Getting Data In
Highlighted

Add index name during silent installation of Universal Forwarder

Explorer

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/DeployaWindowsdfviathecommandline

I am installing the Universal Forwarder using SCCM and was wondering if there was a flag available for the index name. I am able to add everything else except for the index name using CLI flags. If not, is there another simple way to add it during silent installation?

Highlighted

Re: Add index name during silent installation of Universal Forwarder

Contributor

If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver

Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf

But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.

View solution in original post

Highlighted

Re: Add index name during silent installation of Universal Forwarder

Explorer

So it sounds like there is no flag that can be set during installation. I've worked around the problem for now by inserting the information via script.

Eventually, we will use the deployment server, but don't have it set up yet.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.