UF default setting

[eantonio]

Is it safe to deploy the UF with these settings?

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="servername:9997"
AGREETOLICENSE=Yes
DEPLOYMENT_SERVER="servername"
INSTALLDIR="C:\Program Files\Splunk"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
/quiet

And then we just modify the UF once it is installed in the server and make changes depending on the server role (i.e. web server, domain controller, exchange, dmz, etc) so it will index the appropriate logs.

[_d_ · Accepted solution]

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!