Getting Data In

Add index name during silent installation of Universal Forwarder

sephora_it
Explorer

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/DeployaWindowsdfviathecommandline

I am installing the Universal Forwarder using SCCM and was wondering if there was a flag available for the index name. I am able to add everything else except for the index name using CLI flags. If not, is there another simple way to add it during silent installation?

1 Solution

mcronkrite
Splunk Employee
Splunk Employee

If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver

Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf

But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.

View solution in original post

mcronkrite
Splunk Employee
Splunk Employee

If you are not using Deployment Server to manage your forwarders http://docs.splunk.com/Documentation/Splunk/6.0.2/Updating/Aboutdeploymentserver

Then, you should create an inputs.conf (which specifies the index you want) that gets sent down with the UF
http://docs.splunk.com/Documentation/Storm/Storm/User/SetupauniversalforwarderonWindows
Setup the inputs.conf to monitor the files you are interested in.
http://docs.splunk.com/Documentation/Storm/Storm/User/Editinputsconf

But if you have a big deployment of UF then you probably really should check out Deployment Server to manage your forwarder configurations.

sephora_it
Explorer

So it sounds like there is no flag that can be set during installation. I've worked around the problem for now by inserting the information via script.

Eventually, we will use the deployment server, but don't have it set up yet.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...