Deployment Architecture

UF default setting

eantonio
Path Finder

Is it safe to deploy the UF with these settings?

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="servername:9997"
AGREETOLICENSE=Yes
DEPLOYMENT_SERVER="servername"
INSTALLDIR="C:\Program Files\Splunk"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
/quiet

And then we just modify the UF once it is installed in the server and make changes depending on the server role (i.e. web server, domain controller, exchange, dmz, etc) so it will index the appropriate logs.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

This should be OK. You can then, later on, have your Deployment Server push out your inputs.conf according to each of your server classes.

> please upvote and accept answer if you find it useful - thanks!

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...