Add index name during silent installation of Universal Forwarder

[sephora_it]

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/DeployaWindowsdfviathecommandline

I am installing the Universal Forwarder using SCCM and was wondering if there was a flag available for the index name. I am able to add everything else except for the index name using CLI flags. If not, is there another simple way to add it during silent installation?

[mcronkrite · Accepted solution]

If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver

Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf

But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.

[sephora_it]

So it sounds like there is no flag that can be set during installation. I've worked around the problem for now by inserting the information via script.

Eventually, we will use the deployment server, but don't have it set up yet.