https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36952#M6830 <P>Thanks! CLI options work great.</P> Tue, 19 Feb 2013 20:33:19 GMT vragosta 2013-02-19T20:33:19Z https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36950#M6828 <P>I know that you can control the Universal Forwarder to grab historical event logs from Windows using "current_only = 1", but... how do you install the Universal Forwarder without it starting the SplunkForwarder service automatically?</P> <P>In other words, you can't modify inputs.conf, before it exits, to force it to not send over historical logs, correct? Am I missing something?</P> <P>Thanks!</P> Tue, 19 Feb 2013 19:04:51 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36950#M6828 vragosta 2013-02-19T19:04:51Z https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36951#M6829 <P>Option 1: Install with the command line parameter STARTSPLUNK=0 to not have Splunk forwarder start automatically (with caveats- see <A href="http://docs.splunk.com/Documentation/Splunk/latest/installation/installonwindowsviathecommandline">command line installer documentation</A>. </P> <P>Option 2: Install splunk, point to a deployment server during installation. Keep all other defaults (no receiving indexer, no logs to monitor, etc). On your deployment server, create one or more apps with all of the appropriate settings for your environment... this is what we do. See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Aboutdeploymentserver">deployment server documentation</A>.</P> Tue, 19 Feb 2013 20:03:37 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36951#M6829 jeff 2013-02-19T20:03:37Z https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36952#M6830 <P>Thanks! CLI options work great.</P> Tue, 19 Feb 2013 20:33:19 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-Conf-Historical-Logging-Chicken-and-the-Egg/m-p/36952#M6830 vragosta 2013-02-19T20:33:19Z