topic Re: Installing Universal Forwarder with no configuration. in Getting Data In

Installing Universal Forwarder with no configuration.

adrianathome — Thu, 27 Jun 2013 00:23:00 GMT

I am looking to install the UF across my organization. We will use deployment tool to deploy and manage the the UF + any apps/configs.

According to this link the required installation flags are

     1. AGREETOLICENSE=Yes
     2. RECEIVING_INDEXER="<server:port>"
     3. At least one data input flag, such as WINEVENTLOG_APP_ENABLE=1. You can add as many data input flags as you need.

However, I wish to agree to license and continue installation with no other configuration. Our deployment solution will then pass the config files as an app after installation and restart the forwarder.

How can I accomplish this?

Re: Installing Universal Forwarder with no configuration.

asimagu — Thu, 27 Jun 2013 00:36:23 GMT

You should be able to do the install without any inputs.

If you are using a deployment server, you can always configure the inputs in the apps that you are deploying.

So, once you install the package via rpm or untarring it:

splunkforwarder/bin/splunk --accept-license enable boot-start
splunkforwarder/bin/splunk set deploy-poll
vi splunkforwarder/etc/splunk-launch.conf
SPLUNK_BINDIP=127.0.0.1
/etc/init.d/splunk restart

Re: Installing Universal Forwarder with no configuration.

gkanapathy — Thu, 27 Jun 2013 03:24:29 GMT

This is slightly outdated in details, but it should help:

http://wiki.splunk.com/Deploying_Splunk_Light_Forwarders

As for the RECEIVING_INDEXER flag, I believe it is inaccurate that it is required. Only the AGREETOLICENSE flag is required by the installer.

Re: Installing Universal Forwarder with no configuration.

kristian_kolb — Thu, 27 Jun 2013 09:41:36 GMT

Unless you have a very good reason, don't run as root.

Re: Installing Universal Forwarder with no configuration.

kristian_kolb — Thu, 27 Jun 2013 09:55:21 GMT

If you intend to use the Deployment Server, the only additional setting you need is the ip:port of the DS. Then you can configure the rest as deployed applications, including outputs.conf.

MSIEXEC.EXE /i <splunk-installer.msi> DEPLOYMENT_SERVER=ip:port AGREETOLICENSE=Yes

as per the the first example in the docs;

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/DeployaWindowsdfviathecommandline#Examples

/Kristian

Re: Installing Universal Forwarder with no configuration.

adrianathome — Thu, 27 Jun 2013 10:55:56 GMT

No deployment server. We will use a 3rd party tool to manage configs.

Re: Installing Universal Forwarder with no configuration.

adrianathome — Thu, 27 Jun 2013 10:56:31 GMT

Will confirm later today.

Re: Installing Universal Forwarder with no configuration.

gkanapathy — Thu, 27 Jun 2013 14:53:29 GMT

actually, now that i think about it, i'm not sure the AGREETOLICENSE flag is required. if you are scripting your install to a high degree (like you might do on Unix), then you may also want to use the msiexec's "administrative install" option, "msiexec /a", which I believe will simply put the Splunk files in place and not run any first-time run scripts. If you do this, though, you will have to script in a "splunk enable boot-start" and a "splunk start --accept-license" in your own script. This is not really documented, and it not strictly a Splunk option, but a Windows msiexec option.

Re: Installing Universal Forwarder with no configuration.

asimagu — Thu, 27 Jun 2013 20:42:14 GMT

good call, by default I usually do that coz I have to in my systems, I will edit my answer, thanks

Re: Installing Universal Forwarder with no configuration.

adrianathome — Sat, 29 Jun 2013 01:11:15 GMT

Msiexec.exe /a did not work. However, msiexec.exe /i splunk.msi /qn AGREETOLICENSE=yes did work. It threw a couple off errors but at the end it installed.