How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

[pfabrizi]

I am trying to install the universal forwarder on Windows using this command.

msiexec.exe TARGETDIR="C:\PROGRAM Files\splunker-security" /i splunkforwarder-6.6.2-4b804538c686-x64-release.msi RECEIVING_INDEXER="10.83.180.135:9997,10.83.180.133:9997" WINEVENTLOG_SEC_ENABLE=1 AGREETOLICENSE=Yes

it seems to ignore the parameters after the .msi.

I have to use 2 deployment methods, 1 puppet and the other BMC, so I want to use the msi install as that is a requirement for our puppet deployments.

Thanks!

[ddrillic]

The following works for me -

msiexec.exe /i splunkforwarder-6.5.1-f74036626f0c-x64-release.msi  INSTALLDIR="E:\opt\splunk" DEPLOYMENT_SERVER="<host>:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet

[pfabrizi]

I have it working, I had to uninstall the version that I was running since it was the same.

[richgalloway · Accepted solution]

TARGETDIR is not a recognized flag. Try INSTALLDIR. See http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/InstallaWindowsuniversalforwarderfrom...

[pfabrizi]

I get this error, am I missing a switch?

MSI (s) (E8:34) [14:55:53:542]: Package to be registered: 'splunkforwarder-6.6.2-4b804538c686-x64-release.msi'
MSI (s) (E8:34) [14:55:53:542]: Note: 1: 2205 2: 3: Error
MSI (s) (E8:34) [14:55:53:543]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (E8:34) [14:55:53:543]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: Rejecting product '{16F5098E-7399-41AF-AB7B-3F5CEF8E3340}': Non-assigned apps are disabled for non-admin users.
MSI (s) (E8:34) [14:55:53:544]: Note: 1: 1708
MSI (s) (E8:34) [14:55:53:544]: Product: UniversalForwarder -- Installation failed.

[pfabrizi]

I have it working at now, install and then once it reports to the deployment server it updates and brings down the correct stanza.

I have this question and don't know if it should be in a separate thread.

We have multiple deployments of SPLUNK in our company. We have the need to collect security events while the other deployments are collection application logs. We would like to install a separate instance of the universal forwarder in a separate folder with a service name matching the folder. I can do this by installing locally, zipping up the install, then unzip and reg poke the service configuration, but since I am using puppet and our SED folks will not allow a zip and power shell script to do this I need to use the MSI.

Is this possible?

Thanks!

[richgalloway]

That's a good question that should be posted in a new thread.

[richgalloway]

I think you need admin privileges to install the forwarder. Are you using an account with admin rights?