_hotchkiss — Thu, 14 Sep 2023 19:08:14 GMT

Hello -

I am trying to script the installation for the Mac Splunk Universal Forwarder package. The package is a disk image (.dmg).

I understand that we can mount the image using hidutil and access the volume to find the .pkg file. The issue comes from where we attempt to run installer -pkg volume/splunkuf.pgk -target /Applications/SplunkUf/ the end user is prompted to answer dialog boxes, which we do not want to occur.

Is there a switch to use to install the pkg file silently?

TIA
JH

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Mon, 04 Mar 2024 00:52:14 GMT

Hi Jason,

Did you find a solution for this?

Re: Splunk UF Dmg/PKG Silent Install for Mac

dkv21210 — Wed, 20 Mar 2024 17:25:01 GMT

I'd love to know as well. I've been banging my head against a wall with this, off and on, for a couple of months now. It's insane to me how impossible it is to find any solutions online (never mind this forum), and Splunk clearly doesn't care to address it.

How exactly are we to do quiet deployments of UF to a fleet of Macs managed by MDM? As it stands, the DMG is out (too much user interaction required, which apparently can't be suppressed), and the .tgz also requires a combination of scripting, permissions changes, possibly creation of a new user, setting environment variables, and moving config files into place.

Can I do this myself? Sure, but why should I have to? Even with the leverage of $GIGANTIC_FEDERAL_AGENCY, Splunk doesn't care to help us.

Godspeed to us all, I guess.

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Wed, 20 Mar 2024 17:36:31 GMT

Hi dkv21210,

Are you using JAMF as your MDM?

Re: Splunk UF Dmg/PKG Silent Install for Mac

dkv21210 — Wed, 20 Mar 2024 17:39:06 GMT

Yes, I am. Previously, with an older version, we just used Jamf Composer watch the file system, then did the manual .pkg installed (user interaction and all), put in our settings files, then had Composer create the package. I really don't want to keep having to do that kind of sloppy install, but it's beginning to look like we may have to.

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Wed, 20 Mar 2024 17:55:09 GMT

So, I was able to get it to silently deploy and it seems to be working as intended

I built the package using Composer, making sure to set the proper R-W-X, Owner, and Group permissions for /Applications/SplunkForwarder

Then added the deploymentclient.conf file within the /Applications/SplunkForwarder/etc/system/local directory before building the package.

Then for my policy I added that package, and for the silent install I added a script which contains:

#!/bin/sh

#Accept Splunk Licenses

/Applications/SplunkForwarder/bin/splunk start --accept-license --auto-ports --no-prompt --answer-yes

# Enable boot start

/Applications/SplunkForwarder/bin/splunk enable boot-start

#Hide the folder

chflags hidden /Applications/SplunkForwarder

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Wed, 20 Mar 2024 17:54:24 GMT

Although, I do notice that notifications are still enabled. I created a config profile that mutes Critical Alerts and Notifications for Bundle ID: aplt

Tested it once, seemed to work, but I'd like to test again on a fresh machine to verify.

Re: Splunk UF Dmg/PKG Silent Install for Mac

dkv21210 — Wed, 20 Mar 2024 18:25:23 GMT

Interesting! Thanks for this; I'll review and give this a try.

One question: Are you creating a Splunk user and changing permissions recursively to splunk:splunk, or are you just leaving it as-is? (To this point, we've been doing the latter, but I'm wondering if creating a dedicated user might be preferable?)

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Wed, 20 Mar 2024 18:43:44 GMT

Leaving it as is.

SplunkForwarder folder and contents within are owned by root and wheel

Applications Folder is owned by root and admin

Re: Splunk UF Dmg/PKG Silent Install for Mac

jason_hotchkiss — Thu, 21 Mar 2024 11:14:45 GMT

Sorry, no I did not find a solution, the requirement changed, and we shifted gears.

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Thu, 21 Mar 2024 21:26:15 GMT

Update, configuration profile works, no notifications are seen from the users perspective and workstation is added into Splunk

Re: Splunk UF Dmg/PKG Silent Install for Mac

dkv21210 — Thu, 28 Mar 2024 16:44:02 GMT

I'm still working on this; I've made some progress on doing the .tar file install and tweaking it, but I'm getting these two alerts (see attached images) whenever I log in to the user account. Have you found a workaround (assuming you've seen this)?

Re: Splunk UF Dmg/PKG Silent Install for Mac

Knight_Owl — Thu, 28 Mar 2024 17:27:35 GMT

Hey DK,

Build the PKG, then open terminal and run the command

sudo xattr -rd com.apple.quarantine /path/to/the.pkg

This will remove the com.apple.quarantine attribute and stop the computer from checking it for malicious software. The -d option deletes the noted attribute and the -r option acts recursively.

If you would like to check which attributes the .PKG has on it, then run the command:

xattr -r /path/to/the.pkg

Hope this helps

Re: Splunk UF Dmg/PKG Silent Install for Mac

dkv21210 — Thu, 28 Mar 2024 17:07:44 GMT

Perfect! Thanks for the tip.