Getting Data In

How to Install and Configure 6.6.2 universal forwarder using MsiExec.exe

pfabrizi
Path Finder

I am trying to install the universal forwarder on Windows using this command.

msiexec.exe TARGETDIR="C:\PROGRAM Files\splunker-security" /i splunkforwarder-6.6.2-4b804538c686-x64-release.msi RECEIVING_INDEXER="10.83.180.135:9997,10.83.180.133:9997" WINEVENTLOG_SEC_ENABLE=1 AGREETOLICENSE=Yes

it seems to ignore the parameters after the .msi.

I have to use 2 deployment methods, 1 puppet and the other BMC, so I want to use the msi install as that is a requirement for our puppet deployments.

Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

TARGETDIR is not a recognized flag. Try INSTALLDIR. See http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/InstallaWindowsuniversalforwarderfrom...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

ddrillic
Ultra Champion

The following works for me -

msiexec.exe /i splunkforwarder-6.5.1-f74036626f0c-x64-release.msi  INSTALLDIR="E:\opt\splunk" DEPLOYMENT_SERVER="<host>:8089" AGREETOLICENSE=Yes SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet
0 Karma

pfabrizi
Path Finder

I have it working, I had to uninstall the version that I was running since it was the same.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

TARGETDIR is not a recognized flag. Try INSTALLDIR. See http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/InstallaWindowsuniversalforwarderfrom...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

pfabrizi
Path Finder

I get this error, am I missing a switch?

MSI (s) (E8:34) [14:55:53:542]: Package to be registered: 'splunkforwarder-6.6.2-4b804538c686-x64-release.msi'
MSI (s) (E8:34) [14:55:53:542]: Note: 1: 2205 2: 3: Error
MSI (s) (E8:34) [14:55:53:543]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (E8:34) [14:55:53:543]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E8:34) [14:55:53:543]: Rejecting product '{16F5098E-7399-41AF-AB7B-3F5CEF8E3340}': Non-assigned apps are disabled for non-admin users.
MSI (s) (E8:34) [14:55:53:544]: Note: 1: 1708
MSI (s) (E8:34) [14:55:53:544]: Product: UniversalForwarder -- Installation failed.

0 Karma

pfabrizi
Path Finder

I have it working at now, install and then once it reports to the deployment server it updates and brings down the correct stanza.

I have this question and don't know if it should be in a separate thread.

We have multiple deployments of SPLUNK in our company. We have the need to collect security events while the other deployments are collection application logs. We would like to install a separate instance of the universal forwarder in a separate folder with a service name matching the folder. I can do this by installing locally, zipping up the install, then unzip and reg poke the service configuration, but since I am using puppet and our SED folks will not allow a zip and power shell script to do this I need to use the MSI.

Is this possible?

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's a good question that should be posted in a new thread.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need admin privileges to install the forwarder. Are you using an account with admin rights?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!