Deployment Architecture

UF default setting

Path Finder

Is it safe to deploy the UF with these settings?

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="servername:9997"
AGREETOLICENSE=Yes
DEPLOYMENT_SERVER="servername"
INSTALLDIR="C:\Program Files\Splunk"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
/quiet

And then we just modify the UF once it is installed in the server and make changes depending on the server role (i.e. web server, domain controller, exchange, dmz, etc) so it will index the appropriate logs.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post