topic How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe in Getting Data In

How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

pfabrizi — Tue, 29 Sep 2020 15:39:47 GMT

I am trying to install the universal forwarder on Windows using this command.

msiexec.exe TARGETDIR="C:\PROGRAM Files\splunker-security" /i splunkforwarder-6.6.2-4b804538c686-x64-release.msi RECEIVING_INDEXER="10.83.180.135:9997,10.83.180.133:9997" WINEVENTLOG_SEC_ENABLE=1 AGREETOLICENSE=Yes

it seems to ignore the parameters after the .msi.

I have to use 2 deployment methods, 1 puppet and the other BMC, so I want to use the msi install as that is a requirement for our puppet deployments.

Thanks!

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

richgalloway — Wed, 06 Sep 2017 16:58:09 GMT

TARGETDIR is not a recognized flag. Try INSTALLDIR. See http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline#Supported_command_line_flags

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

pfabrizi — Wed, 06 Sep 2017 21:19:20 GMT

I get this error, am I missing a switch?

MSI (s) (E8:34) [14:55:53:542]: Package to be registered: 'splunkforwarder-6.6.2-4b804538c686-x64-release.msi'
MSI (s) (E8:34) [14:55:53:542]: Note: 1: 2205 2: 3: Error
MSI (s) (E8:34) [14:55:53:543]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (E8:34) [14:55:53:543]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: Rejecting product '{16F5098E-7399-41AF-AB7B-3F5CEF8E3340}': Non-assigned apps are disabled for non-admin users.
MSI (s) (E8:34) [14:55:53:544]: Note: 1: 1708
MSI (s) (E8:34) [14:55:53:544]: Product: UniversalForwarder -- Installation failed.

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

richgalloway — Thu, 07 Sep 2017 13:28:19 GMT

I think you need admin privileges to install the forwarder. Are you using an account with admin rights?

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

ddrillic — Thu, 07 Sep 2017 14:35:17 GMT

The following works for me -

msiexec.exe /i splunkforwarder-6.5.1-f74036626f0c-x64-release.msi  INSTALLDIR="E:\opt\splunk" DEPLOYMENT_SERVER="<host>:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

pfabrizi — Thu, 07 Sep 2017 16:25:00 GMT

I have it working, I had to uninstall the version that I was running since it was the same.

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

pfabrizi — Thu, 07 Sep 2017 16:30:06 GMT

I have it working at now, install and then once it reports to the deployment server it updates and brings down the correct stanza.

I have this question and don't know if it should be in a separate thread.

We have multiple deployments of SPLUNK in our company. We have the need to collect security events while the other deployments are collection application logs. We would like to install a separate instance of the universal forwarder in a separate folder with a service name matching the folder. I can do this by installing locally, zipping up the install, then unzip and reg poke the service configuration, but since I am using puppet and our SED folks will not allow a zip and power shell script to do this I need to use the MSI.

Is this possible?

Thanks!

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

richgalloway — Thu, 07 Sep 2017 22:21:57 GMT

That's a good question that should be posted in a new thread.