Deployment Architecture

Can I extend the purpose of the Deployment Server for general software distribution, such as making a Splunk app perform a scripted install?

untieshoe
Path Finder

Can I piggy-back (insert) a Win32 setup.exe (windows program) onto a Splunk App, and use Splunk Deployment Server to deploy the Splunk app, and have the deployed Splunk app run a script that performs an unattended installation of the setup.exe on the target system, using SYSTEM privileges?

0 Karma

lukejadamec
Super Champion

Yes you can, but you should be very familiar with how the deployment server works first.

I once used the deployment server to reconfigure some Splunk apps and other system changes outside of Splunk, but the content pushed to the servers was designed to self-destruct so that it would not get re-deployed and not continually trigger once deployed.
So, Yea you can do it, just make sure you know what you're doing.

One suggestion, you might want to have the script copy the installer to a temp directory before the script executes the installer because your system may prohibit installers from running in the program files directory.

untieshoe
Path Finder

Thanks lukejadamec.

So I split the problem into two parts:

  1. Deliver the source binary (in my case my_prog.msi) to the target as part of the app, and copy the binary to a non-app location (c:\temp) using a script (in my case a BAT file) that runs only once (interval = -1):

    ###### Scripted Input
    [script://.\bin\Copy_VSC.bat]
    interval = -1
    

That works fine.

  1. Install the software binary and ensure the install script (in my case a BAT file) runs only once:

    Scripted Input

    [script://.\bin\Install_VSC.bat]
    interval = -1

The problem is with the command in the Install_VSC.bat file. I have:

c:\windows\system32\msiexec.exe /i "c:\temp\my_prog.msi" /q CONN_INTG_SVC=TRUE INTG_SERVERS=VM301:29522

This appears to work, but the result is imperfect, compared to if I install manually as a local admin using the exact same command. Using the deployment server method, files are installed, a service is installed and it launches, and all the options (switches) appear to be used during the install, but the installed program fails in a critical way when installed using the deployment server method.

I am wondering whether I should use a .path file in inputs.conf in order to reference the out-of-app locations and executables such as msiexec.exe.
Or maybe I need "start_by_shell = true" in the inputs.conf.

Any suggestions/experience with this? Thank you.

0 Karma

lukejadamec
Super Champion

Without knowing the error it is hard to say.
If you compare the service properties between the local and remote install, is the Log On user the same?
Does it work after the remote system is rebooted?

0 Karma

untieshoe
Path Finder

I'm not just being 'cheap'. I have my reasons for wanting to do this...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...