Universal Fowarder Confiugration

[MikeFarmITP]

I'm not sure what I'm doing wrong here, but trying to configure a universal forwarder on Windows so it automatically sends all event logs, performance data etc. If I select this during the installation it just 'works', however that's with a custom install and checking all the boxes. If I do a regular install I cannot figure out how to enable those features. I am sending down to the forwarders the Splunk_TA_Windows.

The related item is that we need to send each universal forwarder to their specific index, I've been able to do this with modifying the input.conf file - is there a way to 'push' this to the forwarder instead?

[ddrillic]

we use something like - msiexec.exe /i splunkforwarder-6.5.1-f74036626f0c-x64-release.msi INSTALLDIR="E:\opt\splunk" DEPLOYMENT_SERVER="<host>.<domain>.com:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet

Works really well for us and the documentation is at Install a Windows universal forwarder from the command line

`

[somesoni2]

For regular install, you need to update (or create) the inputs.conf on Splunk_TA_Windows/local directory on the forwarder with a stanza for each WIndows Event Log monitoring that you want with attribute disabed = 0.
To distribute apps to forwarders, you can setup Splunk deployment server. See more details here. https://docs.splunk.com/Documentation/Splunk/6.5.1/Updating/Updateconfigurations