Deployment Architecture

UF default setting

Path Finder

Is it safe to deploy the UF with these settings?

msiexec /i splunkforwarder64bit.msi
RECEIVINGINDEXER="servername:9997"
AGREETOLICENSE=Yes
DEPLOYMENT
SERVER="servername"
INSTALLDIR="C:\Program Files\Splunk"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOGAPPENABLE=1
WINEVENTLOGSECENABLE=1
WINEVENTLOGSYSENABLE=1
/quiet

And then we just modify the UF once it is installed in the server and make changes depending on the server role (i.e. web server, domain controller, exchange, dmz, etc) so it will index the appropriate logs.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post