Installing Forwarder on Centos machine remotly

[khalidewaidah]

Dear ,
Do you have tested script in-order to install splunk forwarder last version remotely .

[gcusello]

Hi khalidewaidah,
I didn't installed just the last version, but some previous versions (7.2.0) and it was possible.
It was also a part of the old exam as Splunk Architect!

I used a shall script like this:

#!/bin/sh
# Script to remotely install Splunk forwarder

# to avoid to store readable password
read -s -p "Enter Splunk Admin Password: " PASSWORD
echo 

# Configuration file
source /home/archStudent/config.ini

# Command lists to execute in remote forwarder server
REMOTESCRIPT="
cd $DIRDEST
$WGETCMD
sudo tar -xzf $FWDTGZ
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user archStudent
sudo chown -R archStudent:splunk $DIRDEST/splunkforwarder
sudo -H -u archStudent $DIRDEST/splunkforwarder/bin/splunk restart
"

# Installation execution
echo "===================== FORWARDER REMOTE INSTALLER ============================="
echo
sleep 5
echo "Reading host logins from $TARGETSFILE"
echo 
echo "Start Forwarder remote installation to:"

# hosts cycle
for DEST in `cat "$TARGETSFILE"`; do

    if [ -z "$DEST" ]; then
        continue;
    fi
    echo 
    echo "- $DEST"
    ssh "$DEST" "$REMOTESCRIPT"

done

and a config.ini file like this:

TARGETSFILE="/home/archStudent/targets.ini"
DIRDEST="/opt"
WGETCMD="sudo wget -O splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.0.2&product=universalforwarder&filename=splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz&wget=true'"
FWDTGZ="/opt/splunkforwarder-7.0.2-03bbabbd5c0f-Linux-x86_64.tgz"
DEPLOYSERVER="CUSELLO-SEARCH:8089"

Ciao.
Giuseppe