Getting Data In
Highlighted

How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

Path Finder

I am trying to install the universal forwarder on Windows using this command.

msiexec.exe TARGETDIR="C:\PROGRAM Files\splunker-security" /i splunkforwarder-6.6.2-4b804538c686-x64-release.msi RECEIVINGINDEXER="10.83.180.135:9997,10.83.180.133:9997" WINEVENTLOGSEC_ENABLE=1 AGREETOLICENSE=Yes

it seems to ignore the parameters after the .msi.

I have to use 2 deployment methods, 1 puppet and the other BMC, so I want to use the msi install as that is a requirement for our puppet deployments.

Thanks!

0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

SplunkTrust
SplunkTrust

TARGETDIR is not a recognized flag. Try INSTALLDIR. See http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/InstallaWindowsuniversalforwarderfrom...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

Path Finder

I get this error, am I missing a switch?

MSI (s) (E8:34) [14:55:53:542]: Package to be registered: 'splunkforwarder-6.6.2-4b804538c686-x64-release.msi'
MSI (s) (E8:34) [14:55:53:542]: Note: 1: 2205 2: 3: Error
MSI (s) (E8:34) [14:55:53:543]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (E8:34) [14:55:53:543]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: Rejecting product '{16F5098E-7399-41AF-AB7B-3F5CEF8E3340}': Non-assigned apps are disabled for non-admin users.
MSI (s) (E8:34) [14:55:53:544]: Note: 1: 1708
MSI (s) (E8:34) [14:55:53:544]: Product: UniversalForwarder -- Installation failed.

0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

SplunkTrust
SplunkTrust

I think you need admin privileges to install the forwarder. Are you using an account with admin rights?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

Path Finder

I have it working at now, install and then once it reports to the deployment server it updates and brings down the correct stanza.

I have this question and don't know if it should be in a separate thread.

We have multiple deployments of SPLUNK in our company. We have the need to collect security events while the other deployments are collection application logs. We would like to install a separate instance of the universal forwarder in a separate folder with a service name matching the folder. I can do this by installing locally, zipping up the install, then unzip and reg poke the service configuration, but since I am using puppet and our SED folks will not allow a zip and power shell script to do this I need to use the MSI.

Is this possible?

Thanks!

0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

SplunkTrust
SplunkTrust

That's a good question that should be posted in a new thread.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

Ultra Champion

The following works for me -

msiexec.exe /i splunkforwarder-6.5.1-f74036626f0c-x64-release.msi  INSTALLDIR="E:\opt\splunk" DEPLOYMENT_SERVER="<host>:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet
0 Karma
Highlighted

Re: How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

Path Finder

I have it working, I had to uninstall the version that I was running since it was the same.

0 Karma