topic Re: windows agent msi installation string in Getting Data In

windows agent msi installation string

sonicZ — Wed, 08 Aug 2012 00:24:56 GMT

Our old msi install string does not seem to work for our manual installs with newer splunk 4.3.x agents

we used the following string on older installs, any ideas why this does not work with the automated msi installer?

msiexec.exe /i splunk-4.1.6-89596-x64-release.msi WINEVENTLOGAPPCHECK=1 WINEVENTLOGSECCHECK=1 WINEVENTLOGSYSCHECK=1 WINEVENTLOGFWDCHECK=1 WINEVENTLOGSETCHECK=1 WMICHECK_CPUTIME=1 WMICHECK_LOCALDISK=1 WMICHECK_FREEDISK=1 WMICHECK_MEMORY=1 AUTOSTARTSERVICE_SPLUNKD=1 AUTOSTARTSERVICE_SPLUNKWEB=0  SPLUNK_APP=SplunkLightForwarder FORWARD_SERVER="spfd.shared-bo.ilg1.vrsn.com:9997" LAUNCHSPLUNK=0

Re: windows agent msi installation string

kristian_kolb — Wed, 08 Aug 2012 13:41:27 GMT

Are you using the full splunk or the universal forwarder for 4.3.x?

From your install string above it looks like you are trying to install a full splunk as a light forwarder. It's probably better to use the universal forwarder in that case.

I believe that the following string would work for a universal forwarder and achieve what you want. For the full list of install flags, see the docs

msiexec.exe /i splunkuniversalforwarder-4.3.x-xxxxxxx-x64-release.msi 
WINEVENTLOG_APP_ENABLE=1 
WINEVENTLOG_SYS_ENABLE=1 
WINEVENTLOG_SEC_ENABLE=1 
WINEVENTLOG_SET_ENABLE=1 
WINEVENTLOG_FWD_ENABLE=1 
PERFMON=cpu, memory, network, diskspace
SERVICESTARTTYPE=auto    
RECEIVING_INDEXER="spfd.shared-bo.ilg1.vrsn.com:9997" 
LAUNCHSPLUNK=0

NOTE, if you are migrating a splunk light forwarder to a universal forwarder, you should read this as well.

Hope this helps,

Kristian

Re: windows agent msi installation string

sonicZ — Wed, 08 Aug 2012 17:46:38 GMT

Kristian, our IT guys were using older pre-universal forwarder clients for a while. I was looking for the updated strings to use for the universal forwarder. Thanks for the link to the docs didnt catch that.