topic Universal forwarder scripted install in Getting Data In

Universal forwarder scripted install

aberdamy — Mon, 28 Sep 2020 16:18:43 GMT

Does anyone know if it is possible to automatically add the current_only = [0|1] attribute in a scripted Universal Forwarder install? The inputs.conf I am referencing is located here:

C:\Program Files (x86)\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

[WinEventLog://Application]
disabled = 0
current_only = 1

[WinEventLog://Security]
disabled = 0
current_only = 1

[WinEventLog://System]
disabled = 0
current_only = 1

Re: Universal forwarder scripted install

martin_mueller — Thu, 03 Apr 2014 22:35:18 GMT

Have you considered rolling out the inputs.conf (and its surrounding app) automatically, using the Splunk Deployment Server or any 3rd party configuration management tool?
That would not only simplify your scripted install, but would also make future maintenance nightmares disappear.

As for your question itself, you can do this from the CLI:

splunk _internal call /servicesNS/nobody/Splunk_TA_windows/properties/inputs/WinEventLog%3A%2F%2FSecurity/current_only -post:value 1 -auth admin:pass

That should be integrateable into your install script.

Re: Universal forwarder scripted install

aberdamy — Mon, 28 Sep 2020 16:20:36 GMT

We are rolling the Universal Forwarder out via SCCM and we have a batch file that looks at the Operating system architecture and writes to the "/etc/system/local inputs.conf" file to monitor the firewall log if it is a Windows 2003 system. Would the splunk_internal call command work with this? If so, where would I insert it? Part of batch:

start /wait msiexec /i splunkforwarder-6.msi
INSTALLDIR="%PROGRAMFILES%\SplunkUniversalForwarder" RECEIVING_INDEXER="server:9997" WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 DISPLAY_WINDOWS_TA_DIALOG=1 LAUNCHSPLUNK=0 /quiet

Re: Universal forwarder scripted install

martin_mueller — Tue, 08 Apr 2014 15:31:23 GMT

You'd have to run that after Splunk's installation, and probably only while it's running.

It might be easier to add that line to the config file directly from your script, especially if you already are writing to inputs.conf.