Getting Data In

How to deploy the Universal Forwarder 6.2.2 to a few hundred Windows 2008 R2 servers via Group Policy?

rsickler
Explorer

I've been tasked with installing the Splunk Universal Forwarder (splunkforwarder-6.2.2-255606-x64-release.msi) to a few hundred Server 2008-R2 machines. Normally, I'd just do this via a GPO (Computer Configuration > Policies > Software Settings > Software Installation > SplunkForwarder) but this one is different. I've spent two days scouring the web, looking for ways to deploy it, but I've come away with nothing but failures!

Sure, I could create a text file full of server names and then have some crazy script that does a for-loop and loops through all of them but, that doesn't scale well... It'll work for now, but what about months or years from now when more or new servers come online? Will anyone remember to adjust the script and run it? I don't particularly like MS' way of using GP to install software via the Software Installation section, but it beats following a more manual process.

Does anyone here know of a currently working deployment method? I even tried my old standby which is to deploy a one-time Scheduled Task to run something like: msiexec.exe /i "splunkforwarder-6.2.2-255606-x64-release.msi" AGREETOLICENSE=Yes /quiet. However, evidently, MS has deployed a patch to keep people from deploying scheduled tasks via GP that contain a domain user and password.

I've tried a startup PowerShell script, but that failed.... I'm currently trying to debug a startup CMD script. I'm running out of time and ideas so any help would be great.

Tags (3)
1 Solution

rsickler
Explorer

Well, you need a bit more than just your deployment tips; it's a combination of yours and mine.

What was needed:

  • The MST file, tweaked to accept the EULA.
  • In the GPO, under advanced deployment options, ignore the language when deploying.
  • In the GPO, under advanced deployment options, include OLE class & product info.

So, thanks for the hot tip on the software deployment tweaks for the GPO. I already had the MST and your tips took me the rest of the way.

View solution in original post

rsickler
Explorer

Well, you need a bit more than just your deployment tips; it's a combination of yours and mine.

What was needed:

  • The MST file, tweaked to accept the EULA.
  • In the GPO, under advanced deployment options, ignore the language when deploying.
  • In the GPO, under advanced deployment options, include OLE class & product info.

So, thanks for the hot tip on the software deployment tweaks for the GPO. I already had the MST and your tips took me the rest of the way.

bravon
Communicator

Indeed - no problem.

0 Karma

Gstines
Engager

Hi Bravon,

I know this is an older post... But I'm attempting to do this now. I've made the GPO advanced deployment options that are suggested and also created the MST file with the options we would like configured for the install. Still the policy is not installing on the client I am testing this on. Did you run into any other issues? Or any idea what the issue could be? I confirmed the options I used were correct by opening the install manually with the suggested property values I added. They values had the correct checkboxes and data filled in already. I'm not sure where the hang up is.

0 Karma

bravon
Communicator

Should have answered as an answer and not a comment 😛

We deploy 6.1.4, with the following
"Advanced Deployment Options
Settings", it may be of help: Ignore
language when deploying this package;
Enabled Make this 32-bit X86
application available to Win64
computers; Enabled Include OLE class
and product information; Enabled

rsickler
Explorer

At least with v6.2, you also need an MST file because you need to accept the EULA and you can't make any changes to the command that is used for the install when you install it via GP. Not sure if you ran into that or not...

I used Orca and looked at the Property table where I found the AGREETOLICENSE property and changed it from No to Yes. I manually tested that via the following command and it worked fine but it still failed when I tried to deploy via GP:

splunkforwarder-6.2.2-255606-x64-release.msi TRANSFORMS=splunkforwarder-6.2.2-255606-x64-release.mst /quiet

More info here:
http://blogs.splunk.com/2013/11/12/installing-the-splunk-6-0-universal-forwarder-on-windows/

As for your note about advanced settings, I could not find the option for making the 32-bit package available for 64-bit machines but it saw my package as a 64-bit package and we don't do 32-bit. I found and applied the other options and the combination of my MST and your tweaks seemed to have done the trick, so I'll move on and test a few more deployments.

bravon
Communicator

We use an .mst with Property ->
AGREETOLICENCE=YES
DEPLOYMENT_SERVER = deployserver:8089

Where do you store the .msi and .mst file? It may be unaccessable during logon/permissions etc but work OK when you run it manually as an admin perhaps?

0 Karma

rsickler
Explorer

I always store our MSTs with the MSI...

It looks to be working correctly. I've tested a few other servers and it deploys just fine on a reboot now. Like I said, I had the MST file but I must have been missing those advanced settings you mentioned.

bravon
Communicator

We deploy 6.1.4, with the following
"Advanced Deployment Options Settings", it may be of help:
Ignore language when deploying this package; Enabled
Make this 32-bit X86 application available to Win64 computers; Enabled
Include OLE class and product information; Enabled

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...