Dear ,
Do you have tested script in-order to install splunk forwarder last version remotely .
Hi khalidewaidah,
I didn't installed just the last version, but some previous versions (7.2.0) and it was possible.
It was also a part of the old exam as Splunk Architect!
I used a shall script like this:
#!/bin/sh
# Script to remotely install Splunk forwarder
# to avoid to store readable password
read -s -p "Enter Splunk Admin Password: " PASSWORD
echo
# Configuration file
source /home/archStudent/config.ini
# Command lists to execute in remote forwarder server
REMOTESCRIPT="
cd $DIRDEST
$WGETCMD
sudo tar -xzf $FWDTGZ
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user archStudent
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk restart
"
# Installation execution
echo "===================== FORWARDER REMOTE INSTALLER ============================="
echo
sleep 5
echo "Reading host logins from $TARGETSFILE"
echo
echo "Start Forwarder remote installation to:"
# hosts cycle
for DEST in `cat "$TARGETSFILE"`; do
if [ -z "$DEST" ]; then
continue;
fi
echo
echo "- $DEST"
ssh "$DEST" "$REMOTESCRIPT"
done
and a config.ini file like this:
TARGETSFILE="/home/archStudent/targets.ini"
DIRDEST="/opt"
WGETCMD="sudo wget -O splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.0.2&product=universalforwarder&filename=splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz&wget=true'"
FWDTGZ="/opt/splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz"
DEPLOYSERVER="CUSELLO-SEARCH:8089"
Ciao.
Giuseppe